Compliance, Ethics and Regulatory Obligations
The compliance architecture
Compliance is the obligation to obey applicable laws, regulations, standards and internal policies, and to demonstrate that obedience. Candidates must understand the compliance framework: obligations register, policy hierarchy, controls, monitoring, training, whistleblowing, investigation and remediation. Know the difference between mandatory requirements and voluntary codes, and between compliance (following the rule) and ethics (doing what is right beyond the rule).
Key concepts include tone at the top, speak-up culture, conflicts of interest, anti-bribery and corruption, data protection, modern slavery and supply chain due diligence, and sanctions. Understand proportionality: controls should match the size, sector and risk profile of the organisation. A small entity still needs segregation of duties, but may achieve it through oversight by a treasurer or a second signatory rather than a large compliance team.
Traps to watch
Questions often test the difference between legality and ethics - conduct can be lawful yet unethical, and the board must address both. Another trap is assuming a written policy equals an effective control; without training, monitoring and consequence, it is only paper. Watch for options that respond to a breach by tightening a policy while ignoring the culture that allowed it.
Worked example
A supplier is found using forced labour deep in the chain. Rule of thumb: remediate, don't just terminate. Immediate termination can harm the very workers you aim to protect. The better answer combines worker remedy, supplier corrective action, disclosure where required, and strengthened due diligence - with board oversight of the plan.