Orchid Advisors TMorchidadvisors.com/editor_uploads/documents/WP... · It is becoming easier than ever to recognize where your firm stands. Do you ship products in the wrong box?

Transforming The Compliance EcosystemOrchid AdvisorsTM

TM

Spotlight On: Orchid White Paper SeriesFirearms Industry Compliance – Leading Technologies

Spotlight On: Orchid White Paper Series

Firearms Industry Compliance –Leading Technologies

January 2014Transforming The Compliance EcosystemOrchid AdvisorsTM

TM

Copyright ©2014 Orchid Advisors.

Without limiting the rights under copyright above, no part of this publication may be reproduced, stored in, or introduced into a retrieval system, or transmit-ted, in any form, by any means (electronic, mechanical, photocopying, record-ing, or otherwise), without the prior written permission of the copyright owner. The scanning, uploading, and distribution of this publication via the Internet or via any other means without the permission of the copyright owner is illegal and punishable by law. Please utilize only authorized electronic editions, and do not participate in or encourage electronic privacy of copyrighted materials. While the copyright owner has made every effort to provide accurate Internet addresses at the time of publication, the authors do not assume any responsibility for errors or for changes to the Internet publication of referenced materials that occur after publication. Further, neither the copyright owner nor the authors have control over and do not assume any responsibility for third-party authors, websites, or their content.

Firearms Industry Compliance – Leading Technologies 1

You are an executive at a major firearms manufacturer. You operate in an intensively regulated industry, where you are expected to physically ID your products down to the component level. There are rules and regula-tions surrounding how long it takes you to mark, acquire, dispose, and record the history of each item. The rules change often, and are some-times fuzzy in detail. Misinterpretation can lead to regulatory violations, increased third party oversight and in some cases – loss of license. A lot is at stake, and it does not take hyperbole to make it serious.

Long-term industry employees are seeing Federal and State driven proposals that threaten product design, distribution, and end user owner-ship. Regulatory inspections appear to be improving, at least from an auditor’s perspective. And, the ATF’s lens is changing from an agency that was once administered by the IRS to one that now resides under the power of the Department of Justice. As such, inspections are becoming even more focused on GCA, NFA and AECA violations.

The sheer nature of Compliance has outgrown its’ less mature reactionary focus to achieve equal standards with other business metrics. Enterprise Risk Management (ERM) and Enterprise Resource Planning (ERP) are two acronyms that can be used to define where this is all headed – that is, Compliance as a strategic initiative, embedded in the culture of the busi-ness, enabled by best-in-class technology and continuously monitored and improved.

All business functions will have to think about how Compliance affects your livelihood. For example, Logistics personnel need to critically think about the implications when moving “receiving” from one part of the

The Maturing Compliance Environment And Your Enterprise Responsibilities

“Enterprise Risk Management (ERM) and Enterprise Resource Plan-ning (ERP) are six letters that can be used to define where this is all headed – that is, Compliance as a strategic initiative, embedded in the culture of the business, enabled by best-in-class technology and continuously monitored and improved.”

plant to another. Product Management needs to think about Compliance before simply sending a newly engineered product to the factory floor. IT needs to think about Compliance when enhancing its legacy systems. Compliance needs to be part of your corporate culture – a Culture of Compliance, so to speak.

Orchid Advisors is a technology-based management consultancy with a strong focus on the people, processes, and systems that power an enterprise-wide Compliance Culture. Our clients are the largest firearm producers who realize that the industry is indeed going through change. They know that there are new benchmarks, raising the bar for what constitutes acceptable deviation from expected performance. They understand that their own staff needs to be educated in this newer, broader way of approaching Compliance. Those firms that successfully transition to a more transparent and smoother way of interacting with regulatory agencies, such as the ATF, will ultimately be best positioned to reduce their corporate risk profile.

Simply put: Some in the industry will move aggressively to make Compliance proactive while others will rest conservatively on reactive “legal insurance.” We are seeing the industry quickly separate into leaders and laggards, as you might expect. Leaders are those who choose to take a more vigorous approach to transforming their Compliance EcosystemTM rather than patching the short-term holes found during an inexpensive checklist-based audit. It’s the difference between strategi-cally dealing with issues or “fire fighting” all the time.

Firefighting and reactive behaviors are becoming increasing visible to those observing the industry. Remember, we aren’t the only ones watching and benchmarking performance – the ATF is too. Do you think regulatory auditors view leaders and laggards the same?

