The very word “Com­pli­ance” strikes dread in many senior man­age­ment forums.

Viewed most often as a pain, neces­sary evil, or at best a burden on the busi­ness, Com­pli­ance has become a word most often asso­ci­ated with a sigh of despair. But should this really be the case? The very reason many senior man­agers have to be dragged kicking and scream­ing into the Com­pli­ance arena is often the com­plex­ity of the subject and fear of the unknown.

At the end of the day most senior man­agers are focused on making money for the busi­ness, con­trolling costs and gen­er­at­ing value for the share­hold­ers so they view com­pli­ance issues as a distraction.

Now that is inter­est­ing in itself, par­tic­u­larly the latter two points.

Surely con­trolling costs and gen­er­at­ing value for the share­hold­ers should be really good drivers to under­stand what Com­pli­ance can mean to the busi­ness? Part of the problem, and the per­cep­tion, is the pleth­ora of dif­fer­ent com­pli­ance issues that appear when the surface of the topic is scratched, e.g. Human Rights, Privacy, Data Pro­tec­tion, Freedom of Inform­a­tion, Tax­a­tion, Cor­por­ate Gov­ernance, Intel­lec­tual Property/Copyright, Health & Safety, Fraud & Cor­rup­tion, Com­pet­it­ive Prac­tice, Anti-trust, Money Laun­der­ing, Stand­ards (e.g. ISO/IEC27001, COBIT, SAS70) and much more.

Is it any wonder why senior man­age­ment would rather avoid getting embroiled in this as much as pos­sible? The problem is — it is their respons­ib­il­ity, and they are account­able for Com­pli­ance so, in time, many will become to realise that they have no choice and even that Com­pli­ance can provide real bene­fits to the business.

How can this ever happen?

Surely the whole Com­pli­ance effort costs a fortune and bogs the busi­ness down in unne­ces­sary procedure?

All many man­agers see is increas­ing red-tape, extra costs for con­trols, new or increas­ing com­pli­ance teams, per­sonal liab­il­ity and spiral­ing overheads.

But, is this a fair view? Sure there are addi­tional costs to be carried for the com­pli­ance efforts, but it could be argued that these are more than bal­anced by factors such as:

* Increased Customer/Shareholder/Partner con­fid­ence and trust
* Improved ana­lysis, doc­u­ment­a­tion and effi­ciency of busi­ness pro­cesses
* Better busi­ness resi­li­ence
* Greater buy-in from man­age­ment and staff
* The de-duplication of control efforts
* Faster audits with less hold points
* Reduced audit costs Reduced crisis/incident man­age­ment and remedial action costs
* Avoid­ance of legal or reg­u­lat­ory sanc­tions or fines and more …

It is sur­pris­ing how the very attempt to ensure Com­pli­ance can often become a cata­lyst for change. As a busi­ness grows often the devel­op­ment and doc­u­ment­a­tion of sound busi­ness pro­cesses falls by the wayside and greater reli­ance is placed upon staff know­ledge and expertise.

This can work for a while but we live in an ever chan­ging world where the pace of life is increas­ing daily and a lack of sound busi­ness prac­tice will mean trouble in the future. It only takes a key member of staff to leave, or say a dis­gruntled member of staff to ‘throw a spanner in the works’ and serious reper­cus­sions can ripple through­out the business.

Yes — we all know we should write pro­ced­ures so that someone can take over if the worst should happen; but the ‘instant’ nature of the working envir­on­ment today (e.g. the Inter­net, email, instant mes­saging, mobile con­nectiv­ity) makes that very unlikely — we just do what we do!

This is where Com­pli­ance brings back some sanity to the work­place. An auditor is not sat­is­fied by ‘hearsay’ evid­ence that a key busi­ness process is oper­at­ing in line with legal or reg­u­lat­ory require­ments — they want cold, hard doc­u­ment­ary evidence!

The Com­pli­ance drive has a tend­ency there­fore to under­line the need for key con­trols, pro­ced­ures and evid­ence, and to ensure that adequate funding is com­mit­ted to their main­ten­ance. What is often missed is the oppor­tun­ity to develop one man­age­ment system to control all aspects of com­pli­ance, regard­less of law, reg­u­la­tion or standard.

Many organ­isa­tion still approach Com­pli­ance from a piece­meal angle — HR do their bit, IT do their bit, Legal do their bit, etc. It is also common to see organ­isa­tions cre­at­ing sep­ar­ate teams, tasked with com­pli­ance to a par­tic­u­lar piece of legis­la­tion. This is, at best, unwieldy, inef­fi­cient and expens­ive; a prac­tice to be avoided. This can be due to the ‘siloed’ nature of many organ­isa­tions, internal polit­ics, expert­ise issues, or just plain stub­born­ness to get involved.

The problem is Com­pli­ance issues usually cut right across the busi­ness and a very strong lead is needed for any team that is going to co-ordinate all issues company wide. A com­pet­ent Com­pli­ance team can build one man­age­ment system that will provide co-ordination of the com­pli­ance effort, one repos­it­ory and source of inform­a­tion for audit trails and asso­ci­ated evidence.

This avoids the ‘empire build­ing’ that often happens when say a new piece of legis­la­tion comes along, con­tain­ing and poten­tially redu­cing costs.

So, ‘Over­head or Busi­ness Benefit’?

Much depends on your view­point and the type of organ­isa­tion you work for. Finance, Banking and Insur­ance are heavily reg­u­lated, and accept Com­pli­ance as just part of daily busi­ness, whereas for, say a man­u­fac­tur­ing busi­ness, this is all just a cost they would prefer not to have.

Hope­fully this will change in time, legis­la­tion may become simpler and easier to under­stand (eh .. pos­sibly..), busi­ness prac­tices and man­age­ment systems will improve, and many will see how the Com­pli­ance effort can bring real dividends.Business

Clif­ford May, Con­sultancy Prac­tice, Integ­ralis Ltd UK