Regulatory compliance: program, policy, reporting and change management

Answer first. Regulatory compliance is meeting every obligation that law and regulators impose, and being able to show it. A compliance program identifies those obligations, assesses the risk of breaching them, sets policies and controls, tests them, reports to the board and adjusts when rules change. ISO 37301:2021 sets the structure; the US Sentencing Guidelines and the DOJ define "effective".

What regulatory compliance means

ISO 37301:2021 gives the cleanest definitions in print. Compliance obligations are the "requirements that an organization mandatorily has to comply with as well as those that an organization voluntarily chooses to comply with" (clause 3.25). Compliance is meeting all of those obligations (3.26); noncompliance is failing to meet one (3.27); compliance risk is the likelihood and consequences of noncompliance (3.24). The standard's introduction adds the point most definitions miss: compliance is both an ongoing process and an outcome, and it is sustained by embedding it in the organization's culture rather than in a document.

"Regulatory" narrows the definition to the mandatory obligations that come from a statute or a regulator: data protection, financial services rules, health and safety, anti-bribery, sanctions, sector codes with the force of law. The voluntary half, standards such as ISO/IEC 27001 or a customer's security schedule, is still compliance and usually sits in the same program, but the consequences and the reporting line for a breach differ.

Two consequences follow. Compliance is a property of the organization's obligations, not of its policies; a complete policy library proves nothing if the obligations it was written against were never listed. And because obligations change, compliance has to be re-established continuously: ISO 37301 clause 4.5 requires processes to identify new and changed obligations and evaluate their impact, which is what regulatory change management exists to do.

For the shorter definitions, see What is regulatory compliance management? and What is compliance?.

Regulatory compliance, corporate compliance, compliance risk and GRC

The terms are used interchangeably in vendor copy and mean different things to a regulator.

Regulatory compliance, corporate compliance, compliance risk and GRC

Term	What it covers	Where the requirement comes from	The record that proves it
Regulatory compliance	Meeting obligations imposed by law and regulators	Statute, regulation, regulator rulebooks and guidance	Obligation register with mapped controls and evidence
Corporate (ethics and) compliance	Preventing and detecting criminal conduct and promoting an ethical culture across the organization	US Sentencing Guidelines §8B2.1; DOJ Evaluation of Corporate Compliance Programs; ISO 37301	The seven-element program and its artifacts (below)
Compliance risk management	Assessing the likelihood and consequences of noncompliance and prioritizing effort accordingly	ISO 37301 clause 4.6; §8B2.1(c)	Compliance risk assessment, refreshed periodically and on material change
Compliance management system (CMS)	The management-system wrapper: context, leadership, planning, support, operation, evaluation, improvement	ISO 37301 clauses 4 to 10	The documented system, its audit results and management reviews
GRC	The integrated capabilities for governance, risk and compliance	OCEG GRC Capability Model (Red Book), version 3.5	The connected data model across all three

OCEG defines GRC as the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity (Principled Performance), organized into four components: Learn, Align, Perform and Review. Compliance is the "act with integrity" leg, and the model's point is that it cannot be run apart from the other two. What is GRC? covers the wider term; How Risk, Compliance, and Audit Should Work Together in a Connected GRC Program covers the boundaries between the functions.

Three yardsticks: ISO 37301, the Sentencing Guidelines and the DOJ evaluation

Three public documents define what a compliance program should contain. They were written for different audiences and reinforce each other.

ISO 37301:2021, Compliance management systems — Requirements with guidance for use. Published April 2021 by ISO/TC 309, it replaced the guidance-only ISO 19600:2014 with requirements an organization can be certified against, in ISO's harmonized management-system structure. Clause 4 covers context, compliance obligations (4.5) and compliance risk assessment (4.6); clause 5 leadership, compliance governance (5.1.3), the compliance policy (5.2) and roles (5.3); clauses 6 to 8 planning, support, controls and procedures (8.2), raising concerns (8.3) and investigations (8.4); clause 9 monitoring, compliance reporting (9.1.4), record-keeping, internal audit and management review; clause 10 nonconformity and corrective action.

