How we help you
Wipfli’s TCPA compliance solutions can help ensure a stronger compliance program while empowering your marketing and sales goals.
Maintain compliant outreach that drives revenue and engagement.
Keep pace with constantly shifting regulations.
Embedded compliance into operations for a more effective, defensible program.
Support built for risk-aware growth
Wipfli’s TCPA compliance consulting is designed to support your organization with practical, defensible solutions that allow you to focus less on compliance and more on outreach.
TCPA compliance services
Insights
ARTICLE
Title 31/AML compliance checklist for tribal casinos | Wipfli
Title 31/AML compliance needs to be a priority for tribal casinos. To help, Wipfli compiled a Title 31 compliance checklist.
ARTICLE
Tribal gaming trends fall 2026: Four issues to watch | Wipfli
Explore tribal gaming trends for 2026, including NIGC credit card audits, AI strategy, construction monitoring and new GASB reporting requirements.
ARTICLE
Technology risk management: How to modernize while successfully managing risk
More businesses than ever are embracing a digital transformation. Cloud-based systems, big data and AI are creating a flood of new opportunities to operate more effectively and better understand your customers. But is your business prepared to tackle the new risks that emerge when it shifts onto a more digital footing? Or are you taking on unnecessary financial, operational and reputational dangers? Keep reading to learn more about why your business needs to actively manage technology risk and how to get started. What is technology risk management (TRM)? Technology risk management focuses on managing and reducing risks that involve digital systems, data or implementing new technologies. This is a big picture branch of enterprise risk management that includes more focused risk areas like cybersecurity or AI, without being limited to them. Technology-related risks include practical, operational realities like whether your systems actually function as they should. Vendor management and regulatory issues are also important, as is data integrity. Your competition may also represent a technology risk to consider. Technology can be a growth driver that helps differentiate your business from competitors or make it easier to uncover new market opportunities. But it can also leave you falling behind if your competitor wields it more effectively. Technology risk management involves taking all these factors into account and implementing a strategy to mitigate them. Why technology risk management matters during digital transformation When a business goes through a digital transformation that involves transitioning its core systems and data into the cloud, it suddenly faces a host of new risks. A thoughtful technology risk management strategy can make this process safer and more effective, while also mitigating ongoing risks. Technology investments are becoming business-critical Technology risk management is more essential now than ever before — because technology itself is more deeply integrated into virtually every business. Ten years ago, you didn’t have to be in the cloud, but now, any organization larger than a lemonade stand knows it needs modern digital systems to compete. As cloud-based technology becomes critical to your day-to-day operations, you can’t afford to write off technology risks as just cybersecurity. You’ll leave your business too exposed. Digital transformation introduces new operational risks To understand the breadth of technology risks many businesses now face, consider the example of a community bank. For fifty years, this bank has thrived even as large national banks have opened nearby branches because it offers superior customer service and has built deep lending relationships with local homeowners and small businesses. Until now. In recent years, customer expectations have shifted wildly, with younger customers (and many older ones as well) preferring to do everything online. That superior customer service doesn’t mean what it used to if the bank’s app is clunky and hard to use, so the bank scrambles to find a vendor that can clean up its customer-facing technology to avoid losing market share. But is that vendor secure enough to meet banking industry regulatory requirements? Is it reputable and audited? Will the bank itself be able to improve its digital experience enough to meet today’s customers where they are without spending money it doesn’t have? Does it have the data foundation in place to learn enough about those customers to keep them happy while also establishing enough AI governance to avoid exposing their data to public AI models? That’s a lot of new risk from many different angles. Risk visibility leads to better investment decisions Some good news: Technology risk management isn’t just about avoiding trouble. It’s also a way to make smarter business decisions that drive growth and ROI. Governance — the ongoing process of understanding how your business uses technology and creating guardrails to manage the associated risks — is a fantastic opportunity to think about how technology can improve your daily operations. You can’t set up controls if you don’t know how things work; once you know how things work, you can find new efficiencies. Governance also increases the reliability of your technology-related