It is becoming easier than ever to recognize where your firm stands. Do you ship products in the wrong box? Can you reconcile 100,000s of serial numbers to your Book, across multiple plants, in less than three days time? Can you find a specific serialized firearm someplace more specific than “somewhere” in your 1,000,000 sq. ft. warehouse?

“But we just had a mock ATF inspection, we’re fine!” you might say. The days when a mock ATF inspection by a retired ATF agent will meet the needs of true enterprise class Compliance program are long gone. It


is just so much bigger a discussion than that. One of your suppliers can get shut down for infractions and impact your whole production line. ATF inspectors are moving towards electronic data audits – do you have real-time visibility into Compliance at your firm?

At some point, your competitors will evolve their Compliance program and the focus will turn to the laggards – those who don’t view Compli-ance as a process or a strategic equal in a regulated industry.

Orchid Advisors are specialists in Strategic Compliance and can work with your executives to establish a structured program across your entire ecosystem. Set up the right foundation, now. Establish that Culture of Compliance. Implement the right systems. Build that visibility. Our Compliance Framework is what sets us apart and brings you the diligence and technological savvy of a Big 4 consulting firm with the firearms industry expertise of a boutique expert advisory firm.

Building Your Compliance EcosystemTM

As we said earlier, Compliance as a discipline is evolving and maturing. We liken Compliance today to where Quality was before modern Japanese manufacturing methods. In its precursor days, quality manage-ment was focused on individual events or actions that took place, and were coordinated by a single person. Over time, quality became a strate-gic objective, equal on par with other business metrics, and eventually becoming a Total Quality Management (TQM) system. Quality became embedded into the fabric of every financial and operational decision and it was evaluated across the Company rather than with each singular event. Methodologies continued to evolve into Six Sigma, Lean, and now Lean Six Sigma.

Compliance is going through the same evolution. Where it once was event-focused and reactive – and under the domain of a single person – it is now continuous and proactive – and being built into many layers of the organizational hierarchy for future-proofing the business.

The benefits of proactive Compliance leadership include the following:

4

Enhanced repeatability and sustainability through disciplined, process-oriented actions

Internal controls embedded in processes to drive a high-probability of desired outcomes

Flexibility to adapt to the highly volatile legislative environment

Lower overall cost of Compliance through analytic monitoring

Increased transparency and improved working relationships with key regulators such as the ATF

And, perhaps most important to the industry, is that it embeds Compliance in the culture of the operation, permitting management the time and mental focus needed to run their business.

4

4

4

4

4


Figure 1: Key questions any firearms executive should ask.

Orchid Advisors Compliance EcosystemTM Framework has four main elements spanning this entire supply chain – from suppliers, to manufac-turers, to distributors and retailers and ultimately to consumers.

The key elements include:Aligning corporate and regulatory compliance with business strategy

Integrating compliance into the culture and establishing minimum levels of literacy

Enabling business processes with best-in-class technology

Continuously monitoring and improving transparent operations

4

4

4

4

It is critically important to note that the Compliance EcosystemTM extends well beyond the mere walls of your firm’s facility and into the supply chain powering it. A single plant closure at a critical supplier could close all of a manufacturer’s production lines down – so your vigilance on Compliance needs to extend deep into your own supply chain.(See Figure 1)

Is Compliance embeddedinto your strategy?

What if your supplier was closed by ATF? Or an agent commits a crime stopping critical sales?

What if product developmentintroduced product changes that compliance was unaware of?

Is Compliance part ofchange management?

What if processes and ERP transac-tions could be executed in a manner other than designed?

What if the business and IT made changes to SAP code and compliance was not aware?

Is Compliance visible toyou, real time?

Are you self governing or are viola-tions a surprise? Is audit used to identify weaknesses?

Do you have executive dashboards, metrics and performance indicators?

Is Compliance embeddedinto your culture?

Do personnel understand how they impact compliance? Is it measurable and in job duties?

Are you proficient in the regulations under which your business operates?

Upfront strategy to continuous improvement – from your suppliers to your consumers and back again.

Suppliers Customers

Sustained Monitoring& Improvement

Measure With Audits, Industry Benchmarking

and Data Analytics

Govern with Executive Dashboards

Stay In-Tune withIndustry, Legal and

Political Trends

Compliance ProgramStrategy

Map Your EcosystemAnd Regulatory

Environment

Build Your Compliance Vision and Integrate

with Business Strategy

Map Your Federaland State Relationship

Strategy

Re-define Cultural Norms, Policies and Expectations

Establish StructuredRoles, Ownership

and KPIs

Certify and Deliver Knowledge Throughout Your

Ecosystem

CulturalTransformation

Process & TechnologyEnablement

Drive Repeatability with Lean Six Sigma and Internal

Controls

Integrate ERP, CRMand Advanced Technologies

Control ThroughChange and Project

Management


TM

Figure 2: Your Compliance EcosystemTM

These four elements are shown graphically in Figure 2. Orchid has product lines associated with each of these four columns.


