Compliance Program Checklist Template

Start about eleven weeks before the meeting that approves the programme. The first task names the four people and asks whether this is a first set-up or a refresh, whether the organisation is a regulated firm and which countries’ notes to show; each answer adds what it needs. Every due date counts from the approval meeting, in working days.

• Set up the compliance programme cycle — the organisation, the cycle, the date of the meeting that approves the programme (which every due date counts from), who approves it, whether this is a first set-up or a refresh, whether the organisation is a regulated firm, which countries’ notes to show, and the four people; later tasks are assigned from these fields
• Review last year’s programme report and open issues — the last annual review, the board’s or committee’s questions and actions, issues and remediation actions still open, and any regulator contact since
• Agree the programme’s mandate, owner and reporting line — the senior executive with overall responsibility, the compliance lead who runs it day to day, their authority and resources, and their direct access to the board or a committee
• Confirm the scope of the programme — the entities, countries and business lines, the subject areas in scope, and any area run as its own programme, named with its owner
• Map who does what in the programme — the board or committee that oversees it, the senior executive responsible, the compliance lead, obligation and policy owners, managers in the business and internal audit
• Set the timetable to the approval meeting — the dates for the register, the risk assessment, the gap assessment, the paper deadline and the meeting, and the meeting that will receive the first report

The register is the list every later phase works from: what the organisation must do, where the duty comes from and who owns it. An obligation that is not on it will not be assessed, tested or reported.

• Gather the sources of compliance obligations — laws and regulations, licences and permissions, regulator rules and guidance, contracts with customers, suppliers and funders, standards and certifications the organisation has signed up to, and its own codes and public commitments
• Build the obligations register — one row per obligation: its source, what it requires, who it applies to, the owner, how compliance is shown, and when it was last checked
• Agree an owner for every obligation — a named owner in the business who accepts each obligation, not only the compliance team, and the obligations still without one
• Add the regulator’s rules on compliance arrangements — the rules that say what a regulated firm’s compliance arrangements must include, such as a compliance function, a named officer or an annual review
• Check the register with legal and the business — new products, markets, contracts and changes in the law since the register was last checked, and anything missing added
• Set up horizon scanning for new and changed obligations — who watches which sources, how often, and how a change reaches the register and its owner

Rate where a breach is most likely and would do most harm, before and after the controls, so the effort in the rest of the cycle goes to the highest risks.

• Choose the risk assessment method and scale — likelihood and impact, inherent and residual risk, the rating scale and what each rating means, matched to the organisation’s own risk register
• Identify where a breach could happen — for each obligation area, the activities, places, people and third parties where a breach could happen, drawing on past incidents, audit findings, speak-up reports and regulator feedback
• Rate the inherent risk of each area — likelihood and impact before any controls, with the reason for each rating
• Map the controls and rate the residual risk — the policies, approvals, checks, systems and training that reduce each risk, how well they work, and the risk left
• Agree the ratings with the risk owners — each owner sees and challenges the ratings for their area, and changes are recorded with the reason
• Rank the risks and set this cycle’s priorities — the highest residual risks first, and where monitoring, training and resources go because of them

Compare what the register and the risks call for with what is in place today. Each gap gets an owner, an action and a date, and the plan goes to the approval meeting with the resources it needs.

• Assess the programme against the register and the risks — for each obligation and each high risk, whether a policy, a control, training and monitoring cover it
• Check the programme’s own building blocks — written standards, oversight, resources, training, monitoring and auditing, a speak-up route, incentives and discipline, the response to issues, and a periodic review
• Record each gap with its severity and owner — the gap, the obligation or risk it affects, its severity, its owner, the action and the due date
• Write the compliance remediation plan — one action per gap, with its owner, due date and priority by risk, and quick fixes kept apart from projects that need budget
• Confirm the people, systems and budget — compliance staff, time from the business, systems, the training budget and external advice the plan needs, and what is still missing

Decide what staff will be told, trained on and tested on in the coming year. The approval meeting sees these plans with the risk assessment and the remediation plan.

