How mature is your compliance function? We have decided to share some notes on a recently completed compliance maturity assessment which we conducted.
1. Some organisations confuse a compliance review with a compliance maturity assessment. Although these overlap to a degree, a compliance maturity assessment results in a compliance maturity rating. This rating together with recommendations should give the Board a clear picture on what interventions are required to improve the compliance function (most of the time, interventions will be required).
2. As a compliance professional, you will need to manage expectations on what a compliance maturity assessment is, and what it is not. Sometimes management will expect that a compliance maturity assessment should include a detailed review on all pieces of legislation that an organization is bound by. What management therefore has in-mind is a compliance review and not a compliance maturity assessment.
3. Being able to produce a compliance policy, compliance strategy, compliance risk appetite statements and other compliance related documents is only indicative of an acceptable level of compliance maturity. The compliance professional will need to interrogate the effectiveness of these documents, and whether internal audit has provided any previous assurance on the effectiveness thereof.
4. Before project commencement, have a clear understanding of both internal and external stakeholders (if applicable), you will need to engage. Also understand what documents and/or information you will need from these stakeholders. If you fail to engage critical stakeholders, your entire assessment is likely to be fundamentally flawed.
5. You will only gain limited context of the organisation prior to project commencement. Therefore, the compliance professional will need to use the inception meetings and other stakeholder engagements to establish the context of the organisation. It is critical that the compliance professional has a clear understanding of the history of that compliance function. Some compliance functions were once mature, fully embedded and integrated (most mature), events such as COVID-19 forced many organisations to rationalise compliance functions. Affected compliance functions are likely, no longer ‘most mature’.
6. The compliance professional cannot complete a credible compliance maturity assessment without expert knowledge on compliance practice fundamentals (see the Generally Accepted Compliance Practice Framework, 2018 of the Compliance Institute Southern Africa). If deep compliance practice experience is lacking, rather seek help from preferably, certified compliance professionals.
Lastly, Psychologically, the compliance professional needs to confront the reality that the compliance maturity assessment’s outcome or final rating will in many ways chart the compliance function’s future course. The compliance professional will not have many bigger impact responsibilities than this.
