compliance-risk

Compliance & Risk for BA

Missing compliance costs way more than building it right.

What is Compliance & Risk Domain Knowledge?

Definition: Understanding regulatory, legal, and business risks - requirements that must be met, constraints that limit options, and potential failures that must be mitigated.

Why it matters:

• Missed compliance: Fines ($1M+), legal liability, shut-down risk
• Security failures: Customer data breach, reputation damage, legal liability
• Business continuity: System down = revenue/operations stop
• Risk blindness: Unknown risks hit you (data loss, fraud, security)
• Late-stage discovery: Building compliance after launch is 10x harder/expensive

When to Use:

• ✅ Understanding regulatory requirements
• ✅ Assessing compliance impact on design
• ✅ Identifying security risks
• ✅ Planning risk mitigation
• ✅ Building business continuity plans

---

5 Core Risk & Compliance Concepts

1. Regulatory Requirements by Industry

Different industries have dramatically different requirements.

HEALTHCARE (HIPAA):
Requirements:
- Patient data must be encrypted in transit and at rest
- Access logging (who accessed what, when)
- Audit trails for compliance
- Business associate agreements with vendors
- Annual compliance training for all staff
Impact on design:
- Complex encryption architecture
- Detailed audit logging (impacts performance)
- Vendor vetting required
Cost: 20-30% of project

FINANCE (PCI-DSS):
Requirements:
- Credit card data must be encrypted
- Quarterly security assessments
- Intrusion detection systems
- Network segmentation
- Restricted employee access
Impact on design:
- Cannot store card data (use payment processors)
- Security infrastructure complex
Cost: 15-25% of project

E-COMMERCE (GDPR/CCPA):
Requirements:
- User consent for data collection
- Right to access/delete data
- Data breach notification (72 hours)
- Privacy policy
Impact on design:
- Consent management system
- Data export functionality
- Data deletion functionality
Cost: 10-20% of project