When my children were younger we would regularly go on road trips to visit family. Five minutes after leaving the house they would start asking a question which they would not stop asking until we got to our destination, "are we there yet?" Even at their age they knew that progress was an important thing to measure.
When it comes to compliance we also need to answer this same question. However, it is is not as easy as reading the odometer on a car or looking at the GPS. One of the reasons why this may be difficult is that compliance may not have the necessary instrumentation to determine progress. I often hear from managers that they are not sure what they should be measuring or what indicators to use. Without knowing what to measure it is not possible to know your progress.
However, you might also conclude that the problem could well be that compliance does know where it is going and without a destination you also cannot measure progress. Perhaps, herein lies the rub.
To explore this further let's consider a quality program that uses ISO 9001 to define normative behaviors. According to ISO 9000, effectiveness is defined as “the extent to which the anticipated results/objectives are achieved." Having goals around effectiveness is reasonable and something companies should have, although reportedly 70% of companies do not measure the effectiveness of their compliance programs.
Measuring effectiveness requires that two aspects are evaluated: effort and outcome; where:
effort is the time, money, resources committed to building, maintaining, and improving a compliance program, and
outcome is defined as the impacts that these efforts have on the level of compliance and business performance (margins, safety, customer satisfaction, stakeholder trust, and so on)
It is common to only focus on effort when first building a compliance program. As companies progress in their compliance maturity the focus shifts to outcomes. However, determining effort and tracking outcomes is not common which may be attributed to a lack of compliance maturity or as research also shows a lack of proper motivation.
Studies have shown that if the motivation for pursing compliance is stimulated by external pressures, such as pressure to obtain ISO 9001 certification, then organizations end up conforming only to administrative or surface level requirements without optimizing their program effectiveness. In these cases companies are not interested in whether their program is effective but merely that they are able to obtain certification.
For many companies, compliance was about jumping into the car and just start driving. Maybe that was enough back then, however, now the kids in the back want to know where you are taking them and when they will get there. And they will not stop asking until you give them an answer. The first step is to change compliance from an external motivation to an internal one. This involves taking ownership of your compliance obligations and deciding what your destination is, which may be many along the way. You will then be able to measure your progress along with effort so that you can know how effective your program is.