One of the global top three entertainment companies using Harmony for Compliance

Within Harmony, the client manages the compliance of 72 different locations, across the USA, Europe and Asia. Each location must comply with an average of 235 individual control points. (There are 233 controls in the PCI standard, but the client adds extra control points of their own, depending on the venue and the need).

In addition to multiple locations, the client has a need for multiple external user interest groups. The transaction volumes of the client run into the hundreds of millions. Seventeen external banks (the banks process the transactions, based on location), all have their own external login accounts and all only see the locations that relate to the transactions that they process. No bank can see the compliance status in any location other than those where they have a specific interest. In addition, the client is required to use an external auditor, a ‘Qualified Security Advisor’ (QSA), whose role is to provide assurance to the banks about the integrity of the client’s work in progressing their compliance levels. They also have external access to Harmony.

Implementation approach and timelines

Harmony was implemented in 5 weeks. This included deployment, configuration and testing of Harmony in the client’s data centre. The additional changes, which took a total of 10 working days to complete, and 5 days to implement, were done partly in parallel. The whole implementation, including the requested system changes, and data feeds into PeopleSoft, was completed in 40 working days.

The initial client project team was 25, but this decreased to 6 with the deployment of Harmony. This was 5 people less than the client had originally estimated, and was additional savings to their project.
As Harmony was being implemented by the technical team, our project team worked with the client project team to plan:

• Training of the project team – 6 people (half day course)
• Training of two system administrators (full day course)
• Training of the auditors – 5 people (half day course)
• Training of the bank representatives – 25 people (half day course)
• Training of the client user community – 320 people – (fifteen minute course – delivered remotely with helpdesk support for follow-up queries)

In parallel to the technical implementation and the training planning, another team began mapping the client process workflows and intended project activities with Harmony and the features in Harmony which would automate the otherwise manual work of compliance tracking, gap analysis, incident management, risk capture and issue management. The additional changes (paragraph 3, above) were a consequence of this mapping of the client internal processes and project requirements.

Another team worked on a communications plan that was delivered in ‘doses’ as the project proceeded. At each stage, all of the users affected by the project knew in advance what was happening, why it was important to the firm and what their contribution would be.

Once Harmony was live, and the training programme delivered, all locations had completed their initial gap analysis within three months.

Key issues and how they were overcome

All the issues we faced fell into one of two categories:

1. Lack of certainty / changes of mind by the client about the approach to the project: At the beginning of the project the client was not sure whether they wanted to run the project themselves or if the QSA should do it for them. This was important because they both had different approaches which resulted in different levels of visibility of project progress, depending on the approach and who led the project. We solved this by loading the project into the Harmony Programme and Project management system for the client – as a consequence, because the system is web-based and gives equal visibility to everyone, the client had no difficulty allowing the QSA to take the project lead.
2. Uncertainty by the client about the hierarchy of their organisation: The client organisation had grown inorganically, by takeover more than by organic growth. As a consequence, different parts of the business were not all organised in the same way. This meant that there would be incongruencies in the way different parts of the business were handled and a lack of equality in compliance status. The solution was one of the changes that we made to Harmony – to let Harmony manage the different parts of the business in their own way and to ‘equalise’ the compliance reporting status within the system.