In general, compliance means conforming to a rule, such as a specification, policy, standard
or law.
Regulatory compliance describes the goal that organizations aspire to achieve in their efforts
to ensure that they are aware of and take steps to comply with relevant laws and regulations.
Due to the increasing number of regulations and need for operational transparency, organizations
are increasingly adopting the use of consolidated and harmonized sets of compliance controls.
This approach is used to ensure that all necessary governance requirements can be met without
the unnecessary duplication of effort and activity from resources.
Standards and regulations The International Organization for Standardisation
produces international standards such as ISO17799.
The International Electrotechnical Commission produces international standards in the electrotechnology
area.
Some local or international specialized organizations such as the American Society of Mechanical
Engineers also develop standards and regulation codes.
They thereby provide a wide range of rules and directives to ensure compliance of the
products to safety, security or design standards.
There are a number of other regulations which apply in different fields, such as PCI-DSS,
GLBA, FISMA, Joint Commission and HIPAA.
In some cases other compliance frameworks or standards inform on how to comply with
the regulations.
USA Corporate scandals and breakdowns such as
the Enron case of reputational risk in 2001 have highlighted the need for stronger compliance
and regulations for publicly listed companies.
The most significant regulation in this context is the Sarbanes–Oxley Act developed by two
U.S. congressmen, Senator Paul Sarbanes and Representative Michael Oxley in 2002 which
defined significantly tighter personal responsibility of corporate top management for the accuracy
of reported financial statements.
The Office of Foreign Assets Control is an agency of the United States Department of
the Treasury under the auspices of the Under Secretary of the Treasury for Terrorism and
Financial Intelligence.
OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy
and national security goals against targeted foreign states, organizations, and individuals.
Compliance in the USA generally means compliancy with laws and regulations.
These laws can have criminal or civil penalties or can be regulations.
The definition of what constitutes an effective compliance plan has been elusive.
Most authors, however, continue to cite the guidance provided by the United States Sentencing
Commission in Chapter 8 of the Federal Sentencing Guidelines.
On October 12, 2006, the U.S. Small Business Administration re-launched Business.gov which
provides a single point of access to government services and information that help businesses
comply with government regulations.
UK There is considerable regulation in the UK,
some of which is from EU legislation.
Various areas are policed by different bodies, such as the FCA, Environment Agency and Scottish
Environment Protection Agency, Information Commissioner's Office and others.
Important compliance issues for all organisations large and small include the Data Protection
Act 1998 and, for the public sector, Freedom of Information Act 2000.
The UK Corporate Governance Code is issued by the Financial Reporting Council and sets
out standards of good practice in relation to board leadership and effectiveness, remuneration,
accountability and relations with shareholders.
All companies with a Premium Listing of equity shares in the UK are required under the Listing
Rules to report on how they have applied the Combined Code in their annual report and accounts.
Australia Standards Australia revised the standard titled
"AS 3806 - Compliance Programs".
While many aspects of the original standard produced in 1998 standard appear in the 2006
version there are additional principles covered.
The regulators in Australia continue to endorse and encourage the use of the standard when
establishing a compliance framework.
The regulators are the Australian Securities and Investment Commission and the Australian
Prudential Regulation Authority.
Compliance demands in the superannuation industry continue to increase due to the new licensing
regime implemented by APRA.
The new licensing regime requires trustees of superannuation funds to demonstrate to
APRA that they have adequate resources, risk management systems and appropriate skills
and expertise to manage the superannuation fund.
The licensing regime has lifted the bar for superannuation trustees with a significant
number of small to medium size superannuation funds exiting the Industry due to the increasing
risk and compliance demands.
Canada See Keeping the Promise for a Strong Economy
Act, 2002, commonly known as C-SOX or "Bill 198".
Challenges Data retention is a part of regulatory compliance
that is proving to be a challenge in many instances.
The security that comes from compliance with industry regulations can seem contrary to
maintaining user privacy.
Data retention laws and regulations ask data owners and other service providers to retain
extensive records of user activity beyond the time necessary for normal business operations.
These requirements have been called into question by privacy rights advocates.
Compliance in this area is becoming very difficult.
Laws like the CAN-SPAM Act and Fair Credit Reporting Act in the U.S. require that businesses
give people the “right to be forgotten.”
In other words, they must remove individuals from marketing lists if it is requested, tell
them when and why they might share personal information with a third party, or at least
ask permission before sharing that data.
Now, with new laws coming out that demand longer data retention despite the individual’s
desires, it can create some real difficulties.
Definitions Related to Compliance Compliance data is defined as all data belonging
or pertaining to enterprise or included in the law, which can be used for the purpose
of implementing or validating compliance.
It is the set of all data that is relevant to a governance officer or to a court of law
for the purposes of validating consistency, completeness, or compliance
See also China Compulsory Certificate
Business Motivation Model.
A standard for recording governance and compliance activities
Call Report Chief compliance officer
Governance, Risk Management, and Compliance Compliance and ethics program
Enforcement Health Care Compliance Association
Law enforcement agency Law enforcement templates by country or region
Society of Corporate Compliance and Ethics References
External links Business.USA.gov, Official U.S. Government
Portal for Complying with Regulations.
European Project COMPAS, European Project COMPAS - Compliance-driven Models, Languages,
and Architectures for Services; funded by the EU 7th Framework Programme Information
and Communication Technologies Objective.