A compliance programme is assessed on evidence of operation. Ownership, testing and escalation distinguish a functioning framework from a documented one.
When a regulator examines a compliance programme, the question is not whether policies exist but whether they operate. Evidence of operation is what distinguishes a framework that mitigates exposure from a set of documents that establishes the standard the organisation failed to meet.
Named ownership
Every obligation should have a named owner with the authority and resources to discharge it. Obligations owned by a function rather than a person tend to be owned by nobody. A compliance register mapping obligation to owner, frequency and evidence is a modest document that answers most preliminary regulatory questions.
Testing that can fail
Testing designed so that it cannot produce an adverse finding provides no assurance. Sample-based testing with documented findings, including negative findings and their remediation, is more valuable than a confirmation that controls are in place.
- Maintain an obligation register with owners and evidence requirements.
- Test a sample of controls periodically and record the findings, including failures.
- Provide an escalation route that does not run through the person being escalated about.
- Record decisions taken, including decisions to accept a risk, with reasons.
Training that is specific
Generic annual training produces completion records rather than behaviour change. Training targeted at the decisions a particular team actually makes, using scenarios drawn from the organisation's own operations, is materially more effective and considerably shorter.
Board visibility
Reporting to the board should include what has gone wrong, not only metrics that demonstrate activity. A board that has never received an adverse compliance report is not usually a board with nothing to hear.
This article discusses general considerations and is not legal advice.
