It’s allergy season over in this part of California ( East San Francisco Bay Area ), and the prominent allergic symptom that I’ve been dealing with for a number of years now, is an annoying cough.  So, allergies struck over the Memorial Day weekend, which left me with that nasty cough for the week. Thursday morning I was in the shower, coughing my brains out, when one good, deep-diaphragm cough, put just enough strain on my lower back to yield that oh so familiar clench, which almost brought me to my knees.

Here we go again.

By this time, I knew the drill. Fortunately, my wife was in shouting distance, so she rushed in , and escorted me to the bed, where I quickly assumed the horizontal position I would stay in for the next four days. In under a minute, I had two pillows under my knees, an ice pack around my entire lower back, a call into my doctor for a muscle relaxer, and the Food Network channel on the TV. I then proceeded down the frustrating and disappointing route of cancelling all my appointments and commitments for the rest of the week.

This is the drill.

Fortunately, it’s Tuesday now, and I seem to be recovering well. There’s still some pain, and I carry around my back brace just in case, however I can get around without it now.

My doctor explains that I will probably have to deal with this for the rest of my life. In his words, “Once a patient of back pain, always a patient of back pain.” My chiropractor, a Palmer graduate and excellent practitioner, seems to have a different point of view. She says that since my core muscles ( abdomen and surrounding muscles ) are not developed, my lower back has to support all of my weight. There are a number of problems with this:

1)      Nobody’s lower back should be responsible for supporting the entire weight of their body. The lower back muscles aren’t built for that.

2)      My lower back has already been compromised, so it’s in an even worse position to support my body weight.

3)      At 220 lbs, I’m overweight. Even more work for my lower back to do.

As an optimist, and generally positive thinker, I tend to believe my chiropractor. So, this experience has given me a renewed interest in keeping up with my chiropractor, and her methods for strengthening my core muscles.

Of course, any organization – your organization – can fall prey to the same situation. You company can develop a chronic weakness, or “weak spot” when it comes to compliance. This could be in data privacy, network security, segregation of duties … any number of areas.

I’m not necessarily talking about gaps that are identified, and then remedied. I’m talking about violations that are known, that your company is trying to rectify, but they just can’t seem to get their arms around. In fact, in spite of all the money and other resources thrown at the problem, it might just be getting worse! This your company’s Achilles Heel.

So what can you do? How do you deal with your company’s compliance weaknesses?

Well, with the role you probably play, chances are you cannot solve your company’s problem. You do however play a very important role. This is where your company needs you the most, because information is power, and you are the gatekeeper to the information. These are my recommendations for your company, and what you can do to support it.

Step # 1 : Clearly Characterize the Weakness

The more objective data you have about the weakness, the better.  Collect as much data as you can about the weakness. Resist the urge to solve anything at this point, as you will probably jump to spurious conclusions. Collect data in time-series to see if there are any trends you should be aware of. If there are no trends, collect data at random to see if you can characterize the distribution shape, location, and spread. Use your knowledge of data collection and analysis to bring objective, indisputable statistics around your situation.

Step #2 : Encourage Management to Disclose the Situation and Communicate in Precise Terms

It’s dangerous at this point to downplay or exaggerate your problem.  Once you know exactly what you’re dealing with, open and honest communication with everyone involved is the best course of action. Disclosure to management, auditors, and any stakeholders or shareholders is a must. If this weakness is “uncovered” in an audit, without your prior disclosure, things will be 10 times worse. Use your data analysis to keep people honest.

Step #3 : Understand Where You Must Be, and Where You Want To Be

This is your tolerance for non-compliance. When you ask most people what their tolerance for non-compliance is, they will pound their chest and tell you, “Zero Tolerance!” In most cases this is unrealistic, and such bravado, although admirable, should be immediately excused. There’s nothing I can do to get my back to 100% efficiency, and if your company has a chronic weakness, you won’t get to zero tolerance overnight. Your management needs to agree on two metrics; where your company must be ( i.e. absolute minimum number of violations), and where your company would like to be (once again, zero tolerance is not probable, therefore not acceptable).

Step #4 : Accept, Improve, or Explode

If the problem can be accepted for what it is – do that. Do not waste resources on something that just “bothers” you. Accept it, and move on.

If there is a relatively small distance from where you are, to where you need to be, organize an improvement project. You will need to do some more analysis to validate root causes, and then come up with a plan for improvement based on your findings.

If you are a far distance from where you are to where you need to be, you need to blow up the whole process, and design a new one. Sorry, that’s the only answer.

Discovering chronic weaknesses in your company are no fun, and dealing with them is even more enervating. With your help however, your company can hopefully get the situation under control. By clearly understanding the nature of the problem, then communicating the weakness with an attitude of openness and honesty, you’re taking the right first steps. Finally find out where you need to be, then either accept it, improve it, or explode it.

The good news is, organizations are more flexible than humans. Although I will never get my back working like it did when I was 20 years old, your company has hope. That hope, coupled with this information, is your key to total compliance. My hope is that you recognize it, and use it.