The Orchid Framework In Action —Extending SAP For ATF Compliance

Orchid has worked with some of the largest firearms manufacturers in the world, re-inventing the standards for ATF Compliance. These projects demonstrate actual instances where the benchmark and best practices in the industry have been taken to a whole new level.

These four core elements work in tandem. Failure to address any one of these inside your organization, and, in some cases, at your suppliers, can have powerful impacts.

In one such instance, Orchid designed a custom SAP application to enhance ATF Compliance at multiple facilities for a top five U.S. manu-facturer. Although SAP has built-in serialization functionality, it is not designed as an out-of-the box solution for the firearms industry and requires custom development. Orchid is the only firm experienced in designing and delivering a working SAP blue print capable of enhancing

Figure 3: Orchid’s Four Pillars of Firearm Compliance Framework Enabled by SAP.

1LicenseControl 2 Marking

Control

3TracingControl 4 Physical

Control

Affecting EntityControl

ATF

Communication

ATF

Expert

ise

Logical S

ystem

Acces

s

Self

Assessments

Orchid Advisors Methodology:Four Corners of ATF Firearms ComplianceTM

Powered by

the repeatability of buying, importing, production, scrapping, shipping and reporting for the purposes of ATF compliance.

The benefits of a finished product such as this is that it enhances the likelihood of compliance with the regulations by integrating software transactions and internal controls at key failure points in the process. For example, SAP was configured to require a matching of designated serial number on a purchase order to system-driven “mirrors” of an ATF non-marking variance. Without recognition of a matching sub-contractor name, model, and serial number to the variance, the system will not allow the firearm to proceed to the next step in the process.

As finished receivers were transferred to the manufacturing facility, SAP’s traditional controls go into effect by requiring a match between an “Advanced Shipping Notice” (as sent by the supplier) and an SAP purchase order. Provided they agree, the serialization matching process begins.

“Proper entry of a serial number during the acquisition process is critical. Mistakes made here can result in a chain of errors to downstream dispo-sitions and potential ‘wrong-gun-in-box’ issues,” says Orchid’s CEO Jon Rydberg. FFLs benefit from significantly enhancing the receiving process to critically evaluate serial number data entry into its regulated records.

While the process may involve different combinations of hand key, Optical Character Recognition (OCR) technology, and/or 1-D and 2-D barcodes, the SAP match remains the same. An employee must scan a bar code into the system while another employee hand keys (or OCRs) the serial number into the system. The serial number is never shown to the employee in the system, driving a “dual blind entry.” If the two serial numbers match, and if they agree to the purchase order / ASN combina-tion, the system performs the receiving transaction and writes the record to the Book of Acquisition and Disposition.

Orchid Advisors and its clients also combine best-in-class internal control concepts to reduce risk in traditionally high-risk areas. Because scrap is usually a focal point for regulators, additional controls were implemented to ensure that no one person alone could destroy or dispose of a firearm. Duties were segregated in SAP to require one user ID from Production and one user ID from Compliance in order to reduce serial-ized financial inventory by a unit and to dispose of the firearm in the


Book of Acquisition and Disposition. Furthermore, a reconciliation report was generated to ensure that all serial numbers tagged for destruction by operations were indeed transacted by Compliance.

Importing and SellingOrchid’s SAP ATF Compliance blue print does not stop working at this point; on the contrary, the system goes to work to ensure that the firearm makes it to the right location at the first point of sale, and if the firearm is ever returned to the factory for any reason.

When a client sells a firearm to a distributor or its network of dealers, the system validates that the recipient has a valid Federal Firearms License (FFL) by checking this electronically against an authorized scanned copy of the FFL as well as the BATFE database of valid FFL holders, known as the EZ Check system. Data from this system is uploaded and imported into SAP on a weekly basis.

The system ensures that the customer’s FFL reconciles to the EZ Check system; if not, the order is frozen without the ability to override the trans-action. Similar controls exist to ensure that National Firearms Act (NFA) products cannot be entered into an order unless SAP finds an ATF Form 3, 5, or 9 on file.