United States Sentencing Guidelines §8B2.1, Effective Compliance and Ethics Program. Part of Chapter Eight of the Guidelines Manual (current edition effective November 1, 2024). It sets two purposes, to exercise due diligence to prevent and detect criminal conduct and to promote a culture of ethical conduct, the seven minimum requirements in subsection (b), and a periodic risk assessment in subsection (c). An effective program reduces an organization's culpability score at sentencing, which is why the seven elements became the template for US corporate compliance.

US Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024). Not a rule but the question set prosecutors use when deciding whether to charge a company, what penalty to seek and whether to impose a monitor. It organizes its topics under three fundamental questions from the Justice Manual (JM 9-28.800). Because it tells prosecutors to probe whether a program is a "paper program", its questions are the best public test of whether a program works.

Sector regulators add a layer. The UK Financial Conduct Authority's SYSC 6 is the example below; the EU's GDPR is the worked obligation.

The seven elements of an effective compliance program, and the artifact that proves each

Subsection (b) of §8B2.1 says due diligence and an ethical culture "minimally require" seven things. Each is paraphrased with the record an auditor, regulator or prosecutor would ask to see, and the ISO 37301 clause that asks for the same thing.

The seven elements of an effective compliance program, and the artifact that proves each

#	§8B2.1(b) requirement (paraphrased)	Artifact that evidences it	ISO 37301 counterpart
1	Standards and procedures to prevent and detect criminal conduct (b)(1)	Code of conduct; policy library with version, approval and effective dates; procedures; control library mapped to policies	5.2 Compliance policy; 8.2 Establishing controls and procedures
2	Board oversight; a named high-level owner; a named person with day-to-day responsibility who reports periodically upward and has adequate resources, authority and direct access to the board (b)(2)(A) to (C)	Board or committee terms of reference and minutes; compliance charter; appointment record of the chief compliance officer; reporting calendar; budget and headcount records	5.1.1 Governing body and top management; 5.1.3 Compliance governance; 5.3.2 Compliance function
3	Reasonable efforts to keep out of substantial-authority roles anyone the organization knew or should have known engaged in illegal or inconsistent conduct (b)(3)	Pre-hire and promotion screening records for senior roles; due-diligence files	7.2.2 Employment process
4	Periodic, practical communication of standards through training and other means to the board, senior and substantial-authority personnel, employees and, as appropriate, agents (b)(4)	Role-based training records with completion rates; policy attestation logs; communication log	7.2.3 Training; 7.3 Awareness; 7.4 Communication
5	Reasonable steps to ensure the program is followed, including monitoring and auditing; periodic evaluation of effectiveness; a publicized reporting system allowing anonymity or confidentiality without fear of retaliation (b)(5)	Monitoring program and results; control test results; internal audit reports; annual effectiveness review; speak-up case log with time to close	9.1 Monitoring, measurement, analysis and evaluation; 9.2 Internal audit; 8.3 Raising concerns
6	Consistent promotion and enforcement through incentives to comply and discipline for misconduct or for failing to prevent or detect it (b)(6)	Performance objectives that include compliance; disciplinary case log with a consistency review; compensation decisions linked to conduct	5.1.2 Compliance culture; 5.3.3 Management
7	After detection, reasonable steps to respond, prevent recurrence and modify the program (b)(7)	Investigation files; root-cause analyses; issue and remediation log; record of program changes and the incident that prompted each	8.4 Investigation processes; 10.2 Nonconformity and corrective action
(c)	Periodic assessment of the risk of criminal conduct, used to design, implement or modify each element	Compliance risk assessment with date, method, owner and the changes it produced	4.6 Compliance risk assessment

Two points from the commentary. Application note 2(C) says formality and scope depend on size: a large organization "generally shall devote more formal operations and greater resources", a small one may comply "with less formality and fewer resources" while showing the same commitment. Note 2(D) says recurrence of similar misconduct creates doubt that the organization took reasonable steps at all. The artifact column matters because of the first point: a small firm can satisfy element 4 with staff-meeting minutes, but it still needs the minutes.