outputs. For example, an AI policy to mitigate bias, hallucinations and data quality risks will make answers from AI models you use more accurate, delivering clearer, more useful insights about your customers, operations and financials. In other words, managing technology risks helps you learn more about your business and your market. That information makes it easier to compete. What are common technology risks business leaders face? Businesses face a wide range of technology risks. These include risk areas like platform implementations, cloud migration, third-party vendors, AI and cybersecurity, as well as broad strategic risks like falling behind your competition in how you use technology. ERP implementation risk More businesses are transitioning to cloud-based enterprise resource planning (ERP) platforms to manage their core operations and financials. This can be a big boost for your operational efficiency, but it also carries significant risks . During the transition, you’re moving some of your most critical data from one database to another. Incorrect data mapping, poorly designed processes or corrupted data can blind your team to what’s happening inside your business. Fixing this can be expensive and also create ripple effects that disrupt your operations or carry over into your customer experience. Cloud migration risk Moving to the cloud just means transitioning from running your own servers to using servers operated by a vendor. The benefits are huge: You have all the server space you could ever need, without the worry of protecting and maintaining an in-house server bank. However, don’t assume all cloud service vendors handle those responsibilities appropriately. Sloppy server maintenance can open the door to cybersecurity issues, outages and other disruptions that can interfere with your business or create costs. Third-party technology risk Beyond cloud servers, you’re relying on vendors for your ERP, CRM, AI tools and other SaaS products your business uses. Are those vendors protecting your data securely? A data breach at a key vendor can leave your internal or customer data exposed or even shut down some of your core systems. In some industries like financial services, these types of data breaches are actually the most common kind, and the consequences can be just as severe as if your own systems were breached. AI and emerging technology risk AI risks like shadow AI , overspending on compute , bias, output quality and data privacy all flare up for businesses moving to integrate AI more deeply into daily operations. These risks can affect everything from your monthly AI bill to the quality of information that flows up to decision-makers to your reputation with customers. Most can be managed with careful governance, but many businesses are unaware of just how critical that is. Cybersecurity risk Cybersecurity is the technology risk area most business leaders already understand. That familiarity doesn’t make it any less vital, as a successful breach can cause financial, operational and reputational harm. AI has made it easier than ever to launch a cyberattack, and nation-state actors are increasingly pursuing attacks of their own as well, making managing cyber risk an essential pillar of any enterprise risk strategy. Competition risk Finally, technology is a major competitive edge for businesses that deploy it most effectively. Because technology changes so quickly, leaders need to constantly assess how their industries are using the latest tools, or risk getting left behind. However, you must also balance innovation with enough discipline to avoid investing in new technology simply because it’s new, as that can quickly lead to poor ROI and failed projects. A guide to managing technology risks Effectively managing your technology risks can help your business both avoid bad outcomes and actively generate good ones. Key steps to doing this include: 1. Align technology initiatives with business objectives Only onboard new technologies to solve specific business problems or create defined opportunities. Your organization has goals: Technology should be a tool to reach those goals rather than just for the sake of implementing something cool. 2. Assess technology risks before implementation Before you start using a new technology, assess the risks. For example, consider new risk exposures created by ERP implementation, cloud migration or AI tool as part of your overall process for determining whether to move in that direction. If you’ve already begun a digital transformation without considering risk, do a risk evaluation for your existing digital systems as well. Also, do your due diligence on any third-party vendors you already or plan to work with: Review each vendor’s SOC report (if a vendor doesn’t have one, run) and make sure it reflects an adequate and comprehensive SOC audit . 