Managing enterprises better in the 21^st century

By John Kyriazoglou

1. Introduction

According to various sources¹ ‘management control’ is a management function aimed at achieving defined goals within an established timetable, and usually understood to have three components:

(1) Setting standards,

(2) Measuring actual performance, and

(3) Taking corrective action.

In practical business terms, management controls, in a private company or public organizational environment, are used daily by managers and employees to accomplish the identified objectives of an organization (private company, public organization, or business entity, called ‘enterprise’ in this article).

Simply put, management controls are the operational methods that enable work to proceed as expected. 

Management is responsible for establishing and maintaining the business management control environment. Auditors play a role in a system of internal controls by performing evaluations and making recommendations for improved controls. Furthermore, every employee plays a role in either strengthening or weakening the specific company’s internal business management control system. Therefore, all employees need to be aware of the concept and purpose of internal business management controls.

How many, of these business management controls, however, does an enterprise need?

For more details, download the article from the following link:

http://www.slideshare.net/jkyriazoglou/managing-enterprises-better-in-the-21st-century

Preparing for the EU General Data Protection Regulation (GDPR)

By John Kyriazoglou

Is your company ready?

What steps should you, as a manager, executive or board director take for your company by May, 2018?

My new book ‘Data Protection and Privacy Guide’ in five volumes (see links at the end), is designed to support you effectively in all these issues.

I am providing below a short summary of the GDPR and how it impacts your business operations (including your IT systems) and a flavor of what is contained in these volumes.

1. Introduction to the EU GDPR

On April 2016, the EU General Data Protection Regulation (GDPR) was approved, entering a two-year transition period (April 2016 to May 2018) during which member states and enterprises (private companies and public organizations) handling European residents’ personal data will need to adopt the new requirements. The Regulation introduces tough penalties for non-compliance, with breached organizations facing fines of up to 4% of annual global turnover or €20 million – whichever is greater.

The new law dramatically changes the way in which organizations approach personal data protection (for customers, employees, etc.), particularly in terms of access privileges. With financial penalties in place, which can be as much as 4 per cent of a corporation’s annual turnover, enterprises simply cannot afford to let personal data slip into the wrong hands through mismanagement or a malicious breach. One way to ensure this doesn’t happen is for personal data to be secured under lock and key with the help of identity governance, where entry is monitored and controlled around the clock, etc.

2. Preparing for the General Data Protection Regulation (GDPR)

What basic steps to take by May, 2018:

Step 1: Awareness. You should make sure that decision makers and key people in your company or organization are aware that the law is changing to the GDPR.

Step 2: Data Protection Officers. You should designate a Data Protection Officer, if required, or someone to take responsibility for data protection compliance and assess where this role will sit within your organization’s structure and governance arrangements.

Step 3: Personal Data you hold. You should document what personal data you hold, where it came from and who you share it with. You may need to organize a personal data audit, etc.

Step 4: Individuals’ rights. You should check your corporate procedures to ensure they cover all the rights individuals have, including how you will handle requests within the new timescales and provide any additional information, how you would delete personal data or provide data electronically and in a commonly used format, etc.

Step 5: Communicating privacy information. You should review your current privacy notices and put a plan in place for making any necessary changes in time for GDPR implementation.

Step 6: Legal basis for processing personal data. You should look at the various types of data processing you carry out, identify your legal basis for carrying it out and document it.

Step 7: Consent. You should review how you are seeking, obtaining and recording consent and whether you need to make any changes.

Step 8: Children. You should start thinking now about putting systems in place to verify individuals’ ages and to gather parental or guardian consent for the data processing activity.

Step 9: Data breaches. You should make sure you have the right procedures in place to detect, report and investigate a personal data breach.

Step 10: Data Protection Impact Assessments (DPIA). You should familiarize yourself now with the guidance regarding when to carry out a DPIA. For example where a new technology is being deployed or where a profiling operation is likely to significantly affect individuals, etc.

Step 11: Data Protection by Design and by Default. You should ensure that all your products produced and sold and all services provided (including Information systems) by your company implement privacy and data protection according to the principles of the GDPR.

Step 12: International Operations. If your company operates internationally, you should determine which data protection supervisory authority you come under.

3. Resources to support you in implementing the EU GDPR

As noted above, my new book ‘Data Protection and Privacy Guide’ in five volumes (see links at the end), is designed to support you in all these issues.

