What is the purpose of a Corporate Compliance Program?

The simplest definition is almost self-evident: a corporate compliance program exists to ensure that an organization complies with any laws or regulations that apply to it.

Once upon a time, that mostly meant dealing with regulatory reporting. The organization would need to file certain reports with the government from time to time — quarterly financial statements, health and safety alerts, annual billing reports for government grants or contracts, other types of reports; the list is endless — and compliance departments existed to confirm that the right data was recorded on the right forms, which were then filed with the proper agencies at the proper times.

Those basic concepts of adhering to rules, and documenting that adherence to the rules, still apply. Today, however, a corporate compliance program is much more about building and managing systems to ensure regulatory compliance all the time.

Why Have a Compliance Program?

Mostly because local and international regulators have stepped up their enforcement against corporate misconduct. The best way for a company to avoid financial penalties or jail terms is to demonstrate that it genuinely was trying to obey the corporate compliance law, but a few scofflaws (either employees or other third parties working on your company’s behalf) violated the law anyway.

Compliance programs generate that proof, which the company can then show regulators. As I have mentioned many times in this column, if you incur data breaches and can show the National Privacy Commission that you have systems in place and are monitoring the implementation, the regulator will have ‘less ammunition’ against you.

An effective corporate compliance program demonstrates that your organization is aware of the rules and laws that apply to it, and takes reasonable, sincere steps to stay on the right side of those rules and laws. That’s it, really.

The Expansion of Corporate Compliance Programs

In practice, compliance programs have assumed many more duties over the last decade or so, because the risks to organizations have expanded. Many of those risks are still rooted in some regulatory compliance issue: corruption, unfair competition, data privacy, cyber security, adherence to labor standards, environmental regulations, and so forth. But those risks also now spill over into threatening a company’s reputation with consumers, business partners, and other stakeholders — and preserving reputation with those groups is a high priority for boards and CEOs.

For example, the company might have several mid-level or senior managers who misbehave. The risk of regulatory investigation into that misconduct exists, but it’s relatively small compared to litigation risk (employees filing lawsuits), reputation risk (consumers scorching the company on social media), or operational risk (firing executives who might have been eyed for more senior roles).

Hence, companies have policies and procedures to address harassment, data privacy, onboarding for customers or third parties, and so many other issues. The compliance program exists to ensure that those policies and procedures address the company’s risks in a practical, effective manner. That could mean anything from developing new training to investigating complaints to studying data about how employees are (or are not) following policy.

You don’t just need a policy that says, “Don’t bribe.” You need a system to ensure the company is trying to prevent bribery. Or data leaks, or trade violations, or innumerable other risks.

Compliance management is a fascinating line of work when you think about all its challenges. And all those challenges are here to stay!

If you need assistance, or if you are interested to look at software systems that can control / monitor behavior, let me know – you can email me at [email protected]