3. Strengthen governance and accountability Effective governance is a pillar of managing technology risk. To establish or strengthen governance , set up an ongoing governance committee (with C-suite presence or active sponsorship) that will evaluate technology risks, create policies and controls and then train team members to follow them. 4. Conduct ongoing monitoring As you implement new tech tools, conduct ongoing monitoring of technology use. This is both a governance effort to watch for risks and an opportunity to assess whether those tools are delivering ROI. 5. Continuously review and adapt Continuously review your overall technology risk strategy. Consider what you’re learning from your monitoring efforts, as well as how technologies are evolving and the nature of new risks and opportunities. Popular technology risk management frameworks to follow A technology risk management framework is a pre-existing, structured approach to managing IT risk. Often created by institutions, trade associations or international organizations, risk frameworks give you a guidebook for how to assess, mitigate and monitor risk. This is simpler and more effective than creating your own process from scratch. Two popular risk management frameworks you should be aware of include: NIST RMF: Perhaps the biggest technology risk framework, NIST RMF (National Institute of Standards and Technology Risk Management Framework) provides a seven-step process that helps organizations mitigate security, privacy and supply chain risks. COBIT: Another major technology risk framework, COBIT (Control Objectives for Information and Related Technologies), defines a series of processes to manage IT-related risks. If your industry uses a particular technology framework, adopt that one. Otherwise, any established framework is likely a good choice, as most are decades old and heavily vetted. However, don’t mix and match; pick one framework and stick with it rather than trying to pull together elements from several different frameworks. Technology risk management helps businesses modernize with confidence You need up-to-date technology to stay relevant as a business. But how much additional risk do you want to take on as you modernize? Thinking about technology risks strategically, and as part of an overall enterprise risk management strategy , can help dramatically lower your risk exposure. In practical terms, this means lower odds of financial, operational and reputational damages related to technology risks — like a bad data breach that slows down your operations and drives away customers. Embracing an active risk management strategy also helps you learn more about how your business functions, as you work to understand your processes and install stronger controls. This can deliver new efficiencies and process improvements. And finally, consider that managing your technology risk should also boost your confidence in the quality of information that’s coming from inside your organization. You can feel assured that your financial, operational and customer data is accurate, delivering a foundation for smarter business decisions. Read more Enterprise risk management strategy: A short guide for CEOs Shadow AI: How organizations can avoid this growing risk Cybersecurity risk management: A guide for business leaders
Reach out to our TCPA compliance team
Connect with our team and see how we can help protect your brand while driving compliant growth.
TCPA compliance services FAQ
The Telephone Consumer Protection Act (TCPA) was signed into law in 1991 and became one of two key federal rules, the other being the Telemarketing Sales Rule (TSR), covering telephone communications in the United States.
Any person, business, or entity that conducts telephone solicitations needs to comply with the TCPA. The TCPA covers voice calls, faxes, VoIP calls, and text messages. If an organization uses a third party to make calls on its behalf, it could be held liable for any TCPA violations made by the third party.
The TCPA covers voice calls, faxes, VoIP calls and text messages. The law defines “telephone solicitation” as “the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person, but such term does not include a call or message 1) to any person with that person’s prior express invitation or permission, 2) to any person with whom the caller has an established business relationship or 3) by a tax-exempt nonprofit organization.
The TCPA has a variety of requirements related to phone calls, text messages and faxes. For your organization to maintain TCPA compliance, it needs to be doing the following:
Consent and contact requirements
- Suppress against the national DNC registry and state DNC lists when required.
- Accept and honor DNC requests from consumers and keep a centralized list of such requests along with the dates they were made.
- Obtain prior express written consent when using autodialers or prerecorded messages.
- Only make calls between the hours of 8:00 a.m. and 9:00 p.m. at the recipient’s location.
- Ensure caller ID is displayed.
- Disclose certain material facts, including the agent’s name, company name and contact information.
- Send a DNC policy to a consumer if requested.
Agent training and operational practices
- Train all telephone agents on their compliance responsibilities prior to engaging with customers.
- Monitor the abandonment rate when predictively dialing. For calls answered by a live person, the abandonment rate shouldn’t exceed 3% in a 30-day period (per campaign).
- Include an automated opt-out feature in abandonment messages and prerecorded messages.
- Monitor and enforce internal (and external third parties) for compliance.
Documentation and recordkeeping
- Maintain records of compliance.
LET'S CONNECT
See how Wipfli can help you implement risk management that supports compliance, productivity and long-term success.
