Legal
A compliance programme people actually use
The difference between having a manual and proving it is applied.
A compliance programme is judged on one thing when the moment comes: whether it can be shown to have been alive before the problem. A manual approved three years ago and filed in a folder proves nothing — and whoever reviews it knows that.
What must be provable
| Element | What proves it | What does NOT |
|---|---|---|
| That it exists | The programme, with a trusted approval date | A document in a shared folder |
| That it is known | Training with who, when and a signed acknowledgement | An email with the manual attached |
| That it is reviewed | Periodic reviews, dated | That the latest version is three years old |
| That it is applied | Concrete cases detected and handled | That there have been none |
Important
The last row weighs most and is the most uncomfortable. A programme with no case recorded in three years does not prove everything is fine: it proves it is not being used, or that nobody dares use it.
What makes it genuinely used
Watch out
Certifying the programme on the day it is approved and at each review has a concrete purpose: if one day you must show it existed before an event, the date cannot be whatever your file server says.
What a tool cannot do
Design the programme, decide which risks apply to you, or judge whether it is sufficient. That is your adviser's or compliance officer's work. What it can do is leave a dated record of everything you do, which is exactly what is hard to reconstruct afterwards.
Worth knowing
If your programme requires certain third parties to sign up to a code of conduct, that is precisely a signature request with tracking: who signed, when, and who is missing.
›Do training records count as evidence?
With a signed acknowledgement and a date, they are what is asked for.
›What if we detect a case?
Recording and handling it is what sustains the programme, not what weakens it.
›Is this advice?
No. The programme's content is defined by whoever should; this explains how to record it.
A real case
The situation
A company approved its programme four years ago with no evidence it is applied.
What you do
- Certifies the current version
- Launches training with signed acknowledgement
- Schedules the annual review
What you get
Six months later it can show the programme is alive, which is all that is asked.
The situation
The programme exists in a document nobody opens.
What you do
- Turns it into tasks with an owner and a date
What you get
The programme leaves a trail that it is used.
The situation
Training happens and nothing is recorded.
What you do
- Records who did it and when
What you get
The evidence exists when it is asked for.
The situation
An auditor asks for evidence and is shown the manual.
What you do
- Shows the record of real operations
What you get
The control moves from assertion to evidence.
The situation
Periodic reviews happen whenever somebody remembers.
What you do
- Schedules the reminders by calendar
What you get
The cadence keeps itself.
The situation
The organisation changes and the programme stays the same.
What you do
- Reviews it when something relevant changes
What you get
The programme describes today's company.
This article answers
- compliance programme documentation
- prove compliance is applied
- compliance training records
- evidence of a compliance programme