{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-140","name":"Compliance","level":1,"parent_id":null,"l1_id":"BC-140","industry":"cross-industry","macro_id":"MC-10","path":["Compliance"],"description":"Know every law, regulation and code of conduct the enterprise is bound by, make sure people understand and follow them, detect when they do not, and deal with regulators from a position of having the records ready.","aliases":["Regulatory Compliance","Compliance & Ethics","Compliance Program","Conduct & Compliance"],"in_scope":["The inventory of regulatory obligations and the changes to it","The compliance program, its policies, training and attestations","The code of conduct, conflicts of interest, speak-up channels and investigations","Compliance monitoring, testing, regulatory reporting and examinations"],"out_of_scope":["The enterprise risk framework and appetite the program operates within (see BC-130)","Independent assurance over the compliance program itself (see BC-160)","Health, safety and environmental permits and inspections (see BC-810 and BC-820)"],"csdm_note":"Lands as a Business Capability record realized by obligation registers, case and hotline systems and attestation tools; its obligations map to the Business Services and Business Applications that must meet them.","status":"active","successor_id":null,"child_ids":["BC-140.10","BC-140.20","BC-140.30","BC-140.40","BC-140.50"]},"crosswalk":{"realized_by":[{"product_id":"PR-100","product":"ServiceNow","pc_id":"PC-100.80","pc":"Governance, Risk and Compliance","maturity":"partial","via":"BC-140.40"},{"product_id":"PR-110","product":"SAP S/4HANA","pc_id":"PC-110.90","pc":"Governance, Risk and Compliance","maturity":"partial","via":"BC-140.40"},{"product_id":"PR-150","product":"Oracle Fusion Cloud Applications","pc_id":"PC-150.70","pc":"Risk Management and Compliance","maturity":"partial","via":"BC-140.40"},{"product_id":"PR-190","product":"Okta","pc_id":"PC-190.50","pc":"Identity Governance","maturity":"partial","via":"BC-140.40"}],"used_in":[],"patterns":[],"stacks":[],"books":[]},"ancestors":[],"children":[{"id":"BC-140.10","name":"Regulatory Obligations","level":2,"child_count":4},{"id":"BC-140.20","name":"Compliance Program & Training","level":2,"child_count":4},{"id":"BC-140.30","name":"Ethics & Conduct","level":2,"child_count":4},{"id":"BC-140.40","name":"Compliance Monitoring & Testing","level":2,"child_count":3},{"id":"BC-140.50","name":"Regulatory Engagement & Reporting","level":2,"child_count":4}]}