The DOJ's three questions, and what the September 2024 update added

The Evaluation of Corporate Compliance Programs asks:

1. Is the corporation's compliance program well designed?
2. Is the program being applied earnestly and in good faith; in other words, is it adequately resourced and empowered to function effectively?
3. Does the program work in practice?

Under the first it examines risk assessment, policies and procedures, training and communications, confidential reporting and investigation, third parties, and mergers and acquisitions; under the second, management commitment, autonomy and resources, and compensation and consequence management; under the third, continuous improvement and testing, investigation of misconduct, and remediation of its root causes. The document says the topics form neither a checklist nor a formula.

Three parts of the 2024 text deserve attention when designing a program today.

Autonomy and resources (section II.B). Prosecutors test whether those responsible for compliance have sufficient qualifications, seniority and stature; sufficient staff to audit, document and analyze; and sufficient autonomy from management, "such as direct access to the board of directors or the board's audit committee". The questions ask where the function sits and reports, whether the chief compliance officer has other roles, how its stature and pay compare with other functions, whether deals have been stopped or modified on compliance grounds, and how often it meets directors without management present.

Data resources and access (section II.B). The update asks whether compliance personnel have direct or indirect access to the data they need to monitor and test policies, controls and transactions; what impediments exist; whether the company is "appropriately leveraging data analytics tools" to create efficiencies and measure effectiveness; how it manages data quality; and how it measures the accuracy, precision or recall of any analytics models. A related question asks whether the technology used to find market opportunities outstrips the technology used to detect risk.

Emerging risks and new technology (section I.A). The risk-assessment section asks whether the company has a process for identifying emerging risks, including from new technologies such as artificial intelligence; whether AI risk is integrated into enterprise risk management; what controls keep AI used in the business or the compliance program trustworthy and within its intended purpose; and how quickly the company can detect and correct AI decisions that conflict with its values. It also asks whether the company tracks lessons learned from its own issues and from peers. For the board's side, see How Boards Should Oversee AI Risk Without Becoming AI Operators.

Identifying obligations: the obligation register

ISO 37301 clause 4.5 requires the organization to systematically identify its compliance obligations arising from its activities, products and services, assess their impact on operations, maintain documented information about them, and run processes to catch new and changed obligations. The register is that documented information, and everything else in the program hangs off it.

An obligation is a single requirement at the level a control can satisfy: "maintain a record of processing activities containing the items in Article 30(1)", not "GDPR". A statute of 99 articles may produce forty obligations for one organization and five for another, which is why applicability is a field, not an assumption. Each row needs, at minimum: a stable identifier; the source (instrument, article or rule number, publisher); jurisdiction and the entities it applies to; the applicability decision and its rationale; the effective date and any transition period; the accountable owner; links to the policies, controls and evidence that satisfy it; the compliance risk rating; and its status through the change process.

This site already has a field-level article on the record and the mapping method: How to Connect Regulatory Obligations to Policies, Controls, and Evidence. Use it as the schema. For a privacy-specific mapping, see How to Map Privacy Obligations to Policies, Controls, and Evidence.

Most organizations seed the register from a framework library rather than from primary texts. SmartSuite's framework library holds more than 300 pages, each with publisher, version, scope, official links and a requirement summary; the EU GDPR, SOX, HIPAA Omnibus Rule, PCI DSS v4.0.1, EU DORA, EU NIS2 and GLBA Safeguards Rule pages are typical starting points. The library gives the candidate list; the applicability decision is yours, and the primary text remains the source of record.

