Why Physical Compliance Audits Matter as Much as Cybersecurity

Dealers focused on cyber security amendment

Hello, my name is Terry Dortch with Automotive Risk Management Partners. I'm here today to talk to you a little bit about priorities. You know, last week I ran, uh, I ran down in the southern states, down in Louisiana, Alabama, Georgia. This week I was running around northern Illinois talking to dealers, and everybody's hot point or hot button right now is the whole cyber security part of the Safeguards Rule.

History of the Safeguards Rule and cyber clarity

One of the things that I really want to talk about is that, you know, the Safeguards Rule's been around since 2003. It started, it came out as a whole piece of the Gramm-Leach-Bliley Act, and everything was about safeguarding customer information. There's been a cyber piece in that forever. There was not as much clarity, obviously, as there is with this amendment that's coming out that's due in June. So this amendment, what it's done is it's added clarity to the whole cyber aspect of the Safeguards Rule.

Physical compliance risks being overlooked

You know, we shouldn't ignore that cyber piece at all. We need to pay attention to it, but I think, I think we're missing the boat here. We're not paying attention, and the more I talk to dealers, it's we're completely ignoring the physical aspects of the compliance piece. There's so many other things that could happen in a dealership that can cause you problems financially, cost you money, you know, real money, as well as indirectly affecting the revenue streams of your businesses. And those things mostly are physical. They're not going to be the cyber part of it, or the whole data being stolen from your DMS system, let's say.

The real problem that you're going to find is you're going to find in the physical aspects, that it's going to be errors made either in your sales process, your F&I process, which is part of your sales process obviously, in the back in the shop, the OSHA, if you have a body shop, something in the body shop. Those are the things that are ongoing daily, and those are the things that we're not paying attention to now because all of the attention is being poignant, or focused, on that cyber aspect. You really need to step back a minute and take a look at the overall picture of everything.

Real-world case of FTC scrutiny in Illinois

This whole, and the reason I bring this up, we have a store here in Illinois, in the northern part of Illinois, that the FTC's in their store right now. There's going to be some issues, there's going to be some complications for that dealer, and I feel bad for them. They probably really didn't do anything wrong, but they're going to get in trouble for it because it's almost inevitable as a dealership to not have some sort of disparate impact occurring, or it appeared to be occurring.

Need to audit all compliance areas, not just cyber

And my whole point in all of this is, if you're not having someone come in and audit these processes on a daily basis, that to me is as much, if not more, important right now than the cyber aspect. And I can't stress this enough, I'm not telling you to ignore the cyber part of it. That's an issue that needs to be addressed, just like all of it. But don't focus all of your attention over here and forget about here, which really is the point that we need to focus on.

This is over here's where we're going to get caught by a state AG, we're going to get caught by a state banking association, we're going to get caught by the FTC. There's so many different aspects that control the physical part of your dealership and that are involved in it. That's the part that we need to address as much as the cyber aspects, and it's just because this is the hot button right now. And I get it, and trust me, we can handle all of it for you, but I really think, whether it's us or anybody else that you're talking to out there, make sure that they're not just taking care and plugging one hole in a dike that has a bunch of them, right? We want to make sure that we plug all the holes that we can out there.

Past heavy fines and advice on vendor selection

You know, again, back in Illinois, two, three years ago, we had a major automotive group here that got fined heavy, heavy. I want to say it was to the tune of somewhere around 10 million dollars. You can fact check me on it, I don't remember exactly what it was, but it was large money. My point in all of this is that there's a lot to compliance. Please take the time, talk to your vendors, whoever you're talking to, and make sure that they're addressing all of these issues and not little bits and pieces of it, and then giving you a false sense of security in the process.

If you guys have any questions about this, you want to discuss it, please feel free to give me a call anytime. You want numbers, here on the screen, our website's out there. You can go to the website, you can contact us via email, however you'd like to. Thanks a lot, talk to you later.