This book, in 5 volumes, contains a complete set of methods, strategies, plans, policies, audit tools and other practical techniques to guide, support and facilitate you to effectively manage the personal data your company collects and processes and comply better with all privacy regulations (e.g. EU GDPR).

1. Data Protection and Privacy Management System: Data Protection and Privacy Guide – Vol I

http://bookboon.com/en/data-protection-and-privacy-management-system-ebook

2. DP&P Strategies, Policies and Plans: Data Protection and Privacy Guide – Vol II

http://bookboon.com/en/dpp-strategies-policies-and-plans-ebook

3. Data Protection Impact Assessment: Data Protection and Privacy Guide – Vol III

http://bookboon.com/en/data-protection-impact-assessment-ebook

4. Data Protection Specialized Controls: Data Protection and Privacy Guide – Vol IV

http://bookboon.com/en/data-protection-specialized-controls-ebook

5. Security and Data Privacy Audit Questionnaires: Data Protection and Privacy Guide – Vol V

http://bookboon.com/en/security-and-data-privacy-audit-questionnaires-ebook

Thank you,

John Kyriazoglou

Data Protection Impact Assessment Toolkit

This is available at:

http://flevy.com/browse/business-document/data-protection-impact-assessment-eu-gdpr-requirement-2543

Summary

This document describes a set of methods and tools that enable, facilitate and support you in assessing your data protection risks and executing a Data Protection Impact Assessment

(DPIA) for existing as well as for new products, services, systems, functions and information systems, that collect, process and maintain personal data.

It may also be used to evaluate the data protection and privacy risks of the personal data your company collects, processes and stores and to comply with the requirements of the EU General Data Protection Regulation (Articles 27, 28, 34, 35, 36, 39, 53, 57, 58, 64 and recitals 53 and 58) for any enterprises located within the EU or doing business in the EU, regardless of their home base and central location offices (headquarters).

Table of Contents

Chapter 1: Summary of the New EU General Data Protection Regulation

Chapter 2: Data Protection Impact Assessment Methodology

Chapter 3: Data Protection and Privacy Audit Tools

Annex 1: Data Protection Impact Pre-Assessment Survey

Annex 2: Data Protection Risk Identification Questionnaire

Annex 3. Privacy Risk Register

Annex 4. Suggested DPIA Report Format

Annex 5. Proposed Risk Resolution Actions

Annex 6: Personal Data Checklist

This is available at:

http://flevy.com/browse/business-document/data-protection-impact-assessment-eu-gdpr-requirement-2543

A Manager’s ‘duty of care’ responsibilities

By John Kyriazoglou

Plato: ‘The most important of all goods is health, the second is beauty of the soul and the third is to be able to become rich without doing anything bad’.

This short article describes a plan for improving the responsibilities you have as a business owner, board director or manager towards the wellbeing of your employees.

Introduction

Our workplaces are full of problems, to put it lightly. According to the World Health Organization ‘Mental health problems, such as depression, anxiety, substance abuse and stress, are common, affecting individuals, their families and co-workers, and the broader community. In addition, they have a direct impact on workplaces through increased absenteeism, reduced productivity, and increased costs¹.’

As 60-70% of people with common mental disorders were in work, according to various experts and governmental studies, it is up to each company and its individual owners and managers to do something about these crucial and debilitating problems at work.

The principle that investing in support for employees who may be struggling is not just morally correct but a financial imperative is well established, according to experts².

Also you must remember that your staff, quite rightly so, are the single most valuable asset your organization has. This definitely means that when they work and travel for your company, you need to be assured of their safety at all times, to the best of your abilities.

In general terms, a manager’s or professional’s duty of care responsibility is a legal, and many times, professional obligation, which is imposed on an individual manager or professional, requiring them to adhere to a standard of reasonable care while performing their duties and avoid any acts that could foreseeably harm others (organizations, societies, people, environment, et).

In practical terms, duty of care means that every party to a contract must comply well according to the rules included in it as well as other relevant industry and state laws and regulations on ethics, health and safety. The same goes for an accountant in correctly maintaining financial transactions and preparing company accounts; Auditors, in confirming the financial statements of a company; Board and managers in managing well their corporate resources, etc.

More details at:

http://www.slideshare.net/jkyriazoglou/a-managers-duty-of-care-responsibilities