Compliance

1. Brief service summary

Organise how identified obligations are addressed in your organisation’s operations. The engagement connects compliance matters with the responsibilities, procedures and controls required, within an explicitly defined scope.

2. Your needs

Requirements affecting your activity are handled by several people, without a shared overview of their follow-up. Some actions are documented, but the person responsible, their status or the evidence expected remains difficult to identify.

You wish to structure a proportionate framework, without equating the existence of a procedure with the actual compliance of practices.

3. Objectives of the engagement

The engagement aims to organise obligations that have already been identified and assessed, clarify responsibilities and prepare follow-up actions. It helps distinguish confirmed requirements from questions still subject to specialist validation.

The objective is to make the framework usable and facilitate the reporting of deviations to those with the appropriate responsibilities.

4. Indicative scope

The work may cover an agreed domain, function or set of activities. It may bring together requirements mapping, procedures, controls, evidence and processes for handling anomalies.

Legal identification and interpretation of obligations depend on confirmed expertise. The framework may incorporate internal policies, clearly distinguishing them from external requirements. Proposed controls remain proportionate to the issues and resources involved.

5. Possible delivery arrangements

Document review, interviews and workshops help build the monitoring framework. A limited review of practices or files may be included to assess the use of existing arrangements, without constituting exhaustive assurance.

6. Possible deliverables

Deliverables may include an obligations-and-responsibilities matrix, a compliance plan, control templates and a process for tracking deviations and evidence.

7. Conditions and limitations

The engagement does not certify the organisation’s compliance and does not guarantee the absence of breaches. A statutory or regulatory function, mandate or attestation is never presumed included. Overall risk governance falls notably under service 11.09; decisions and responsibilities remain with the competent governing bodies.