Compliance: Obligations, Controls, and Culture
What compliance requires
Compliance is the discipline of identifying applicable obligations, translating them into controls, and evidencing that those controls operate. Obligations come from law, regulation, contracts, standards, and internal policy. A credible compliance program maps each obligation to an owner, a control, and a monitoring method.
Concepts to master
- Obligation register: a single inventory of requirements with ownership and applicability rationale; regulators expect proportionality and documented risk assessment.
- Three pillars: prevention (policies, training), detection (monitoring, surveillance), response (investigation, remediation, reporting).
- Know your customer / third-party due diligence: compliance extends to intermediaries and vendors; outsourced activity does not outsource accountability.
- Whistleblowing and speak-up channels: must be accessible, confidential, and free from retaliation, with escalation independent of the line being reported.
- Regulatory change management: horizon scanning and timely policy updates; stale policies are themselves a compliance failure.
Traps in questions
Questions often reward the answer that documents and escalates over the one that quietly fixes a breach. Another trap: assuming a policy's existence proves compliance - evidence of operation is required. Watch for options that let a business unit self-certify high-risk obligations without independent challenge.
Worked example / rule of thumb
A monitoring report shows a sanctions-screening control failed for three days. Correct handling: log the incident, assess exposure, remediate the control, notify the accountable executive and, where required, the regulator, then test that the fix works. Rule of thumb: detect, contain, escalate, remediate, verify - in that order, with evidence at each step.