Compliance risk assessment

ISO 37301 clause 4.6 asks the organization to identify compliance risks by relating its obligations to its activities, products, services and operations, including outsourced and third-party processes; to assess them periodically and whenever circumstances change materially; and to keep documented information on the assessment and the actions taken. §8B2.1(c) says the same in criminal-law terms: assess the risk of criminal conduct periodically and use the result to design, implement or modify each of the seven elements. The DOJ's first topic under "well designed" is the same assessment, and it asks whether the review is a "snapshot" or draws on continuous operational data, and whether it has led to changes in policies, procedures and controls.

In practice the assessment rates each obligation, or group of obligations, on the likelihood of a breach given current controls and the consequence if one occurs: penalty, license conditions, customer harm, reputational damage and remediation cost. The output is a priority order that decides where monitoring, training and control investment go. The scales and matrix are the same as for any other risk (see What is a risk register?); the difference is that the risk is attached to an obligation, and the control that mitigates it is the one the obligation maps to.

Three inputs make the assessment defensible: the obligation register (so nothing is assessed that was never identified), the incident and speak-up history (the DOJ's "lessons learned"), and the last monitoring cycle's results (so a failed control test raises the rating without anyone re-keying it).

A worked obligation: GDPR Articles 5 and 30

Regulation (EU) 2016/679, the General Data Protection Regulation, shows how an obligation becomes a control and its evidence.

Article 5(1) sets six principles for processing personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Article 5(2) adds accountability: the controller "shall be responsible for, and be able to demonstrate compliance with, paragraph 1". That sentence is the general obligation to hold evidence. It does not say what evidence.

Article 30 does, for one part of it. Each controller must maintain a record of processing activities containing seven items: the controller's name and contact details (and those of any joint controller, representative and data protection officer); the purposes of processing; the categories of data subjects and of personal data; the categories of recipients, including those in third countries; transfers to third countries with the safeguards documented where Article 49(1) applies; where possible, the envisaged erasure time limits; and where possible, a general description of the security measures under Article 32(1). Processors keep a parallel record (30(2)). The record must be in writing, including electronic form, and produced to the supervisory authority on request (30(3) and (4)). Organizations with fewer than 250 employees are exempt unless the processing is likely to create a risk to individuals, is not occasional, or involves special-category or criminal-conviction data (30(5)).

Traced through the chain:

A worked obligation: GDPR Articles 5 and 30

Layer	Record	Example for Article 30
Obligation	Register row	"Maintain a written record of processing activities with the seven Article 30(1) items; produce on request." Source: Regulation (EU) 2016/679, Art. 30. Applicability: yes; the 250-person exemption does not apply because processing is not occasional. Owner: DPO
Policy	Data protection policy, records section	Every processing activity is recorded before it starts and reviewed at least annually
Procedure	New-processing intake procedure	The form that creates or updates a register entry when a system, vendor or purpose is added
Control	"RoPA maintained and reviewed"	Owner: privacy lead. Frequency: entry on intake, full review annually, DPO sign-off. Test: sample ten systems added in the period and confirm each has an entry with all seven items
Evidence	Dated export of the register; review log; sign-off record; intake forms for the sample	Retained for the period the evidence policy sets; linked to the control test result
Risk	Compliance risk row	Rating driven by data volume, special-category data and the last test result

The same method applies to Article 5(1)(e), storage limitation: the obligation becomes a retention schedule (policy), a deletion job and exception process (control) and deletion logs (evidence). Data Retention Controls works that example through.

Policies: the compliance policy and the policy library

ISO 37301 clause 5.2 requires a compliance policy, set by the governing body and top management, compatible with the organization's strategic direction. It is the top-level document: it states the commitment, the scope, the roles and the consequences, and it authorizes everything below it. The policy library beneath it translates each obligation, or group of obligations, into a rule the organization has chosen to follow.

