You are about to set up a compliance unit in your company. However, no laws require you to do so nor prescribe how you should do it. You can design it at your convenience. This freedom can pose significant challenges: how do you make the right choices when possibilities are unlimited? To navigate this complexity, you should consider a series of foundational questions that will shape the core of your compliance architecture and strategy.
History
Has your company suffered major compliance incidents in the past? Are you aware of major compliance incidents at other companies in your industry?
Purpose
If your company is not legally required to set up a compliance unit, why do you consider establishing one? Who is asking for it, and what are their reasons? Your company already has many compliance systems in place (e.g., the HR department handles compliance with HR laws and regulations), so what added value would a compliance unit provide beyond the existing procedures?
Culture
How would you describe your company’s corporate culture in relation to compliance? How does it fit within the company’s values? What is the ‘tone at the top’ in this domain? How do managers, employees, and workers feel about compliance? Are formal and informal messages about compliance consistent?
Scope
Many laws and regulations apply across many areas: international sanctions, GDPR, health and safety, environment, HR, tax and accounting, etc. There are also contractual obligations, industry standards, and internal rules (code of conduct, policies, standard operating procedures, etc.). Among all these rules, which ones would fall within the scope of the compliance unit, and why?
Scope (geography, units, and people)
Would the compliance unit’s scope of work be global, or limited to a region or specific locations? Would it apply to all affiliates, business units, and corporate functions within the company, or only some? Which ones? What about the others?
Role
What would be the role of the compliance unit? Would they serve as a service centre to help other departments and business units design and implement their compliance policies and processes? As a training & communication centre to increase awareness? As a control & enforcement unit? As an office to process administrative work and produce reports?
Goals and operations
Assuming the role of the compliance unit has been determined, what would be its long-term and short-term goals and what would be the strategies to achieve these goals? What would the compliance unit do in practice, and how (methodologies, processes, and tools)?
Interface with other corporate functions
What would be the interactions between the compliance unit and other corporate functions (Legal, Internal Audit, Risk, HR, Security, Health and Safety, Procurement, etc.)? What would be their respective roles, authority, and accountability? How would they collaborate? How to avoid creating an additional bureaucratic silo?
Responsibilities of the business
To what extent do business managers feel responsible for compliance? How do the business units organise to ensure compliance of their operations? What interactions would they have with the compliance unit?
Governance and reporting lines
Would the compliance unit stand alone or sit within the Legal department? What will the reporting lines be to the CLO, to the CEO, and the Board?
Staffing
What profiles do you need? How many people would there be? Where would they be located? What would be the job description of each member of the team?
