Regulatory Compliance

Regulatory compliance means meeting what a regulator requires of you. A good deal of what gets managed under the compliance heading is something else.

Three categories usually sit in the same register. Regulatory obligations, which carry enforcement and penalties. Contractual obligations owed to a customer or a funder, which carry commercial consequences. And internal rules the organisation set for itself, which carry none of either.

All three may well be worth having. Treating them as equivalent is what produces a register that nobody can prioritise, because every line in it is labelled must.

Tagging each obligation with its source changes how it gets triaged. A regulatory breach and an internal policy exception are not the same kind of event at all, and they should not escalate the same way.

ASIC publishes governance guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s GRC system and risk management system.