As companies grow and become subject to increasing regulatory scrutiny, one of the most valuable intangible assets that executives can foster is a culture of compliance. This blog post will describe the importance of a culture of compliance and how to create it.
What is a Culture of Compliance?
Culture is defined as “the set of shared attitudes, values, goals, and practices that characterizes an institution or organization.” A culture of compliance is one that values following through on an organization’s regulatory obligations and expectations, even in the face of obstacles or inconvenience. While a culture of compliance is related to a culture of ethical behavior, it is narrower and geared toward understanding the specific rules a company needs to abide by and the value that can be derived from dotting the T’s and crossing the I’s.
Why Does a Culture of Compliance Matter?
Instilling a culture of compliance helps ensure an organization can meet its goals and objectives. Such a culture helps encourage proper behaviors and steer clear of regulatory and legal trouble. This all helps enable long-term growth, security, and profitability.
The idea of having a culture of compliance is especially important for smaller businesses. As small companies grow, they will almost inevitably cross a threshold where expectations and requirements shift as they come under the purview of various governing bodies. Instilling a culture of compliance before reaching this point will help make this transition much less bumpy.
What Are the Main Pillars of Compliance & How Does Compliance Culture Relate to These?
Key components of an effective compliance program include the following:
- Written policies and procedures
- Some examples of potential policies and procedures are:
- Designated compliance officer
- Training and education
- Communication channels
- Internal auditing and monitoring
- Enforcement
- Incident response
Having a full compliance program implemented isn’t a requirement for creating a culture of compliance. You can begin instilling values and norms of compliance even if your company isn’t large enough to support or require a full compliance program. By creating a culture of compliance in advance you’ll help prepare the way for an effective compliance program.
What Are Some Ways to Create & Nurture This Culture?
Having set the stage for why you should care about a culture of compliance, the next step is to understand best practices for implementing one in your organization. These best practices are covered below, including examples of what compliance culture looks like, common barriers to avoid, and how implementation will reduce your organizational risk.
Begin with Tone at the Top
As with most things in any organization, an effective compliance culture starts with tone at the top. Leadership needs to demonstrate the importance of compliance and the value that can be derived from seemingly mundane compliance-related activities. They must also demonstrate their support by ensuring proper staffing, reporting structures, and training exist to facilitate compliance and mitigate any gaps that are found.
Assess Your Current State
Taking stock of your employees’ existing understanding and value of compliance can help you identify areas for growth. If employees already appreciate the importance of compliance, you can help prepare them for the future by identifying specific regulations to prepare for. If there is a lack of understanding around the significance of compliance activities, training (such as security awareness training) and encouragement can be offered.
Create a Plan
Based on the current state of your organization and your vision for the ideal future state, create a plan for how to get there. Develop milestones or other methods to measure your progress. Identify leaders who can take responsibility for and champion the effort to build a culture of compliance.
Communicate & Reinforce
Based on your plan, look for opportunities to consistently embed messages about compliance. Some ideas are to include compliance-related themes in meetings, incorporate compliance into company goals, strategies, and mission statements, and include compliance topics in personal goals.
Celebrate Progress
As the company makes progress, take opportunities to celebrate success. If your company successfully passes an examination or issues an audit report such as SOC 1, SOC 2, or SOC 3, make sure to recognize those responsible and celebrate the achievement together.
How Does Your Compliance Culture Impact Your Audit Process?
The components of an effective compliance program listed above map directly to the Trust Services Criteria for SOC 2 reports. Even if your company is at the beginning of its journey toward creating a compliance program, having a solid compliance culture will help your employees have the proper incentives and proactively take the steps to help facilitate the process.
Conclusion
A company’s culture is one of its most unique and valuable assets. Adding a culture of compliance to a company’s overall culture will serve it well both in the near and long term.
If you would like to learn more about how to ensure your organization’s compliance, or inquire about the audit services offered by Linford & Co, please feel free to contact us.
Tim Nackos joined Linford & Company, LLP in 2022. The first 5 years of his career were spent at the “Big Four” firms EY and KPMG providing IT assurance and advisory services. He also spent 10 years at two large financial institutions primarily in internal audit performing data analytics. Tim is a certified public accountant (CPA) in the state of Utah and is a certified information systems auditor (CISA). He holds both a Master of Accountancy and a Bachelor of Science degree in Accounting from Brigham Young University.