Three properties make a policy library usable as compliance evidence rather than shelf-ware:

1. Each policy links upward to the obligations it satisfies and downward to the controls that implement it. A policy with no obligation is a preference; a policy with no control is a wish. Policy vs Procedure vs Control sets out the three layers.
2. Each policy has a lifecycle with dates. Draft, review, approve, publish, attest, review, retire, with version, approver, effective date and next review date on the record. ISO 37301 clause 7.5 asks for control of documented information; the DOJ asks how often policies are reviewed and whether they fit particular business units.
3. Attestation is recorded per person and per version. Element 4 of §8B2.1 is about communication; the attestation log is the artifact.

Policy Management That Connects the Written Rule to the Actual Control covers the operating model; What is policy management in GRC? covers the term.

Obligation-to-control-to-evidence traceability

Traceability lets you start at any obligation and reach the evidence that it is being met, or start at any piece of evidence and reach the obligation it serves, without a human explaining the path. It is what the DOJ means by a program that works in practice, what ISO 37301 clauses 7.5 (documented information) and 9.1.5 (record-keeping) require, and what a supervisor asks for in an information request.

The chain has five record types and four relationships:

• Obligation → Policy. Many-to-many. One policy often satisfies obligations from several instruments (an access-control policy serves GDPR Article 32, PCI DSS Requirement 7 and SOX IT general controls); one obligation may need clauses in several policies.
• Policy → Control. One-to-many. A control is a specific activity with an owner, a frequency and a test; a policy usually needs several.
• Control → Test. One-to-many over time. Each test has a date, a tester, a sample, a method and a result. A control with no result in the last cycle is untested, whatever the policy says.
• Test → Evidence. One-to-many. Evidence is the artifact behind the result: the export, the screenshot, the ticket, the signed form. It has a date, a source system and a retention period, and it links to the test, not to a folder named after the auditor.

Two design rules follow. Mapping runs through the control, not around it: an obligation "evidenced" by a policy document has skipped the layer where work happens. And controls are shared: one control, tested once, satisfies every obligation mapped to it, the model in How to Design a Test-Once, Comply-Many Control Framework and the main reason to hold obligations from many instruments in one register.

The evidence standard is in What Good GRC Evidence Looks Like for Regulators, Auditors, and Customers; the data model in The Connected GRC Operating Model.

Regulatory change management, step by step

ISO 37301 clause 4.5 requires two processes: identify new and changed obligations, and evaluate the impact of the changes and implement whatever the management of the obligations now needs. The DOJ asks whether risk assessments and policies are "periodically updated" and whether the updates account for changed risk. The process below satisfies both. Each stage has an owner, an output record and the evidence that the stage happened.

Regulatory change management, step by step

Stage	What happens	Owner	Output record	Evidence it happened
1. Horizon scanning	Monitor regulators, legislatures, standards bodies and industry sources for proposals, consultations, final rules, guidance and enforcement actions in the organization's jurisdictions	Regulatory affairs or compliance	Change record: source, instrument, publication and effective dates, stage (proposal, consultation, final), summary	Scan log with sources and dates; change records created
2. Applicability	Decide whether the change applies, to which entities, products and jurisdictions, and whether it is material	Compliance with legal; business owner consulted	Applicability decision and rationale on the change record; new or amended obligation rows	Signed decision with date; obligation register diff
3. Impact assessment	Identify affected policies, controls, processes, systems, contracts, third parties and training; estimate effort and deadline; rate the compliance risk of not acting	Compliance with affected business and control owners	Impact assessment linked to the change and to every affected record	Assessment with reviewer and date; linked policy and control list
4. Control mapping	Map each new or changed obligation to existing controls or specify new ones; list gaps	Compliance and control owners	Updated obligation-to-control links; gap list	Mapping change history; gap issues opened
5. Implementation	Update policies, redesign or add controls, change systems and contracts, train staff; track each action to a due date before the effective date	Business and control owners; compliance oversees	Action plan with owners and due dates; policy versions; control changes	Closed actions with completion evidence; new policy version and attestation; control test scheduled
6. Evidence and closure	Test the changed controls, collect evidence, confirm the obligation is met, close the change and report	Compliance; internal audit for high-risk changes	Test results; evidence links; closure record; committee report entry	Test results with samples; closure sign-off; report extract

