Automotive Risk Management Partners ARMP

Why a Dealership Compliance Program Is a Sound Business Decision

Terry Dortch President, Automotive Risk Management Partners

Key takeaways

  • A dealership compliance program can be justified purely as a business decision, separate from regulatory penalties or audits.
  • Cyberattacks like the one that hit Finley disrupted business operations and cost thousands of dollars to address, illustrating a non-regulatory reason for cybersecurity investment.
  • A solid compliance program in the F&I office can reduce the personal worry a dealer principal carries about what is happening in that department.
  • Avoiding or mitigating regulatory risk is described as an ancillary benefit of having a good compliance program, not the primary reason to build one.
  • Dealers are advised not to be cheap or careless when choosing a compliance company and to select one that will take care of them.

Summary

A strong compliance program is worth building for reasons that go beyond avoiding fines or audits from the FTC, CFPB, or state attorneys general. Viewed simply as a business decision, weighing risk against reward the way any dealership evaluates a revenue opportunity, investing in compliance holds up on its own merits. Cybersecurity is one clear example: dealerships hit by breaches, like Finley's incident around the same time as the CDK hack, have faced major expense and serious disruption to daily operations, a cost no dealer wants to absorb.

Beyond cyber risk, a solid compliance program in the F&I office gives leadership peace of mind, letting a dealer principal or F&I director go home at night without worrying about what's happening on the floor. Regulatory protection then becomes a secondary benefit rather than the main reason to act. Dortch cautions dealers not to be cheap or careless when choosing a compliance partner, and to pick a company that will genuinely look after the store's interests rather than treating the program as a checkbox expense.

Transcript

Setting aside regulators to focus on business logic

Hi, my name is Terry Dortch. I'm with Automotive Risk Management Partners. You know, I want to talk to you today about regulations. Obviously, I'm a compliance company, or we're a compliance company, that's what we deal with, right? We deal with the regulatory aspects of the dealership. I want to talk to you and say, listen, forget forget the FTC, forget the CFPB, forget your state AGs for a minute. Let's forget about the regulatory aspects of compliance for a moment. Let's not worry about being fined or being audited. Let's just concentrate on what is a good business decision.

Business decisions as risk versus reward

You as business people, me as a business person, we have to make business decisions every day. Everything's based on a risk reward. It's based on, you know, what's what's the potential of of losing money, making money. If you're looking at a revenue generating aspect of your business, you're going to say, all right, what's how much do I have to invest to generate X number of dollars, what's it going to be. That's what we do as business people, right? We sit and we weigh all the odds and look at all the different things.

Cybersecurity costs as a business case example

So let's forget about the regulatory aspects for a moment. Is it or is it not a good business decision to have a compliance program that's robust and solid in your dealership? Of course it is. Forget the regulatory aspects of it. Having a compliance program in your dealership today does several things. One, from a cyber security standpoint, just ask Finley what it does. They've spent thousands and thousands of dollars to try to combat the hack that happened to them, just around the same time as CDK's hack happened. I've talked to the guys at Finley, they've spent a fortune on it. Not only that, it disrupted their business, a huge disruption in their business. So tell me, forget the regulatory aspect, that in and of itself is a reason to consider it.

F&I office peace of mind and regulatory benefit

Let's let's go back and let's look at just just from a business standpoint, from the physical aspects. If you have a solid compliance program in your F&I office, can you go home at night now and not have to worry about what's going on? Absolutely. So let's look at this from a standpoint of forget regulations, that's an ancillary part, right, that's the benefit. If we have a good compliance program, is a good business decision, I'm also going to avoid or mitigate any type of regulatory aspect.

Advice on choosing a compliance provider

Guys, when it comes to your compliance program, don't be cheap and don't be silly. Look for a company that's going to take care of you. Give us a call, we'll be more than happy to talk to you. Information is right here on the screen.

Questions this video answers

Why should a dealership have a compliance program if not just for regulatory reasons?

Because it is a sound business decision on its own. It helps avoid disruptions like the cyberattack Finley experienced, which cost them significant money and disrupted their business, and it can reduce a dealer's worry about what is going on in the F&I office.

What happened to Finley that relates to compliance and cybersecurity?

Finley was hit by a hack around the same time as the CDK hack and spent thousands and thousands of dollars trying to combat it. It also caused a huge disruption to their business.

Does having a compliance program help with regulatory risk too?

Yes, while the main point is that a compliance program is good business regardless of regulation, having one also helps avoid or mitigate regulatory aspects as an additional benefit.

What advice is given for choosing a compliance provider?

Dealers are told not to be cheap or silly when it comes to their compliance program and to look for a company that will take care of them.

Read more on this

  • Dealership Cybersecurity Requirements

    A US auto dealership's cybersecurity requirements come primarily from the FTC Safeguards Rule, which mandates multi-factor authentication, encryption of custome...

  • How to Choose a Dealership Compliance Vendor

    Choose a dealership compliance vendor by testing four things: whether their own auditors come on site or the assessment is a questionnaire, which of the nine FT...

Covered in this video

  • dealership compliance programs
  • cybersecurity incidents (Finley, CDK hack)
  • F&I office risk management
  • business decision-making around compliance