With regard to imported firearms, Orchid designed SAP to validate the requested purchase of firearms against ATF provided import licenses. For example, if an import license allows for 100 units and the buyer requests 50, the sale proceeds as normal. If a subsequent order is placed for 51, the transfer is halted and an automated notification is sent to the import department.

Executive DashboardUNIVERSEFIREARMS

Finally, and in order to further limit the risk of ‘wrong-gun-in-box,’ a three-way matching process was used to produce a serialized box label. Prior to packaging, every firearm is placed on a scale. Its bar-code is scanned and the serial number is hand keyed. If the product weight, system weight, and the two serial numbers match, a finished goods box label is produced.

Figure 4: Best-In-Class ComplianceVisibilty Through Orchid SAP Dashboards

Compliance is a Process, not a ProjectImproving compliance is more than just implementing the latest and greatest technology. It requires heavy discipline, accurate data and persis-tent checks, balances and improvements to drive behavior. A methodical approach such as that described in The Four Pillars of Firearm Compli-ance (an Orchid Advisors authored book) facilitates the achievement of compliance objectives. Moreover, such methodologies create a repeatable environment that reduces organizational risk and allows management to run the business and actively respond to evolving legislation.

Although Orchid-Powered SAP designs are at the forefront of such best-in-class ATF compliance programs, they are not the only piecesto the puzzle. It begins with sound ethics, on-demand and required training, and access to a corporate hotline for a variety of employee concerns. These and other “environmental controls” play a critical rolein tone setting and as compensating mechanisms to potential breakdowns in process transactions.

One of our client’s invested in industry-leading security measures that include a staff of armed security guards on duty 24 hours a day, seven days a week, at every key point in the facility. In addition, every employee and third party must enter one or more X-ray machinesand metal detector as they enter or leave the facility.

Employees who visit the facility are vetted and registered through back-ground checks and drug screening to ensure they are not in a prohibited class. Employees of vendors and common carriers are not permitted in the company parking lots outside of scheduled times and must certify as to the same.

“Environmental controls are a core element of a balanced ‘system of internal controls,’ and, for the compliance program to be fully effective, this layer of defense requires the same level of rigor,” states Rydberg. “I have seen organizations propose millions in spend to enhance one control element and fail to address others. This simply permits the bubble to burst at its weakest point. Ideally, internal controls are balanced in cost and strength and work together in a system to achieve an overall objective.”

Beyond Technology


Compliance Solutions For The Rest Of Us

Not everyone can afford a major ERP software implementation. While other industry giants have contacted Orchid Advisors for such transfor-mations, the majority of the firearm industry’s 65,000 license holders are small to mid-size organizations. Compliance does not necessarily require a multi-million dollar approach, but the program must be tailored to the size, complexity, and risk of the environment. Unfortunately, a dealer with $50,000 in sales has the exact same compliance responsibilities as a $500,000,000 manufacturer – so creativity is a necessity when scaling up or down.

Orchid Advisors works with small to mid-sized organizations and is currently developing extremely low-cost compliance software for the “mom and pop” firearm dealer. Orchid believes that these smaller indus-try players should be provided the same types of internal control features as the giants. In fact, small business owners look to their dealership as a means of income and their lifeblood. Loss of their FFL could prove to be even more treacherous, so focus on compliance is paramount.

In the United States, there is a dilemma of protecting the Second Amendment and balancing that with respect to regulation. As time goes on compliance with new legislation may become more difficult and Orchid Advisors is leading the charge as the first and only pro-active ATF compliance consulting firm. Retailers simply cannot rely on after-the-fact legal services as their only means of survival. A subscription to “insurance-like FFL protection” increases not decreases the risk. To make matters worse, if the insurance is never used, it does nothing more than pad an attorney’s bank roll.

In a new solution for firearms retailers, the system will address the most common violations that occur at the retail level including mistakes made on the form 4473. A system would requires scans of the buyer’s state issued identification and in the case of a multiple handgun transaction will generate a multiple sales form for the dealer before continuing with the sale.

Why Orchid? Why Not Internal Staff?

Orchid Advisors is pioneering and transforming the concept of a Compliance EcosystemTM – that is, the compliance activities that exist throughout your supply chain, from manufacturers, to distributors, andto the end consumer.

We are a strategic management consultancy, akin to McKinsey, BCG and Big 4 firms delivering services for the strategic needs of a CEO, CFO and General Counsel. We leverage Orchid’s thought leadership, technol-ogy and software to innovate your compliance. And, we leave simple regulatory recital and checklist-based services to our competition.