Three points on running it. Time from publication to effective date is the constraint, so scanning has to pick up proposals and consultations, not only final rules, and the action plan is back-scheduled from the effective date. Applicability decisions are evidence: a decision that a change does not apply matters as much as one that it does, and a regulator may ask for it. And one change can touch many obligations, so model the change as its own record linked to obligations, not as a field on the obligation.

For the impact assessment method, see Regulatory Change Impact Assessments; for the end-to-end workflow, Regulatory Change Management: Turning Change into Action; for the term, What is regulatory change management?.

Monitoring and the compliance function: the FCA SYSC 6 example

Sector regulators turn the general requirements into rules. Chapter 6 of the UK Financial Conduct Authority's Senior Management Arrangements, Systems and Controls sourcebook (SYSC) is a compact example of what a regulator expects of the function itself.

• SYSC 6.1.1R requires a firm to establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm, its managers, employees and appointed representatives with its obligations under the regulatory system, and for countering the risk that the firm is used to further financial crime.
• SYSC 6.1.2R and 6.1.2-AR require those policies and procedures to be designed to detect any risk of failure to comply, taking into account the nature, scale and complexity of the business, with measures to minimize those risks.
• SYSC 6.1.3R and 6.1.3-AR require a permanent, independent and effective compliance function that monitors and regularly assesses the adequacy and effectiveness of the measures in place and the actions taken to address deficiencies, and advises and assists the people who carry out regulated activities. For common platform firms, 6.1.3-AR adds an annual report to the management body on the control environment, the risks identified and complaints handling, and 6.1.3-BR requires a risk-based monitoring program built on a compliance risk assessment.
• SYSC 6.1.3-CR and 6.1.4R set the conditions for independence: authority, resources, expertise and access to all relevant information; an appointed compliance officer responsible for the function and its reporting; staff not involved in the activities they monitor; remuneration that does not compromise objectivity; and, under 6.1.3-CR, ad hoc reporting direct to the management body when the function detects a significant risk of failure to comply.

Set beside §8B2.1(b)(2)(C) and the DOJ's autonomy questions, the pattern is the same in both jurisdictions: a named officer, independence from the business monitored, resources and data access, a risk-based monitoring program, and a reporting line to the top. Firms outside the rules' direct scope are told to treat SYSC 6.1.3R as guidance; check the rule text and in-force version for your firm type.

Monitoring is the operational half: for each obligation or control, what is checked, how, how often, by whom and against what sample, with results feeding the risk assessment and the board report. The difference between a monitoring campaign and continuous assurance is covered in Compliance Assessments and Testing and Continuous Compliance Is Not the Same as Continuous Control Monitoring.

Reporting to the board

Four sources set the duty to report. §8B2.1(b)(2)(A) requires the governing authority to be knowledgeable about the program and exercise reasonable oversight, and (b)(2)(C) requires the person with day-to-day responsibility to report periodically to high-level personnel and, as appropriate, the governing authority. ISO 37301 clause 5.1.1 requires the governing body to be informed in a timely manner about compliance matters, including noncompliance; clause 9.1.4 is titled compliance reporting. SYSC 6.1.3-AR(3) requires an annual report plus ad hoc escalation. The DOJ asks how often the function meets directors and whether management is present.

