CONTROLLING
SOCIAL MEDIA RISKS
Dennis B. Kremer, CPA/ABV/CFF, CVA, CFE, FCPA
And
Warren Richman
The explosion of social network sites and social media tools means more and more companies and
professionals are engaging in this activity—as they should! Enterprises of all types are developing
an online presence through websites and social media marketing campaigns. Companies and/or
their employees are using social networks, personal and professional blogs, YouTube and other
means to express themselves. While it’s critical to seize these opportunities, it is equally important
to understand the emerging rules and regulations and mitigate the personal and professional risks
that could result from their activities.
The biggest risks companies take when engaging in social media are:
 The lack of a comprehensive social media strategy that ties into corporate goals and
objectives
 The lack of a realistic customized social media policy that ensures the company’s unique
social media activities comply with a range of laws and industry regulations
 Failure to provide clear and specific training to employees about the company’s social media
policy
 The lack of a continuing process to thoroughly monitor social media activity and compliance,
and
 The inability to show active and consistent enforcement of the social media policy.
Ungoverned use of social media can expose all to a host of legal risks, including:
 Breach of confidentiality
 Invasion of privacy
 Discrimination and sexual harassment claims
 Wrongful discharge
 Intellectual property, copyright, and royalty issues
 Violations of existing laws
 Criminal activities
The concerns are more complex when taking into account the regulatory requirements. Several
government agencies are now developing new rules and guidance that affect ALL companies—for
example, the National Labor Relations Board (NLRB), affecting employee rights, and the Federal
Trade Commission (FTC) governing enterprise websites, online advertising, and data security and
privacy. The picture is even more complicated for highly-regulated industries like financial services
(which must comply with FINRA and the SEC), healthcare (HIPAA, HITECH Act) and
pharmaceuticals (FDA).
Social Media Risk awareness is necessary to help enterprises and their employees understand and
identify areas of strategic and competitive concern as well as potential legal and regulatory
compliance liabilities. Awareness will allow entities to fully engage in social media and achieve an
aggressive and profitable online presence, by learning how to protect themselves.
Customized packages should be developed to address each entities specific goals and risks.
Entities need to build packages addressing their main areas of focus:
1) Social Media Assessment
All policies include a Social Media Assessment. An assessment should be conducted to
determine an entity’s social media ‘footprint”. Internal auditors or other outsourced experts should
conduct this assessment utilizing a custom analytics application. The assessment process
includes:



A review of a company’s website to identify potential regulatory or compliance issues.
An analysis and evaluation of a company’s current online presence—including not only
company-sanctioned activity but what employees are saying/doing on both public and
private sites.
A review of public/client comments about the company
2) Review with Senior Management
Periodic meetings should occur with the senior management team to break down the assessment
results and identify next steps. This process may include:
 Presentation of a customized service package that addresses all issues discovered during
the assessment. This includes defining a social media strategy that identifies key
performance indicators and metrics that align with the Company’s overall goals and
objectives.
 A critical look at the existing social media policy, if any, and steps that can be taken to
improve the policy.
Based on the actual online and social media activity,
recommendations will focus on mitigating any risk or liability potential for the Company and
its employees, contractors and vendors.
At the conclusion of this process, the senior management team will have a customized social
media policy, a comprehensive social media strategy, and the tools to continuously monitor and
enforce the social media policy, as well as continue to measure, monitor, manage and modify its
social media strategy.
3) Training
The best practice needs to protect the Company with a detailed training program so all
employees understand and buy in to the social media policy. A key requirement that every
regulator and compliance auditor suggests is to make this policy clearly available to all
current and new employees, with each, including senior managers, signing to show their
understanding and acceptance.
Implementation and management a consistent and ongoing training program for every level
of employee should be assured. To ensure conformity to the policy on all levels, a twotiered training approach is suggested:

Initial training with the senior management team, including the benefits and risks of
social media and how to best use the social media strategy and analytics application
as management tools. Executives need updated training at least annually, to ensure
that they 1) adequately monitor and enforce the social media policy and strategies,
and 2) effectively manage the metrics and key performance indicators used to
measure how well social media campaigns advance the Company’s overall strategy.

Employees need more frequent workshops as social media use patterns emerge
and evolve. On top of the policy do’s and don’ts, our training explains the benefits
and risks that employees face personally and professionally. Training of employees
should be required aimed specifically on how to respond via the different social
media outlets and the conversational styles requisite to the different media forms
and strategy objectives.
4) Ongoing support and consulting services
Social media is constantly evolving, and Company policies and strategies must do so as well.
Using analytics will allow continuous monitoring of employee compliance and help identify trends
and relationships to outcomes as well as areas for improvement. Together, an intelligent policy
and the right analytical tools will ensure that everyone performs to maximize the social media
goals. Ongoing consulting should provide three levels of support:
Monthly maintenance – Someone within or outside the organization needs to be responsible for
monitoring its activity and assist the Company in performing monthly conformance audits.
Virtual Compliance Committee – This monitoring will act as the in-house compliance committee
and perform all the necessary functions to review any potential compliance, liability or risk
concerns. And upon approval by the executive committee, implement recommended changes. In
addition the “monitors” should also consider consultative legal services with experts in the various
areas identified as potentially at risk.
FINRA Virtual Compliance Committee – Experts should provide FINRA-experienced resources
to implement and manage the Company’s obligations for Compliance if it is a FINRA regulated
organization. They will develop FINRA related profiles and static content that the Company’s
staff will use for their social network profiles, online conversations and public announcements
through their social networking activities. Legal Consultants should review any custom
submissions that either the Company or an individual employee wants to post and provide a legal
opinion as to the suitability of the item for FINRA Compliance. Experts will also conduct a
compliance review on a weekly basis and provide documentation to demonstrate the Company’s
enforcement of policies to meet its FINRA obligation.
Dennis B. Kremer, CPA/ABV/CFF/CGMA, CVA, CFE, FCPA
Dennis B. Kremer, CPA, ABV/CFF/CGMA, CVA, CFE, FCPA, an owner and Founder of Fairfield Forensic and Valuation
Services, LLC (FFVS), has over 30 years of experience in performing business valuations, forensic investigations, fraud
audits, lost profits, business appraisals, audits, financial consulting, expert testimony and arbitration, as well as advising
family-owned businesses. He is an active member of the New York City Chapter of the New York Society of Certified
Public Accountants where he serves on the Litigation Services, Business Valuation and Anti-Money Laundering
Committees. Mr. Kremer has recently been appointed by the Westchester County Executive to serve on the
Westchester County Board of Ethics. In addition, he serves on the Westchester Medical Center Foundation Board and
its Audit Committee. The opinions expressed in this article are his own and do not represent those of FFVS.