We work alongside your staff and complement their efforts. Our goal is to leave in place an elevated Compliance Culture. While internal staff has an extensive array of knowledge, history, and experience with the Compliance activities in your firm, Orchid brings technical specialty and regulatory domain knowledge that results from our continued exposure to many environments and situations – including many instances of mediat-ing solutions for clients with the ATF and other regulators. If you reduce this to an internal v. external consultant battle, we all lose. The bottom line is we all have something to add to the equation, and all our respec-tive talents are needed to re-invent Compliance.

What Next?Schedule time with one of our executives. We can discuss how working together we can take Compliance in your firm to a next level.

The time to act is now. Let us help make Compliance a non-issue in your firm.


Products and Services

Orchid Advisors is a strategic management consultancy focused on transforming the worlds of audit and compliance. We are experts in ATF Compliance, State Firearms Compliance, Anti-Corruption/Bribery, ITAR, Import, Export, and Sarbanes-Oxley. Our initial entry market is the Firearms Industry where Orchid counts among its customers the top manufacturers in the world. Orchid clients hire the firm to reinvent business processes, implement technology and big data solutions to support that change, and transform their compliance culture. Orchid Advisors brings the depth and breadth of Big Four consulting with the innovation, thought leadership, and economies of a boutique analyst firm. More information about our four service lines of Compliance Consult-ing, Technology, Business Consulting and Internal Audit may be found at www.orchidadvisors.com.

Compliance Program StrategyCultural TransformationProcess & Technology EnablementSustained Monitoring & ImprovementInspection Readiness & RemediationSupplier & Channel Partner ReadinessCorporate Compliance & Ethics TrainingPhysical SecurityFirearms Industry Certification ProgramCompliance Technology, Data Analytics and ExecutiveDashboardsBusiness ConsultingERM, SOX and Internal Audit

4

4

4

4

4

4

4

4

About Orchid Advisors

4

4

4

4

4

How Orchid Advisors is Reinventing ATF Compliance with Innovative Technology Solutions

FFL-to-ATF EZ Check MatchSoftware controls prohibit order entry or product shipment by comparing customer FFL and the ATF’s EZ Check database.

Segregated Scrap ControlScrapping a firearm and disposition from the Book of A&D requires system IDs from two separate departments and are complemented by a balancing report ensuring items to-be-scrapped were completed.

Variance Receipt ValidationSystem data tables mirror paper ATF variances, reserving serial numbers by suppliers and model, and notifying operators when an off-variance serial number is received.

Firearms Compliance UniversityOn-demand courses train operators through executives on ATF, Import, Export, and FCPA regulations and provide best-practice internal control examples.

Dual Blind EntrySoftware logic requires independent, dual-entry of a serial number at every transaction point via hand-key, 1D/2D bar code, or Optical Character Recognition to enhance integrity of A&D Book. Real-Time Acquisitions and DispositionsModern dash-board and query technology that enables any authorized employee to slice and dice the A&D Book – on a real time basis – for regulators or for internal audit purposes.

WGIB (Wrong Gun In Box) 3-Way MatchWGIB risk mitigated by limiting the print of box labels to only those transactions with a combined dual-blind entry and product weight check.


Acquisition and Ghost Serial Number ControlIntegrated programmable logic controller and injection-molding machines require sequence and phased timing, called “Shot-Scan-Shot-Scan.” Software mitigates the risk of ever producing a ghost serial number.

Real-Time Compliance Tracking and NotificationsSoftware identifies possible transaction errors in real-time and sends workflow notifications to the Compliance Department as they are detected. For example, prior theft-loss received on a customer return.

Import Match And DecrementElectronic import licenses that limit buying to make, model, type, and quantity of firearms or as stated on approved import licenses.

Bidirectional Independent Serial Number InventorySoftware application that reconciles physical product count to scanned serial numbers the Book of A&D by segmented areas of your factory, retail operation, or national sales team – and then again in reverse.

Orchid Advisors is headquartered in Hartford, CT with technology research and development offices in East Hartford, CT.

Orchid Advisors Headquarters:100 Pearl Street, 14th Fl Hartford, CT 06103 United Statestel: +1 (855) ORCHID-0 fax: +1 (800) 507-4409 East Hartford R&D Offices:Orchid Advisors Connecticut Center for Advanced Technology (CCAT)222 Pitkin StreetEast Hartford, CT 06108United Statestel: +1 (855) ORCHID-0fax: +1 (800) 507-4409


TM

Documents

Orchid Advisors TMorchidadvisors.com/editor_uploads/documents/WP... · It is becoming easier than ever to recognize where your firm stands. Do you ship products in the wrong box?