02 — Capability · BC-140
Compliance
Know every law, regulation and code of conduct the enterprise is bound by, make sure people understand and follow them, detect when they do not, and deal with regulators from a position of having the records ready.
- Regulatory Compliance
- Compliance & Ethics
- Compliance Program
- Conduct & Compliance
In scope
- The inventory of regulatory obligations and the changes to it
- The compliance program, its policies, training and attestations
- The code of conduct, conflicts of interest, speak-up channels and investigations
- Compliance monitoring, testing, regulatory reporting and examinations
Out of scope
- The enterprise risk framework and appetite the program operates within (see BC-130)
- Independent assurance over the compliance program itself (see BC-160)
- Health, safety and environmental permits and inspections (see BC-810 and BC-820)
Realized by · 4
- ServiceNow · Governance, Risk and Compliancepartial via BC-140.40
- SAP S/4HANA · Governance, Risk and Compliancepartial via BC-140.40
- Oracle Fusion Cloud Applications · Risk Management and Compliancepartial via BC-140.40
- Okta · Identity Governancepartial via BC-140.40
Used in · 0
- Not yet placed on a value stream.
Build it · 0
- Nothing in the library points here yet.
Decomposes into · 5
- BC-140.10Regulatory ObligationsMaintain the complete list of what the enterprise must comply with, in every jurisdiction it operates in, and update it before the regulator does.
- BC-140.20Compliance Program & TrainingTurn obligations into policies, procedures and training people actually complete, with attestations that show they did, so compliance is a practice rather than a document.
- BC-140.30Ethics & ConductSet the standard of behavior the enterprise expects, give people a safe way to report when it is breached, and investigate fairly when they do.
- BC-140.40Compliance Monitoring & TestingCheck on a schedule whether the enterprise is actually complying, find the gaps before a regulator does, and track them to closure.
- BC-140.50Regulatory Engagement & ReportingDeliver the reports regulators require, host their examinations without scrambling, and manage licenses and permits so the enterprise stays allowed to operate.