Being compliant with legal requirements is often a high-priority focus area for most corporates. However, with increasing regulations, intensified regulatory activism, rise in costs and a shortage of experience-diversified professionals, we are perhaps living in the most challenging times in the history of corporate compliance. Further, unlike their other well-documented business processes, it has been observed that very few corporates approach compliance management in the same manner and instead it remains veiled function, carried out by a handful of people, who lack a comprehensive view of the company’s operations; a far cry from idiot-proof factory operations, service delivery processes or store opening playbooks that they have.
While there is an ISO standard and other recommendations from global bodies prescribing requirements for compliance management, the nuances of corporate culture, operations, territorial spread and personnel make it difficult to have a one-size-fits-all compliance program. Thus having a customised compliance management program is as important as having a corporate mission or a documented sexual harassment policy. In this post, we attempt to list out some of the elements that go into creating an effective compliance management program.
1. Culture from the top
In most cases, the success of any compliance management program will be determined by the attitude and perspective of the Board and senior management and their efforts in permeating the message across the company. It is crucial to be compliant in spirit and not just letter. The culture of a successful compliance management program includes vision and relates to goals such as:
- Leading by example;
- Communication effectively;
- Imbibing a zero-tolerance policy;
- Investing in, and hiring the appropriate resources;
2. Documented Code of Conduct, Policies, SOP’s
As a matter of good governance, every company should have a code of conduct for its employees, partners and vendors, to lay down guidelines for interacting and transacting. Further, companies should strive to create policies around legal requirements and some of their core operations which will lay down the do’s and don’ts for those activities. Yet, it can be seen that most companies fall short in creating and/or effectively documenting these codes or policies, and operate more on word-of-mouth and inherent trust in the system. Any such codes and policies (SOP’s even) should be documented, revised and updated periodically, and all concerned stakeholders should be made aware of these documents. Again, merely having a policy document should not suffice, as awareness and monitoring adherence to such policies should be the ultimate goal.
3. Resources
Companies should be careful to allocate the appropriate personnel and resources (quality & quantity) to in order to effectively manage its compliance program. Personnel should be a cultural fit, qualified and experienced with an attitude to drive the program across the company. Additional resources such as financing, management or tracking tools should also be considered while developing a program as even the best program will not yield result unless there are resources to implement it.
4. Risk Assessment
Anticipating risk and preparing for it is a core activity of corporates. In addition to being compliant for the benefits of being compliant, the core reason to assess and monitor compliances and non-compliances is to be able to predict and mitigate the risk associated with it. For any compliance program to be successful, risk assessment should be the backbone. Quantifying risk to each compliance activity, monitoring its performance and analysing historical trends and forecasting future performance should form part of all compliance programs in order to effectively predict and mitigate such risks.
5. Performance assessment
Companies should adopt a zero-tolerance policy towards non-compliances, even if the risk arising from it may be trivial. To this effect company’s should ensure that they adequately reward the top performers and take strict action against negligent or mischievous performers. Incentives and disciplinary measures should be laid down in the Code of Conduct or other policy documents of the organisation.
6. Independent verification
In order to be truly credible, it is important for companies to have their compliance status and program assessed and verified by a reliable third party assessor/auditor. Having a compliance program without independent verification is like grading oneself for any entrance exam – will not be free from biases and internal pressures. Organisations, especially their senior management should take pains to ensure that their compliance program is accurate and free from bias.
7. Reporting and investigations
No matter the repercussions, instances of non-compliance should always be reported honestly and clearly, investigations should be carried out to determine the cause of such non-compliances and corrective actions should be recommended to ensure that such instances don’t recur. All three of these activities should go into this aspect of a compliance program.
8. Training and sensitising
One of the most frequently encountered “complaints” in carrying out an effective compliance management program is that it “adds to the burden” of already overburdened personnel. It is observed, the root cause of such complaints lies in the lack of sensitising of non-legal and non-secretarial personnel. Not being trained or qualified in comprehending the importance of being compliant and the risks associated with it, it has been seen that a short sensitising session remarkably changes the outlook and makes such personnel be willing to comply in spirit and letter.
9. Continuous improvement
Like any other program, an effective compliance management program will need to be reviewed at frequent intervals and based on such review, tweaked in order to address any shortfalls and inefficiencies. The frequency of such reviews need to be determined based on actual performance.
So that’s our list of some of the essential elements to include in an effective compliance management program. The weightage put to each will need to be determined by the board and senior management the company. In these challenging compliance times, it is essential for ALL companies, no matter the size, operations or industry, to have an effective compliance management program.
If you feel there are any other elements or activities that need to be included in an effective compliance management program, feel free to leave line in the comments section below.
If you would like advise on setting up a compliance management program at your company, feel free to drop us a line at inquiries@lexplosion.in and we’ll help you set one up.
Disclaimer
All material included in this blog is for informational purposes only and does not purport to be or constitute legal or other advice. The Blog should not be used as a substitute for specific legal advice. Professional legal advice should be obtained before taking or refraining from an action as a result of the contents of this blog. We exclude any liability (including without limitation that for negligence or for any damages of any kind) for the content of this blog. The views and opinions expressed in this blog are those of the author/(s) alone and do not necessarily reflect the official position of Lexplosion. We make no representations, warranties or undertakings about any of the information, content or materials provided in this blog (including, without limitation, any as to quality, accuracy, completeness or reliability). All the contents of this blog, including the design, text, graphics, their selection and arrangement, are Copyright 2018, Lexplosion Solutions Private Limited or its licensors.
ALL RIGHTS RESERVED, and all moral rights are asserted and reserved
