Compliance advisory for companies without a compliance function

For most smaller companies, compliance starts with a request from outside. A customer, often a public authority or a larger business, sends a questionnaire or a draft data processing agreement and wants answers. Nobody in the building is quite sure what is being asked, or what a wrong answer might cost.

That is usually where I come in.

The role without the headcount

I handle the compliance work in the company the way an in-house compliance officer would. Today that is mostly data protection and GDPR. Earlier I held the same role in anti-corruption and in connection with acquisitions.

How it usually runs

It begins with a conversation about what you need to be able to answer, and who is asking. I get to know the business before I say anything about price, because the business decides how much work there is.

Then comes a defined stretch of work in which the groundwork is laid, so that you have documentation and agreements to show when someone asks. This is where most of the hours go.

Once the groundwork is in place the need drops off, and we adjust the arrangement to the work that is actually there. That might be a fixed ongoing arrangement, or hours you draw on when something comes up. With some clients, months pass in between.

Work outside the standing role

Some work does not need an ongoing arrangement. I have, for instance, helped a company that had to document its compliance programme for an international partner. The partner wanted proof that the programme worked in practice and not just on paper, and that decided whether the company would be considered for future projects.

At other times someone in the organisation may face a dilemma over ethics or compliance and need an outsider to settle it. Or a programme or a training course may need setting up so that you can run it yourselves afterwards.

Training people remember

Writing a GDPR course is easy enough. Building one that people remember afterwards is a different job, and it starts with working out which topics matter to your organisation, then pulling the training into a programme rather than a string of one-off courses.

A few of the principles I work to. People need to understand why the subject concerns them before they get the content. A short word from management at the start tells them this is not something the compliance department dreamt up. And in the quiz, every question should have one answer that is almost right, so that whoever answers has to tell the difference rather than simply recognise the right word.