Federal Statutes
The Gramm-Leach-Bliley
Act:
Requiring every business who accesses or uses a customer's
personal financial information to issue a privacy statement that notifies
its customers “in clear and conspicuous language” on an annual basis how
that information is collected and used and to comply with its stated
privacy policy to protect the privacy of such information;
The Health Insurance
Portability and Accountability Act:
Requiring every business who
accesses or uses an individual's protected health information to issue a
privacy statement that notifies such individuals on an annual basis how
that information is collected and used and to comply with its stated
privacy policy to protect the privacy of such information;
The Sarbanes Oxley
Act:
Requiring accountants who audit or review Financial Statements
for a business to retain certain business records relating to that audit
or review; and imposing criminal liability on any business that engages in
document destruction, even if such document destruction occurs before the
business has any formal notice of an official proceeding, and without the
necessity of proving a bad intent for the destruction, i.e., a “corrupt
persuasion.”
Securities and Exchange
Commission (SEC):
A 1997 amendment to the Securities and Exchange
Commission (SEC) Act requires financial institutions to keep records of
digital communications between broker/dealers and customers. Records must
be stored on media that are not subject to change, are easily accessible
for the first two years and retains unchanged for no fewer than six
years.
What is required to be
compliant?
Regulations today require a company's top management
to:
(a) Affirm their
ultimate responsibility for the company's internal financial controls in
writing in their annual report;
(b) Provide an assessment of and
attest to the effectiveness of those controls; and
(c) Obtain a
separate report from a third-party auditor evaluating and validating
management's assessment of the company's controls. To achieve this it will
be critical to have controls, policies and procedures in place and
documented.
- What does this mean for
business today?
Email is no longer a novelty to conduct business today for small or large, privately owned or publicly traded companies - Email is considered admissible as a business record in a court of law by way of defense against litigation