The New Compliance Landscape

From Standard to Business Advantage

Security standards and risk mitigation practices will not be universal across all sectors of the auto finance industry. While SOC 2 compliance may be preferred for a partner such as a forwarder, it may not be necessary for a repossession agent, depending on how data is shared and used. Whether a lender should require SOC 2 compliance of their vendors needs to be a conversation between their legal counsel, third-party management, information technology, and compliance professionals. Security needs vary based on multiple factors, and some lenders may find that requiring SOC 2 Type 2 compliance for all partners is not the best choice for their organization. SOC 2 Type 2 is an independent audit studying the effectiveness of security controls over an extended window, typically three to twelve months, while SOC 2 Type 1 evaluates controls at a single point in time. Organizations should ask their vendors: What data flows to your vendors? Is it anonymized? Is artificial intelligence being used in workflows and if so, what kind? Lenders will also need to consider how far their vendor oversight will extend based on their risk appetite and security needs.

As artificial intelligence becomes more readily available at both consumer and enterprise levels, leaders across sectors of the industry need to evaluate operational needs and data security requirements. With the adoption of AI tools outpacing governance, it is up to each organization to manage risk and AI use internally to ensure their compliance standards are being met and prioritize conversations with their vendors regarding AI use. If AI is being utilized in an organization’s workflows, what oversight is in place to ensure compliance and output standards are met? A company that does not provide an approved AI tool for employees will find itself at greater risk of “shadow AI” use, which they will not be able to appropriately govern. Shadow AI can be as simple and well-intentioned as an employee using a consumer AI tool to streamline an email. Evaluating and implementing an enterprise-level AI tool for employee use will require the involvement of several departments, from IT and Compliance to HR, Training, and Communications. Providing an AI tool that meets security requirements, establishing responsible use policies, and appropriately training staff on the new policies and use of the approved software is the best way to reduce shadow AI and its associated risks to an organization.

As the compliance landscape continues to evolve, leaders must balance maintaining existing standards, evaluating what should be required of partners, and managing emerging risks. Standardizing methodology, implementing automation, and tracking potential legislative changes early will allow compliance leaders to effectively ensure continuous compliance and mitigate emerging risks efficiently. As assignments move through the different sectors of the auto finance and repossession industry, operations are outsourced, but risk is not. While it may be necessary for a forwarder to remain SOC 2 Type 2 compliant, businesses may find that it isn’t needed for every vendor they partner with. Risk mitigation practices will vary, but organizations must ensure that employees receive appropriate training for the data that they handle and that their partners do the same. Shadow AI risks can be reduced by providing an appropriate tool based on business needs and compliance requirements, and establishing responsible use policies. Industry wide more opportunities are being created for leaders to collaborate on standardizing compliance requirements at each level, best practices for known risks, and handling emerging risks.