Effective Compliance Policy
Given more and more pressure on companies to create an Effective Compliance Policy, from anti-corruption to paying the right taxes, from quality control to data privacy protection, to name a few only, it will help to gain deeper insight into how companies can easily and efficiently create policies to keep up with the pressing compliance demand in a highly regulated and risk-fraught global environment.
It will be important to:
* Identify the purpose of your compliance policy
* Create a policy that is engaging all employees
* Establish the objectives for your policy
* Set the right tone for your policy
Who is the compliance policy for: Compliance officers, compliance managers and other professionals who want to systemize the creation and adoption of policies.
A policy states an objective the company wants to achieve, whether that objective is rooted in regulatory compliance (pay no bribes) or good business practice (always give the customer the benefit of the doubt).
The important point is that a policy tells the employee what the goal is—not how to achieve the goal. The latter is a procedure, and procedures do have an important place in the compliance program. But policies are even more important, because they fix the employee’s attention on the desired result.
The wording of a policy should engage employees in ways they understand. The easy example of this point is to translate policies into local language (which is now a given for effective compliance programs), but it goes well beyond that. Good policies are clearly written and simply written.
All policies should be tied to something: a regulatory requirement, a core value, a performance objective. Not all policies need to stem from regulatory requirements, although many do. But all policies must state why they exist (cite the relevant regulation, if one applies), and why the company wants employees to follow them.
An anti-bribery policy, for instance, should include examples of what is not allowed (making a donation to a charity run by a foreign government procurement officer) and what is allowed (paying a bribe to escape false imprisonment). The examples you include must be considered carefully. They should be practical, “real” examples of what an employee might encounter—and they also must reflect the core values or risks driving the need for the policy in the first place.
Every policy should explain how an employee can seek an exemption to it, or why exceptions are not allowed. A policy should never ignore exception requests entirely—for fear that employees will simply decide not to ask about an exception at all, and violate the policy without telling you.
A procedure to ask for exceptions (even if the answer is no) tells employees that they can play a role in policy implementation; that policies are not diktats from high command, where questions are hidden rather than raised.
In conclusion: The foundation for successis a methodical approach to crafting policies individually: policies that employees (and third parties) can understand, respect, and follow.
Whatever the regulatory requirement or business risk might be that drives the need for a specific policy, if it can’t deliver on those three points, the policy won’t work as well as the company needs.. An effective compliance program nurtures those traits as a structure for policy creation.
A compliance officer should strive to educate everyone involved in policy creation about those traits, and help them apply that more rigorous approach as they form policies across the enterprise—because, for better or worse, creating more policies will be the order of the day for quite some time.
Compliance officers need to address the broader question of policy management: ensuring that various policies don’t contradict each other, or ignore a risk, or linger past their useful lifespan.
- Latest
