Get Started
Getting started with compliance is likely the hardest part. There are many new words to learn and often concepts that are difficult to understand.
This webpage assumes that Management and the Board are aware of their responsibility and is committed. This is not always the case and the biggest challenge might end up being communication and implementation of the various processes all the way out in the front line of the company.
Lastly the aim of this webpage is to help build a compliance framework that can actually work in real life and with real people.
The Compliance House
A way to illustrate how compliance looks within the organisation is to see it as a house.
Code of conduct
The is the “Tone from the top”, the culture so to speak. Often the direction is set by the Board or the Management and in practice written and maintained by Compliance.
Policy – The Why
Policies are the descriptive arm of governance. It regulates behaviour and applies to all employees. It defines the roles and responsibility and often stems from laws and regulations.
Policies can have both an external and internal direction. A external Privacy policy describes how you handle data of visitors to your website where as an internal Privacy policy describes how you handle the data of your employees.
An example could be a Whistleblower policy. It explains why, who and how employees can submit whistleblower reports. The policy should be clear about who has what roles when it come to handling a whistleblower case as well as who is responsible for maintaining the policy and who has approved it. Lastly the whistleblower directive in the EU is the source of the regulation.
Procedure – The What
Procedures are the implementation of the behaviour principles from the policy. It describes how to act to be compliant with the policies and applies broadly to the employees. It should be easy to read and understand.
On this webpage we will not be dealing with Procedures as something separate and instead work them into our Polices and Processes. But you should be aware that some companies work with them as something distinct.
An example could be that all sexual harassment should be reported to nearest leader or via the whistleblower channel.
Process – The How
The process describes in detail how a task is to be carried out and applies to the specific employees who are to carry out a given task.
An example could be the compliance employee who receives a whistleblower case needs a guide on how to open the whistleblower tool, how to ad internal notes, communicate with the whistleblower and escalate the issue.
Documentation
Documentation is the foundation and is about the company being able to document that is has done what is says it does.
Whats next