Some may be aware of an obscure but important guideline called ISO 19600 “Compliance Management System . provides description of what is considered a regulatory compliance culture. highlights the issues of independence, staffing and skills of Regulatory Compliance to operate without interventions and with Is this standard what you need to modernize your compliance? ISO 37001 is applicable for organizations that: want to modernized their corporate compliance efforts

Safety performance is improved when organizations take a comprehensive and systemic view of their safety efforts. This requires different skills than implementing separate activities connected with requirements where the "means" have already been specified.  With todays performance and outcome-based regulatory designs, organizations must now identify and determine how they will achieve targeted safety goals; which can be considered as obligations. A "design" step is needed to translate requirements to design specifications. These specifications describe the ends (key results and objectives) and the means (people, process, technology) of the safety effort needed to meet your obligations. API RP 1173 Management of Change (MOC) Example The following completed system requirements canvas demonstrates how this looks like for a Management of Change (MOC) sub-system for a Pipeline Safety Managment System (SMS) using API RP 1173. Although, this approach can be applied to other types of systems where improvement in both performance and outcomes have been targeted. This canvas maps requirements to the processes and capabilities that have been identified to achieve MOC effectiveness. Since API RP 1173 is a recommended practice (i.e. not mandatory) and uses a performance-based approach, it is no surprise that elements only include minimum procedural requirements that could be verified using an internal or external audit. Although, no certification body exists or is expected. When considering requirements a necessary (and perhaps the first) step is to identify what effectiveness looks like. This goes beyond looking at minimum prescriptive requirements and includes consideration of the system's overall purpose, internal and external dependencies and requirements that come from improving essential capabilities to achieve key results and objectives. For an MOC subsystem, effectiveness can be defined as: Management of change is effective when it keeps pipeline safety risk (individual and aggregate) within acceptable risk levels (risk tolerance) resulting from technical, physical, procedural or organizational change. This measure of effectiveness will create additional requirements although not specified in API RP 1173, are certainly expected as part of its adoption. A comprehensive design will also consider overall system properties which for a purposively system, like a Pipeline SMS, can be expressed in the following way: The first property we have already addressed, although not for the system as a whole. We know from system theory that a system is not the sum of its parts and is rather the product of its interactions. We expect that all subsystems will be designed to contribute to the production of the essential system properties. Therefore, we must identify what is needed for the MOC subsystem itself and its contribution to the whole (i.e. dependency requirements) with respect to being: effective, proactive, viable, sustainable, resilient, efficient, adaptive, and transparent. A design structure matrix (as shown below) can be used to identify dependency requirements along with possible vulnerabilities or gaps in system capabilities: Summary To meet performance and outcome-based obligations each organization must establish their own goals and objectives along with the means by which they will be achieved. It is in meeting these obligations that create performance requirements that extend beyond procedural specifications within the API RP 1173 framework as in our MOC example. A design step is now needed to translate performance, element, and system requirements to design specifications for solutions that advance overall outcomes. As safety is an emergent property of an overall safety system the design step requires knowledge and skills in system design, cybernetic controls, and risk-based strategies to ensure that safety is advanced. These are not only needed for adopting API RP 1173 but for all performance and outcome-based regulations and standards.

elements that, when properly integrated, form a powerful framework for achieving organizational and compliance drives innovation, inspires employees, and propels the organization towards sustainable success for compliance

short-term thinking to a long-term view and the benefits it can bring to our lives, businesses, and compliance This involves recognizing that success (including compliance success) often requires sacrifices in the With respect to compliance this means taking ownership of obligations and keeping promises associated a characteristic we value in people and businesses, and something we need to value with respect to compliance Compliance Growth and Maturity In a world where short-term thinking often prevails, it's time to embrace

When it comes to performance-based compliance required by organizations where compliance failure means For compliance systems to work they must be operational. They must achieve a minimum level of compliance defined as Minimum Viable Compliance (MVC). when essential functions, behaviours, and interactions work together at levels sufficient to create compliance benefits (the outcome of compliance.)

Compliance is all about staying between the lines and ahead of risk. This requires organizations be proactive and integrative with their compliance. This is best accomplished by having effective Operational Governance – the proactive side of compliance

working across high-risk, highly regulated industries like medical device, pharmaceuticals, and energy, compliance Today, compliance is about fulfilling all our commitments, not just the ones mandated by law. In fact, a strong compliance integrity score can be calculated by the number of promises kept compared The problem is, many still see compliance as an after-the-fact audit function, solely focused on legal compliance.

Establishing and maintaining compliance is an objective of many organizations. This means they don't know if their compliance efforts are helping or hindering meeting their regulatory A Measure of Effectiveness An important question to answer is how should compliance effectiveness be How is compliance progress measured? For most organizations verifying that their compliance systems are effective at keeping organizational

It addresses both Compliance 1 (rules and practices) and Compliance 2 (targets and outcomes), encompassing The Operational Compliance Model within Lean TCM ensures that compliance is not just a set of rules but Elevate Compliance Program, both designed to facilitate compliance transformation, strengthen defenses Not Elevating Minimal Viable Compliance : While the concept of achieving Minimal Viable Compliance (MVC Lean TCM addresses Compliance 1 and Compliance 2 requirements, offering a holistic, proactive, and integrative

Many organizations identify the need for a program to help them meet all their compliance obligations challenges and help them achieve compliance success. If you want to make a qualitative difference to compliance outcomes you need a compliance program and Don’t make the mistake between computer and compliance programs.  Make sure you have what you really need for mission and compliance success.

These have more to with outcomes of compliance rather than adherence to prescriptive rules. : “We are in compliance with all applicable rules, laws and regulations as far we know. Compliance needs a new sign. Compliance must become an operational function not just an administrative expense. That's a better sign and a better way to do compliance.

Technology is a pervasive force that significantly influences our lives in various ways, particularly with the widespread integration of AI. The impact of software on us is not always apparent, as we've learned from years of using social media. It's crucial to be aware of how technology can amplify certain behaviors while constraining others. Gone are the days when we could perceive technology as neutral, merely consisting of data collection, processing, or output devices. We now understand that information possesses influence beyond our explicit requests or desires. In many ways, information has agency. Therefore, it's imperative to ensure that our technology choices align with our values, contribute to our objectives, and, most importantly, reinforce the behaviors essential for achieving our mission. Failing to do so may result in reinforcing what benefits technology at the expense of our own interests. Be mindful of your technology choices and choose wisely.