What the report contains follows from the program's records. A board pack produced from the register rather than assembled by hand looks like this:

Reporting to the board

Section	Content	Record it comes from
Obligation coverage	Obligations in scope; share with a named owner, a mapped control and current evidence; changes since last report	Obligation register
Regulatory change	Changes open by stage; changes past effective date without closure; effective dates in the next two quarters	Regulatory change records
Compliance risk	Top risks by rating; movements; risks outside appetite and the decision taken	Compliance risk assessment
Monitoring and testing	Tests completed against plan; failures by severity; repeat failures	Control test results
Issues and remediation	Open issues by severity and age; overdue actions; recurring root causes	Issue log
Speak-up and investigations	Reports by channel; substantiation rate; time to close; retaliation complaints	Case management log
Training and attestation	Completion by population against target; overdue attestations	Training and attestation logs
Regulatory interactions	Inquiries, examinations, findings and undertakings open; deadlines	Regulatory inquiry records
Resources and independence	Headcount and budget against plan; access to data; any resource request declined and why	Compliance function records
Decisions required	Acceptances, policy approvals, resourcing	Prepared by the compliance officer

The last two rows are the ones boards least often see and the DOJ most often asks about. A record of declined resource requests, with reasons, is direct evidence on question two.

Keep the narrative short and the movement visible: what changed since last time, why, and what the board is asked to decide. How to Make GRC Reporting Useful to the Board and the Board GRC Reporting Checklist cover format; Regulatory Inquiry Readiness covers what happens when the regulator, rather than the board, asks.

Common mistakes

1. Starting from policies instead of obligations. A policy library with no obligation register cannot show what it was written to satisfy or what it missed. ISO 37301 clause 4.5 puts the register first.
2. Treating the framework as the obligation. "GDPR" is not an obligation; Article 30(1) is. Decompose to the level a control can satisfy or nothing maps.
3. Evidence by assertion. A policy document offered as proof that a control operates. Skipping the control and test layers is what the DOJ calls a paper program.
4. Untested controls counted as coverage. Dashboards that count mapped controls rather than controls with a passing test in the current cycle overstate the position.
5. Change management that starts at the final rule. By then the implementation period is half gone. Scan proposals and consultations.
6. No record of "does not apply". Applicability decisions are evidence; a regulator can ask why a rule was not implemented.
7. A compliance function without data access. The 2024 DOJ update asks directly about impediments to data. A function that requests extracts by email cannot monitor.
8. One spreadsheet per regulation. Each duplicates controls and evidence. From Spreadsheet GRC to Connected GRC is the migration route.
9. Program changes not linked to the incident that caused them. §8B2.1(b)(7) and the DOJ's "lessons learned" question both ask for the link.

How SmartSuite does this

SmartSuite's Compliance Management suite holds the chain in this guide as related records: framework alignment (mapping controls to ISO, SOC 2, GDPR, SOX, HIPAA, FFIEC and CRI from a central framework library), control testing with standard test plans and recurring assessments, evidence linked to control records, and policy governance with version control, review cycles and attestation logs. Issues, root-cause analysis and remediation sit on the same records, and dashboards read from them.

Regulatory Change Management runs the six-stage process above. Its lifecycle is monitor regulatory changes, assess impact, define obligations, implement changes, and validate and report: it tracks changes from multiple sources, assesses impact on policies, controls, processes and operations, defines obligations with owners and timelines, links changes to policies and controls, manages implementation tasks and approvals, triggers alerts, and connects changes to risks, issues and audits in the other products.

Around it, Control Framework & Regulatory Libraries holds the central control library, multi-framework mapping, gap analysis and test-once, comply-many reuse of tests and evidence; Policy Management runs the policy lifecycle, distribution and acknowledgment, policy-to-control mapping and exceptions; Compliance Assessments & Testing runs the monitoring program; Issues Management holds remediation; and Regulatory Inquiries handles requests from supervisors. For the roles that own this work, see Connected GRC for the Chief Compliance Officer and Connected GRC for Regulatory Affairs.

