TransUnion’s Transformation

TransUnion’s Transformation

The amazing journey of one company from Business Continuity to Enterprise Issue Management. TransUnion is a leading global risk and information solutions provider to businesses and consumers. The company provides consumer reports, risk scores, analytical services, and decisioning capabilities to businesses, as well as enables consumers to understand and manage their personal information.

TransUnion’s commitment to the businesses and consumers it serves has been a driving force behind its dedication to enterprise issue management. For over a decade, Tracy Judge, the senior director of compliance program management, has worked hard to create a department that is responsible for the continued development and implementation of key compliance programs for all domestic and international TransUnion locations. These programs include compliance policy, compliance training, compliance risk assessments, regulatory change management, records management, and the enterprise issue management program, with supporting programs and plans for crisis management, business continuity, and data issue response.

Tracy is a Certified Compliance and Ethics Professional by the Compliance Certification Board, a Certified Business Continuity Professional by DRI International, and a Member of the Business Continuity Institute.

In 2008, the Federal Financial Institutions Examination Council (FFIEC) revised their standards so that your largest financial services customers were required to put robust business continuity programs in place. These standards included ensuring that third–parties – such as TransUnion – also had business continuity programs. How did you respond?

Until that time, we did not have a major emphasis on business continuity at TransUnion. The updated FFIEC regulations were – to me – a golden opportunity to strengthen our business continuity program. However, I did not know much about business continuity! I aggressively pursued information: joining every organization I could find, attending conferences to understand the elements and best practices of a program, and talking to everyone I met. One of the people who freely gave me a lot of advice and input was David Nolan of Fusion Risk Management. Based on my learnings, we were able to put in place a solid team and program at TransUnion.

Please describe what you had originally envisioned for your business continuity program and how it has actually evolved over time.

Back in 2008, I thought that business continuity was the overarching program and goal – but I was wrong. Business continuity is designed to respond to a specific type of issue. But there are other issues as well, ones that business continuity plans don’t address. We soon realized we needed to create a program that would enable us to respond to any type of issue that might arise.

With that in mind, we developed what we call an enterprise issue management program. Enterprise issue management allows us to be alerted about and respond to any issue that may occur anywhere around the globe. If the issue involves operations, we activate our business continuity plans. It there is a crisis, we activate our crisis management plans. If we were to experience a cyber attack, we would activate our data issue response plans. And the list goes on.

That is a lot of work! What motivated you to go above and beyond the requirements of a business continuity program to develop a holistic enterprise issue management program?

Some people respond to opportunities that arise by saying, “That’s not my job!” or, “I don’t know and neither does my team!” When the FFIEC regulations came down in 2008, I saw it as an opportunity: an opportunity for TransUnion to strengthen its business continuity preparedness, and an opportunity for me to grow professionally. Later, when I realized that this was just the beginning, I saw it as an opportunity to develop something much bigger. There’s a sign in my office that captures my approach perfectly – it’s a quote attributed to Thomas Edison: “Opportunity is missed by most people because it is dressed in overalls and looks like work.” When I see an opportunity, I am willing to do the work it demands.