Regulations, standards, and compliance
Domain 4: Regulations, standards, and compliance
This domain tests how IROP requirements sit within a hierarchy of obligations. Candidates must identify the controlling rule, the evidence of compliance, and the action required when a requirement is missed.
Hierarchy and controls
- Law and regulation create enforceable duties; standards set consensus requirements; policies and procedures translate them into local practice. A lower-level document cannot relax a higher-level duty.
- Jurisdiction matters. Cross-border activity may trigger data-protection, consent, reporting, and retention duties in more than one place.
- Compliance is evidenced by records: approvals, training, audit results, incident reports, corrective actions, and management review.
- Exceptions require authority, a risk assessment, a time limit, and a compensating control. An undocumented workaround is non-compliance.
- Third-party suppliers remain part of the compliance chain; due diligence and contract terms must cover confidentiality, security, and reporting.
Worked example
A team wants to send case records to an overseas service provider for review. The provider is competent, but the transfer still needs a lawful basis, a permitted transfer mechanism, and safeguards such as encryption and access controls. The team must also check whether the patient must be informed or whether a reporting duty applies. Reasoning: competence of the recipient does not satisfy the transfer rule.
Traps
- Assuming a standard is automatically law.
- Applying home-country rules to a foreign placement without checking local law.
- Missing a mandatory reporting deadline because internal review was slow.
- Treating supplier assurance as a one-off signature.
- Recording an exception without an owner, expiry, or compensating control.