Compliance System

A compliance system is the framework an organisation uses to meet its legal obligations on purpose rather than by luck. It joins up policies, training, records, reporting and review so obligations are assigned to real people, the work leaves evidence behind, and problems surface early enough to fix.

Australia has deep roots in this area. AS 3806, the Australian Standard for compliance programs, was the model Standards Australia put to ISO, and it grew into AS ISO 37301:2021, the international standard for compliance management systems. That standard rests on proportionality, good governance, transparency and sustainability, which is a fair test for any system you are designing. A control that cannot be explained to the people it binds is unlikely to hold.

In a small or medium Australian business, a workable system usually has five moving parts:

• a register of the obligations that genuinely apply, from work health and safety through to competition and consumer law
• current policies and procedures, written in language staff can actually follow
• training matched to role and risk, rather than the same module issued to everyone
• records showing who did what and when
• a review cycle, because obligations shift and a system left alone goes stale quietly

Scale matters, and the regulator says so directly. The ACCC’s guidance on implementing a business compliance program states that what a program should contain depends on the size, operations and risk profile of the business, and its templates are scaled to match. A two-person firm and a 500-person one need different systems, not different volumes of the same paperwork. Obligations also differ across states and territories and change over time, so treat this as general information rather than legal advice.

Posts tagged here look at how Australian organisations build and run these systems, and where they come unstuck. To see the components in one place, browse the Sentrient workplace compliance system and the wider workplace compliance solution.