FAQs

What is the difference between a compliance program and a compliance management system? They describe the same thing from two angles. "Compliance program" is the US legal term, from §8B2.1 of the Sentencing Guidelines and the DOJ's evaluation, for the standards, oversight, training, monitoring, incentives and response that prevent and detect misconduct. "Compliance management system" is the ISO 37301 term for the same elements arranged in the harmonized management-system structure an organization can certify against. The artifacts are the same.

Is ISO 37301 certification required? No law requires it. ISO 37301:2021 is voluntary, and its introduction notes that courts in some jurisdictions consider an organization's compliance management system when setting penalties, the same logic as §8B2.1's culpability-score reduction. Certification is useful when customers, regulators or a court will ask for independent evidence that a system exists; the requirements are worth following whether or not you certify.

How often should a compliance risk assessment be refreshed? ISO 37301 clause 4.6 says periodically and whenever there are material changes in circumstances or context; §8B2.1(c) says periodically. Neither sets a number. Annual is the common baseline, with triggers for regulatory change, a new product or market, an acquisition, an incident or a failed control test. The DOJ asks whether the review draws on continuous operational data rather than a snapshot, so the triggers matter more than the calendar.

What does "regulatory compliance" mean in plain terms? Meeting every requirement that a law or regulator imposes on your organization, and being able to show it. ISO 37301 defines compliance as meeting all the organization's compliance obligations, and defines those obligations as the requirements it must comply with plus those it chooses to. "Regulatory" restricts the term to the mandatory half: statutes, regulations and regulator rulebooks, as opposed to voluntary standards and contracts.

What should a regulatory change management process produce? For each change: a change record with source, publication and effective dates; an applicability decision with rationale; an impact assessment listing affected obligations, policies, controls, systems and third parties; updated obligation-to-control mappings; an action plan closed before the effective date; and test results and evidence showing the changed controls operate. ISO 37301 clause 4.5 requires the first and last; the DOJ asks whether updates reached policies and controls.

Sources

• ISO 37301:2021, Compliance management systems — Requirements with guidance for use, first edition, International Organization for Standardization, April 2021, prepared by ISO/TC 309. Catalog: https://www.iso.org/standard/75080.html. Preview with foreword, introduction, clauses 1 to 5.1.3 and the table of contents: https://cdn.standards.iteh.ai/samples/75080/98db41625e0445a193a12f005dd5f30b/ISO-37301-2021.pdf. Clause titles for 5.2 to 10.2 are taken from the table of contents in that preview.
• United States Sentencing Commission, Guidelines Manual, effective November 1, 2024, Chapter Eight, §8B2.1 Effective Compliance and Ethics Program and Commentary. https://www.ussc.gov/guidelines/guidelines-archive/2024-guidelines-manual (Chapter Eight PDF: https://www.ussc.gov/sites/default/files/pdf/guidelines-manual/2024/CHAPTER_8.pdf)
• US Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (Updated September 2024). Introduction; I.A Risk Assessment; II.B Autonomy and Resources; III.A Continuous Improvement, Periodic Testing, and Review. https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl
• OCEG, What is GRC? and the GRC Capability Model (Red Book), version 3.5. https://www.oceg.org/ideas/what-is-grc/
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), Articles 5 and 30. Official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj. Article pages used for wording: https://gdpr-info.eu/art-5-gdpr/ and https://gdpr-info.eu/art-30-gdpr/. SmartSuite framework page: https://www.smartsuite.com/frameworks/eu-gdpr-general-data-protection-regulation
• Financial Conduct Authority, FCA Handbook, SYSC 6.1 Compliance, rules 6.1.1R to 6.1.4R including 6.1.2-AR, 6.1.3-AR, 6.1.3-BR and 6.1.3-CR, as published on 27 September 2026 with in-force dates. https://www.handbook.fca.org.uk/handbook/SYSC/6/1.html
• US Department of Justice, Justice Manual 9-28.800, Corporate Compliance Programs, as cited in the Evaluation above.

Related: GRC Foundation · What is compliance management? · What is compliance monitoring? · What is continuous compliance? · Framework library