What does "to comply" mean?

What does it mean “to comply”?

Compliance refers to adhering to the requirements of laws, regulations, industry codes, and organizational doctrines. This obligation also extends to contractual arrangements that govern organizational processes, encompassing both externally and internally imposed criteria. For instance, in the healthcare industry, compliance might involve following stringent protocols to protect patient privacy under laws like HIPAA.

In simple terms, compliance means following the rules set by authorities other than ourselves, including the norms of our own organizations. Reflect on this: left to our own devices, would we consistently adhere to all rules and regulations imposed on us? The likely answer is no. It’s a human tendency to occasionally stretch or break rules, whether it’s speeding, bending the rules of a game, or even sidestepping corporate policies.

This innate propensity to deviate from established rules underscores the need for effective organizational compliance programs. Such programs are crucial not only for preventing violations but also for identifying and addressing them when they do occur. They foster a culture of compliance within the organization through:

1. Prevention: Establishing policies and standards designed to prevent breaches of laws and regulations.

2. Detection and Response: Implement procedures that promptly detect and address any breaches.

3. Promotion of Compliance Culture: Encouraging a workplace environment that prioritizes adherence to legal and ethical standards.

Compliance Control as a process

Compliance control is a process implemented by management and other personnel. It’s crafted to ensure that all processes, transactions, and systems that support them comply with:

• Laws governing budget use and other regulations that may significantly impact financial statements or required supplementary stewardship information.
• Additional laws, regulations, and government-wide policies outlined in audit guidelines.

Organizational leaders disseminate these controls through well-documented policies, standards, and procedures. These documents serve as guides for staff during day-to-day operations, setting boundaries and norms for behavior and decision-making. Exceptions to these rules are only made under formal approval, ensuring that deviations are well-regulated.

The need for Documented Controls

The documented controls in an organization—comprising policies, standards, and procedures—are termed ‘controls’ because they guide and limit the actions of individuals within the organization. Thus, when an organization is described as “in compliance,” it means it adheres to all set rules and guidelines through:

• The creation and implementation of a compliance program that details specific controls.
• Regular auditing to verify adherence to these controls, ensuring that practices align with stated policies and standards.

The process by which an organization moves from identifying what needs to be complied with to documenting the requirements, implementing them, and testing them is a whole other discussion.

Why compliance is a bit more complex than you’d think

Yes, “complying” is more complex than you might think. To illustrate the point, let’s start with the idea that something needs to be protected and follow the conversation from there. Once we know that we must put some type of constraints upon our actions, we know that we must have rules to follow to enact those constraints. Let’s take the case of protecting personal information. Lawmakers have seen fit to create bills and acts, which become laws that say we need to protect this type of information. However, laws aren’t rules. Regulations must be derived from those laws to create the rules we need to follow for protecting the information. Sometimes the rule makers turn to pre-existing documents, called safe harbors, to define very prescriptive rules and controls.

Lawmakers aren’t the only group working on creating controls for compliance. Self-regulatory bodies (such as manufacturing groups, groups requiring contractual obligations to be members of, etc.) can, and do, jump into the fray, as well as international and national standards bodies. The difference between these groups is that while laws are written to be prescriptively ambiguous, self-regulatory body requirements and standards organizations normally focus on very prescriptive controls.

As you can see in the previous illustration, what this leaves us with is both overlap and gaps between the various types of Authority Documents. Complying with legal and regulatory requirements can be more complex than it initially appears due to several factors^[1]:

1. Constantly evolving regulatory landscape: Laws and regulations constantly change, making it challenging for organizations to stay current and adapt their compliance processes accordingly. New regulations emerge, existing ones are amended, and interpretations can vary across jurisdictions.

2. Multiple jurisdictions and overlapping requirements: Organizations operating across different regions or countries must navigate a web of overlapping and sometimes conflicting regulations. Ensuring compliance with all applicable laws and standards can be a daunting task, especially for global enterprises.

3. Diverse business operations and data types: The complexity of an organization’s operations, products, services, and data types can increase the complexity of compliance efforts. Different business units or data types may be subject to specific regulatory requirements, necessitating tailored compliance strategies.

4. Lack of standardized processes and centralized document management: Without standardized processes and a centralized repository for legal documents, organizations may struggle to maintain consistency, track changes, and ensure all relevant parties have access to the latest information.

5. Limited resources and expertise: Compliance often requires specialized knowledge and dedicated resources. Organizations may lack the necessary expertise or resources to effectively manage compliance efforts, leading to potential gaps or oversights.

6. Evolving technologies and data privacy concerns: The rapid pace of technological advancements and increasing concerns around data privacy and security have led to new regulations and compliance challenges. Organizations must adapt their compliance strategies to address these emerging risks.

1. “(19) Navigating Compliance Complexity: Simplifying Legal Document Compliance for Businesses | LinkedIn”; “(19) Navigating the Complexity of Regulations: Why One-Size-Fits-All Compliance Can Be Dangerous? | LinkedIn”; Cooke, “Complexity Is Not the Enemy of Compliance”; “Compliance Complexity”; “Regulatory Complexity Calls for a Strategic Approach | Wolters Kluwer.”↑

Answering why you should comply

Here’s a great article on answering the question of “why” your organization should comply.

What are your thoughts?

How does your organization handle compliance? What challenges have you faced, and what strategies have you found most effective? Let’s discuss it on LinkedIn!