The difference between an organisation that complies and one that claims to comply shows up in a single question: when did you last test a control yourselves, before someone else tested it?
1 Testing controls
Monitoring does not mean asking “did you comply?” — it means verifying with samples and evidence:
| Control | Testing method | Evidence required |
|---|---|---|
| A signed contract for every employee | A sample of 10 files | Copies of the contracts with their dates |
| Dual authorisation on transfers | A sample of the month’s transfers | The system log showing both approvals |
| Updating customer data | A sample of long-standing customers | The documented date of the last update |
| Staff training | Reconcile the staff list against attendance | The attendance sheet and assessment results |
Design or effectiveness?
Two different questions: is the control well designed to prevent the risk? And does it actually operate throughout the period? A control that is excellent on paper but switched off in the system fails the second.
2 Compliance indicators
| Indicator | What it reveals |
|---|---|
| Share of obligations met on time | Discipline of the statutory calendar |
| Number of recurring findings | Superficial treatment of the root cause |
| Average time to close a finding | Seriousness of follow-up |
| Share of staff trained | Awareness coverage |
| Number of reports received and their outcomes | Staff confidence in the channel |
| Fines and penalties during the period | The programme’s bottom line |
Zero reports is not success
A complete absence of reports usually does not mean an absence of violations — it means an absence of trust in the channel, or ignorance that it exists. Read the number alongside survey and training results.
3 The compliance report
A good report is short, answers four questions, and is submitted periodically to the committee or the board:
Where do we stand?
The status of obligations and indicators
What is new?
New regulations and their impact on us
What went wrong?
What occurred and how it was handled
What are we asking for?
Decisions or resources required
A report that asks for no decision is an information display, not a governance tool
| Obligations | 42 obligations · 40 on time · 2 late (with reasons stated) |
| Testing | 6 controls tested · 5 effective · 1 needs a procedural change |
| Developments | An update to a disclosure requirement — impact: amend a form and train the team |
| Reports received | 3 reports · 2 closed · 1 under investigation |
| Asked of the committee | Approve the updated gifts policy · approve specialised training |
4 A culture of compliance
Controls stop the person who would breach the rules out of inattention; culture produces the person who would not want to breach them at all. It is built on four things:
- Example: leadership visibly bound by the same rules, without exception.
- Clarity: rules written in plain language that employees know before they are asked about them.
- Safety: whoever reports is thanked and protected, and whoever objects is not punished for objecting.
- Consistency: sanctions applied to everyone by the same standard, however senior.
Chapter 1 summary
- Monitoring verifies with samples and evidence, not with questions and answers.
- A control is tested for design and effectiveness together.
- Indicators are read as a set: zero reports is not necessarily success.
- A good report is short and asks for a clear decision.
- Culture is built on example, clarity, safety and consistency.
5 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. A control is precisely written but switched off in the system. What is the failure?
The design is sound but it does not actually operate — an effectiveness failure, revealed by testing rather than by reading.
2. Zero reports came in all year. How do you read that?
The number is read alongside the level of awareness and trust; an absence of reports can be a negative signal, not a positive one.
3. Which element has the strongest effect in building a culture of compliance?
Consistency and example make the culture; selective sanction destroys trust in the whole programme.