Compliance &
Risk

BCP answers the question: if this site, system, or team becomes unavailable tomorrow, how do we keep delivering services?

• In GBS, processes are concentrated in a small number of hubs — making BCP existential, not optional.
• A natural disaster, pandemic, or infrastructure failure at a single hub can take out services for the entire enterprise.
• Planning for this is not pessimism — it is operational maturity.

Third-party risk is the risk your vendors introduce. Fourth-party risk is the risk your vendors' vendors introduce — and you often do not even know who they are.

• In GBS, outsourced and hybrid models are common — vendor risk management goes beyond contract terms.
• Scope covers: data handling practices, BCP readiness, and regulatory compliance of the entire supply chain.

When something goes wrong — a data breach, a system outage, a compliance violation — the speed and quality of your response determines the outcome.

• Incident playbooks define severity levels, escalation paths, communication templates, and resolution protocols — before the crisis hits.
• The teams that perform well under pressure are the ones who rehearsed the playbook when things were calm.

SoD ensures no single person can create, approve, and release a transaction.

• Toxic combinations are role pairings that create fraud or error risk — e.g. the same person who creates a vendor also approves payments to that vendor.
• In ERP systems, SoD is enforced through access controls.
• The GBS team that understands SoD prevents audit findings before they happen.

GDPR defines how personal data must be handled: lawful basis for processing, data minimization, right to erasure, breach notification within 72 hours.

• Even if your GBS hub is outside the EU — if you process EU resident data, GDPR applies.
• Practical implications: know what personal data your process touches, where it is stored, and who has access.

SOX (Sarbanes-Oxley) requires public companies to maintain effective internal controls over financial reporting.

• For GBS finance roles: documented processes, evidence of control execution, and audit trails for every transaction that feeds the financial statements.
• SOX is not a one-time project — it is an ongoing discipline that affects daily operations.

AML and sanctions screening verify your organization is not doing business with sanctioned entities, politically exposed persons, or known criminal networks.

• In GBS this applies to: vendor onboarding, customer due diligence, and payment processing.
• Missing a sanctions hit is not an error — it is a regulatory violation with criminal liability.

Retention policies define how long documents must be kept and when they must be destroyed.

• In GBS this covers: invoices, contracts, employee records, audit evidence, and communications.
• Keeping documents too long creates data privacy risk; destroying them too early creates compliance risk.
• The policy must balance both — and someone needs to actually enforce it.

Shadow IT is technology adopted by business teams without IT approval — personal cloud storage, unauthorized automation tools, ChatGPT for sensitive data processing.

• In GBS, shadow IT proliferates because official tools are slow to provision and often inadequate.
• The solution is not banning everything — it is providing approved alternatives fast enough that people do not need to go rogue.

ESG reporting is becoming mandatory for large companies — and GBS is directly in scope.

• GBS contributes through: energy consumption of operations, diversity metrics, labor practices in hubs, and governance of third-party vendors.
• Understanding how your GBS contributes to (or detracts from) the company ESG narrative is increasingly relevant for leadership roles.

As GBS deploys more AI — automated approvals, intelligent routing, predictive analytics — the question of who is accountable when the AI makes a wrong decision becomes critical.

• Ethical AI governance covers: bias testing, explainability requirements, human override protocols, and audit trails for automated decisions.
• The regulatory landscape is tightening — GBS leaders need to be ahead of it.

Social engineering attacks target the human, not the system.

• Phishing emails, impersonation calls, and business email compromise (BEC) are the most common attack vectors in GBS — because GBS teams process payments, handle credentials, and have system access.
• One click on a malicious link can bypass every technical security control your IT team built.
• Awareness is not annual training — it is daily vigilance.