Building an Effective Compliance Program

Compliance is sometimes treated as a regulatory burden. In practice an effective program is a cost-reduction tool: finding a breach early is always cheaper than addressing it after it has reached the regulator.

Components you cannot skip

• A written risk assessment identifying where breach is actually concentrated in this organisation's activity specifically.
• Policies and procedures written in language the people applying them understand, not only in regulatory language.
• An internal reporting channel that protects the reporter — otherwise the information never arrives.
• Documented periodic training, and an independent review that tests the program rather than merely describing it.

The indicator that matters

The clearest indicator of effectiveness is not the number of policies, but the number of breaches found internally before an external party found them. A program that never finds anything is not necessarily a successful one.