Compliance

The word carries two meanings. As a state, a company is compliant when its activities match its obligations. As a function, compliance is the team that identifies those obligations, turns them into policies and controls, trains staff, monitors results and reports breaches. In a typical set-up the business owns the risk and compliance sits in the second line, advising and challenging. Obligations come from outside, such as statutes, licence conditions and industry codes, and from inside, such as the code of conduct. Some firms also include voluntary commitments like contract terms and sustainability pledges. Compliance asks whether a rule is met; it does not by itself decide whether an act is right. Regulated industries such as banking, pharmaceuticals and aviation have large teams, but every organisation has obligations. A lapse can end in a fine, a withdrawn licence or a lawsuit, and customers tend to remember it longer than the regulator does.

A medical device maker sells in several countries. Its compliance team keeps a list of the rules each market imposes on labelling and complaint reporting, writes procedures for staff and tests whether they are followed. When a distributor omits a required warning, the team records the breach and works with the business to fix it.