Compliance Management: Guide & tips to get started

Compliance management is a collective term for all the tools and processes a company implements to ensure compliance with the rules. These rules include both outside regulatory and legal requirements as well as internal policies and bylaws. Compliance management tools and processes aim to detect compliance violations and also protect a company from these violations which can cost a company considerable reputational damage and high financial penalties.

Companies often implement compliance management platform to automate and streamline many compliance processes, such as digital whistleblowing systems for employees and stakeholders to report irregularities and approval systems to manage approvals for gifts and hospitality.

The seeds of compliance were sown in the 1970s and 1980s when scandals in the USA (Watergate, Lockheed) highlighted the widespread practice of companies bribing politicians and government officials. These events led to the US passing the Foreign Corrupt Practices Act (FCPA) in 1977 which outlawed corporate bribery of foreign government officials for the first time. More corporate scandals and breakdowns such as the Enron case in 2001 have increased calls for stronger compliance and regulations, particularly for publicly traded corporations. The most significant statutory change in this context was the Sarbanes–Oxley Act 2002 which defined significantly tighter personal responsibility of corporate top management for the accuracy of reported financial statements. Since then increased regulation in both USA and Europe (UK Bribery Act, SAPIN II in France, EU Whistleblowing Directive) has caused top management to place greater emphasis on compliance and ethical conduct, reinforce their compliance departments and implement widespread compliance management systems.

Common compliance frameworks (ISO 19600, IDW PS 980) and the relevant international regulations (such as DoJ guidelines and the UK Bribery Act) all state that a comprehensive compliance risk assessment should form the foundation of any compliance programme. A risk assessment ensures that companies set the correct priorities and implement effective measures to counteract relevant compliance risks. The compliance risk assessment would ideally be carried out before the compliance department put any specific compliance measures in place so that resources can be correctly allocated from the start.

If a compliance violation does occur, the risk assessment also serves as important evidence to law enforcement and auditors that the company has thoroughly considered the risks and has taken appropriate countermeasures.

It is a general rule that compliance management will not succeed unless there is a general culture of integrity in the company. This is the foundation to any successful compliance management programme. Without this, organisations are likely to view their ethics and compliance programmes as a set of tick-box activities, or even worse, as a roadblock to achieving their business objectives.

If your company is new to compliance management, the following six tips will help you to get started:

• Make sure everyone is on board – from the leadership to subject matter experts, all relevant stakeholders should understand why a compliance programme is important and what it aims to achieve. This sets the tone from the top.
• Conduct a risk assessment – This focuses the board and senior management on those risks that are most significant within the organisation, and provides the basis for determining the actions necessary to avoid, mitigate, or remediate those risks.
• Conduct a policy audit – to take inventory of what is already out there. This will expose any gaps in your existing policy library, and any necessary updates that need to be made.
• Provide training – it’s not enough to simply update the policies. Employees need to both understand the policies and how they apply to their day-to-day work. That’s where training comes into play.
• Establish a monitor and review process – this will future-proof your programme and ensure your programme stays relevant.
• Build in accountability – there needs to be procedures in place for when an employee fails to comply. These should include clear disciplinary guidelines and protocols that are actively and consistently enforced.

Find out more about the upcoming ISO 37301 standard for compliance management systems.

Since compliance is still a relatively new topic within companies, there are many misconceptions about what a compliance manager does.

Compliance managers provide an in-house service that effectively supports business areas in their duty to comply with relevant laws and regulations and internal procedures. They do this by tracking regulatory developments that may affect how the company functions, regularly maintaining policies and procedures which help a company to remain within an industry’s regulatory framework, and organise regular training sessions for employees to communicate any key regulatory changes. They oversee the company’s compliance management programme and identify any hidden risks the company may face. It is the compliance manager‘s duty to ensure continual monitoring and review of compliance procedures to help identify possible areas where improvements could be made.

The Corona crisis has had a huge impact on the work of compliance managers. The ability for managers to communicate the latest regulations and updates to staff has been hampered by the cancellation of in-person training events and more employees now working from home. Given these conditions, Corona has also forced compliance managers to face the fact that their processes – often still managed on paper and spreadsheets – are out of date. Luckily there are tools which automate processes and help compliance managers carry out their daily work more easily and effectively.