• Map policies to the obligations and risks — which policy covers each obligation and high risk, the new policies to write, and the old ones to update or retire
• Name an owner and a review date for every policy — each policy’s owner, approver and next review date in the policy register
• Plan the training by role — who needs which course (the board, managers, high-risk roles, all staff and, where it fits, third parties), when and how often, and how completion is recorded
• Write the compliance monitoring and testing plan — what is checked, by whom, how often and how: checks in the business, compliance monitoring and internal audit reviews, with the highest risks tested first
• Check the speak-up and investigation routes — how staff and others raise a concern, confidentially or anonymously where allowed, who investigates, and how people are protected from retaliation
• Choose the measures the board will see — training completion, test results, issues found and closed, overdue remediation actions, speak-up reports and regulatory changes

Nothing after the approval of the programme can be completed until the decision is recorded. Approved with changes and Not approved each add a task that says what to do next.

• Prepare the programme paper for approval — the scope, the register, the top risks, the gaps, the remediation plan, the training and monitoring plans, the resources and the decision asked for
• Review the paper with legal — statements about compliance with the law, how issues are described, and whether any part needs legal advice before it goes to the meeting
• Approve the compliance programme — the approver records the decision of the board, committee or senior executive on the programme and its plans; nothing after this task can be completed until it is done
• Make the changes the approver asked for — each change made before launch, and the approver told what changed
• Rework the programme and record a fresh decision — the compliance lead reworks the paper and takes it back to the approver, who changes the decision on the approval task to Approved, or un-completes and completes it again; do not launch until it reads Approved

Tell people what the programme expects of them, start the training and the remediation actions, and put every recurring task in the calendar so the programme runs between cycles.

• Publish the approved programme and policies — where staff find them, with the owners, the speak-up route and where to ask questions
• Communicate the senior commitment — a message from the chief executive or the chair on why the programme matters and what is expected of everyone
• Open the compliance issue log — one place for every issue from any source (tests, audits, speak-up reports, incidents and regulator contact), with its severity, owner, root cause and status
• Launch the training — the courses by role with their deadlines, and completion tracked against the training plan
• Start the remediation actions — each action in the plan opened with its owner and due date, and the quick fixes done first
• Put the recurring tasks in the compliance calendar — monitoring tests, training refreshers, policy reviews, register checks, board reports and the annual review, each with an owner

Run the first monitoring and testing cycle, log what it finds and fix the cause, not only the symptom. The answer on the issue log task adds two tasks when an issue may need reporting to a regulator.

• Run the first monitoring and testing cycle — the tests in the plan for the highest risks, with the results and the evidence recorded
• Log every issue found — each issue in the issue log with its severity and owner, and whether any may need reporting to a regulator or another authority
• Take legal advice on reporting the issue — whether the law, a regulator’s rules or a contract requires the issue to be reported, by when and to whom, and who decides; access to the details restricted
• Find the root cause of each significant issue — why the control failed, not only what happened, and whether the same cause affects other areas
• Record the decision on reporting and any report made — the decision, who made it and when, the date and reference of any report, and the board or committee told
• Track remediation actions to closure — overdue actions escalated to their owner’s manager, and each closure checked before it is marked closed
• Retest the controls that were fixed — the tester confirms each fix works before the issue is closed in the log

Report what the first cycle found to the board or committee, then set the date and scope of the next annual review so the programme is refreshed rather than left to age.

• Report to the board or committee — the measures, test results, issues and their status, remediation progress, regulatory changes and what the programme needs
• Record the board’s questions and actions — what the board or committee asked, the actions it set, their owners and dates
• Compare this cycle with last year’s — the measures, the issues and repeat findings, and the actions from last year that are still open
• Set the scope and date of the annual review — the next review date, what triggers an earlier one (a new law, market or product, a significant issue, an acquisition), and who leads it
• File the programme records — the register, the risk assessment, the gap register, the plans, the approval, the test results and the reports, with the retention period