An effective compliance policy keeps you out of trouble

Given more and more pressure on companies to create an Effective Compliance Policy, from anti-corruption to paying the right taxes, from quality control to data privacy protection, to name a few only, it will help to gain deeper insight into how companies can easily and efficiently create policies to keep up with the pressing compliance demand in a highly regulated and risk-fraught environment.

The compliance policy, properly implemented, reduces the risk of compliance breaches which would undermine the reputation of your organization.

It is important to:

Identify the purpose of your compliance policy

* A policy states an objective the company wants to achieve, whether that objective is rooted in regulatory compliance (pay no bribes) or good business practice (always give the customer the benefit of the doubt). The important point is that a policy tells the employee what the goal is—not how to achieve the goal. The latter is a procedure, and procedures do have an important place in the compliance program. But policies are even more important, because they fix the employee’s attention on the desired result.

Create a policy that is engaging all employees

* The wording of a policy should engage employees in ways they understand. The easy example of this point is to translate policies into local language (which is now a given for effective compliance programs), but it goes well beyond that. Good policies are clearly written and simply written.

Establish the objectives for your policy

* All policies should be tied to something: a regulatory requirement, a core value, a performance objective. Not all policies need to stem from regulatory requirements, although many do. But all policies must state why they exist (cite the relevant regulation, if one applies), and why the company wants employees to follow them.

Set the right tone for your policy

* An anti-bribery policy, for instance, should include examples of what is not allowed and what is allowed. The examples you include must be considered carefully. They should be practical, “real” examples of what an employee might encounter—and they also must reflect the core values or risks driving the need for the policy in the first place.

Every policy should explain how an employee can seek an exemption to it, or why exceptions are not allowed. A policy should never ignore exception requests entirely—for fear that employees will simply decide not to ask about an exception at all, and violate the policy without telling you. A procedure to ask for exceptions (even if the answer is no) tells employees that they can play a role in policy implementation; that policies are not dictates from high command, where questions are hidden rather than raised.

In conclusion: The foundation for success is a methodical approach to crafting policies individually: policies that employees (and third parties) can understand, respect, and follow. Whatever the regulatory requirement or business risk might be that drives the need for a specific policy, if it can’t deliver on those three points, the policy won’t work as well as the company needs.

An effective compliance program nurtures those traits as a structure for policy creation. A compliance officer should strive to educate everyone involved in policy creation about those traits, and help them apply that more rigorous approach as they form policies across the enterprise—because, for better or worse, creating more policies will be the order of the day for quite some time. Compliance officers need to address the broader question of policy management: ensuring that various policies don’t contradict each other, or ignore a risk, or linger past their useful lifespan.

It may by useful to automate the compliance program, especially that on data privacy protection, covered by the Philippine Data Privacy Act. A very good software is available that can manage the compliance process.

If assistance is required, contact me at [email protected]