A traditional approach to compliance has been about policing environments based on expectations of regulators but this is not necessarily the best way to go about bringing true cultural change. In today’s complex environment, organizations looking to leverage compliance to create a competitive advantage are looking at their programs from a more holistic perspective. While the building blocks remain the same, including programs like risk assessments, policies and training, reporting systems and third-party management, today’s effective compliance programs are fused with the mission and strategy of the organization.

To evaluate compliance programs, regulators look at the tone from the top and whether it illustrates the expectations of the board and the C-suite. They also seek to understand whether there are adequate resources given to the compliance and legal function and whether they are adequately independent from the C-suite. Are there incentives that are problematic? Are there appropriate disciplinary measures in place? Is there a continuous review and improvement process? Are investigations done by qualified personnel?

Compliance needs to be an enterprise-wide effort and everyone across the business needs to understand the risk, and view the function as a critical component to the business strategy. Compliance needs to understand the business and the business needs to understand the value of compliance. When you look at compliance through this lens, you begin to develop a deeper and business-informed understanding of risk.

If you look at profitability rather than revenue, then you look at the costs of non-compliance and the damage that can be done to your bottom line including fines and legal costs. Looking at profitability from a multi-year process enables you to have a longer horizon but it can be undermined by compensation schemes where bonuses are given based on revenue which may be unintentionally driving unethical behavior.

Creating real cultural change within an organization around your approach to compliance can be done by:

• Integrating clear and regular messaging and modeling behaviors across executives, middle management and peers. It’s not just what you say, but how you say it and it is also about demonstrating the right behaviors.
• It’s important to think of all personnel in your program . There may be many people who have activities in their day-to-day work that touch on compliance and they need to understand their role in this change.
• Making sure that you have the appropriate time and resources is critical, and that includes the ability to bring in external resources and expertise as needed. It may also mean exploring options like technology to help make these processes and communications more efficient and effective.
• Linking up with processes in other areas of the corporation such as ESG, ERM, and crisis planning will enable the streamlining of processes as well as the ability to establish clear mandates and identify potential areas of overlap.
• Consider how your existing processes may not foster compliant behaviors. For example, some organizations may prioritize revenue over profitability, particularly in compensation structures. But, as noted above, this can inadvertently create an environment that rewards potentially non-compliant behaviors that inflate revenue generation.

An effective compliance program is very much a long term and ongoing effort. It’s not only the infrastructure and resources but it’s also the cultural element which takes time and commitment.