Management systems are efficient at what they do, that is, doing the same thing the same way over and over again. What they tend not to be good at is change and improvement. What compliance needs most of all is the ability to improve and mature capability over time to advance compliance outcomes. This means change and this is something that management software often does not support very well. Many organizations chose software based only on improving efficiencies with respect to a fixed set of basic compliance requirements. These capabilities are often directed at the reactive side of compliance focused on reporting, audits and the collection of lagging indicators. Software applications and platforms in this space often do not support processes that allow you to be proactive as you improve towards higher standards, and better outcomes. The majority of regulations and industry standards are now performance and risk-based that require companies advance their capability maturity over time. Compliance systems must move beyond just focusing on improving efficiencies and instead support the capabilities leadership needs to improve effectiveness. Compliance technology must now support proactive as well as reactive processes. Modern compliance systems should include capabilities that support: Managing all obligations (mandatory and voluntary) Managing traceability of promises and commitments in support of accepted obligations Managing the alignment of organizational values with operational objectives Managing preventive and mitigatve measures to contend with uncertainty and risk Real-time monitoring of compliance status and capacities Discovery of insights to proactively stay in compliance and ahead of risk Learning and skill development to advance capabilities that advance compliance outcomes (safety, security, sustainability, quality, regulatory, ethical, etc.) Continuous improvement across measures of conformance, performance, effectiveness, and assurance. Support for front-view planning, management preview, pre-incident investigations, program pre-mortems, evaluate/elevate cycles, prevention and improvement, benefit realization. Organizations should not settle on software that only meets basic, reactive requirements. When it comes to meeting modern day obligations, there is more at stake than just saving money.

Have you ever noticed how quickly things start to shape up when senior management turn their gaze to a particular corner of the company? It's almost like magic – suddenly, that chronically underperforming function or system is hitting targets, or that long-neglected process gets a much-needed overhaul. This phenomenon isn't just coincidence; it's the power of attention at work. Attention, particularly from senior management, acts as a powerful catalyst for change. When leaders focus on an area, several things happen: Resources are allocated : Time, money, and personnel are directed towards the area of focus. Accountability increases : People know they're being watched, so they step up their game. Innovation is encouraged : Fresh ideas are sought out and implemented to show progress. Priorities shift : The highlighted area becomes a top concern for everyone involved. This sudden influx of energy and resources often leads to rapid improvements. It's like shining a spotlight on a dusty corner – you can't help but notice what needs cleaning. But here's the million-dollar question: Is attention alone enough to sustain long-term improvement? The short answer is no. While attention is a great kick-starter, it's not a sustainable strategy for continuous improvement. Here's why: Attention is finite : Leaders can't focus on everything all the time. Eventually, their gaze will shift elsewhere. Quick fixes vs. systemic change : The pressure of attention often leads to band-aid solutions rather than addressing root causes. Burnout : Constant scrutiny can lead to stress and decreased morale over time. Dependency : Teams may become reliant on leadership attention to drive improvement, rather than developing their own initiative. So, what's the solution? How can businesses harness the power of attention while ensuring lasting improvement? Here are a few strategies: Develop robust systems : Create processes that maintain high standards even when leadership isn't watching. Foster a culture of continuous improvement : Encourage all employees to constantly seek ways to enhance their work. Implement regular check-ins : Schedule periodic reviews to maintain accountability without constant oversight. Empower middle managemen t: Equip them with the tools and authority to drive ongoing improvement in their areas. Celebrate and reward sustained excellence : Recognize long-term performance, not just short-term gains. Attention from senior management is indeed a powerful tool for driving improvement in business. However, it's most effective when used as a catalyst for creating self-sustaining systems of excellence. By combining the motivating power of attention with strategies for long-term success, businesses can achieve more than low hanging fruit, but also address root causes which lead to longer lasting improvement. What are your thoughts? Have you experienced the attention effect in your organization? How do you balance the need for leadership focus with sustainable improvement strategies?

CrowdStrike recently published the results of a technical root cause analysis (RCA) stemming from the July 19th, 2024 incident that caused millions of computer system crashes worldwide. The report identifies several factors contributing to the incident and presents mitigative actions. It cites an out-of-bounds memory read leading to the failure of the EDR sensor, causing Windows operating systems to crash, as the root cause. The root cause analysis presents findings and remedies, which form the basis for actions now underway, as summarized in the RCA executive summary: Update Content Configuration System test procedures. This work has been completed. This includes upgraded tests for Template Type development, with automated tests for all existing Template Types. Template Types are part of the sensor and contain predefined fields for threat detection engineers to leverage in Rapid Response Content. Add additional deployment layers and acceptance checks for the Content Configuration System . This work has been completed with an updated deployment ring process, ensuring Template Instances pass successive deployment rings before rollout into production. Provide customers additional control over the deployment of Rapid Response Content updates . New capabilities have been implemented and deployed to our cloud that allow customers to control how Rapid Response Content is deployed, with additional functionality planned for the future. Prevent the creation of problematic Channel 291 files . Validation for the number of input fields has been implemented to prevent this issue from happening. Implement additional checks in the Content Validator. Additional checks are planned for release into production by August 19, 2024. Enhance bounds checking in the Content Interpreter for Rapid Response Content in Channel File 291 . Bounds checking was added on July 25, 2024, with general availability expected August 9, 2024. These fixes are being backported to all Windows sensor versions 7.11 and above through a sensor software hotfix release. Engage two independent third-party software security vendors to conduct further review of the Falcon sensor code and end-to-end quality control and release processes . This work has begun and will be ongoing as part of our focus on security and resilience by design. While these actions and the specific mitigative measures in the RCA report are important, they may not be sufficient. The reason? The root cause may not be purely technical. The Scope of the RCA Was Limited and Reductive The findings reported in the RCA only considered technical, proximal causes. Proximal (or first-order) causes are closest to the event and often don't provide sufficient explanation of what initiated the causal chain leading to the incident. Identifying the causal chain requires looking beyond first-order causes and considering non-technical factors. The analysis failed to answer: What were the prior conditions or actions that created the opportunity for an unmitigated high-risk software change to be deployed to customers? This question can only be answered by taking a systems perspective that includes both technical and non-technical factors. Based on what has been reported, this comprehensive analysis has yet to be conducted. The Root Cause Was Likely Not Technical A statement from the report offers a clue about the nature of the root cause and why the primary cause may not be purely technical: "In summary, it was the confluence of these issues that resulted in a system crash: the mismatch between the 21 inputs validated by the Content Validator versus the 20 provided to the Content Interpreter, the latent [emphasis added] out-of-bounds read issue in the Content Interpreter, and the lack of a specific test for non-wildcard matching criteria in the 21st field." The word "LATENT" stands out. The vulnerability that led to the incident already existed, lying dormant and waiting for a software change to expose it. This form of risk propagation, proposed by James Reason and illustrated by the well-known Swiss cheese model, is not new. Studies of other complex systems have shown that the greatest risk is usually not a failure in a single component, but rather the existence of smaller latent vulnerabilities that, as a result of ongoing changes, align to allow risk to materialize. This raises further questions: What other latent vulnerabilities reside within the software? What future changes will cause these latent risks to breach the defenses? What is causing the vulnerabilities to be introduced in the first place? Why was the software change process ineffective at identifying and mitigating potential risks? The last question suggests an alternative root cause: A failure to effectively handle risk due to planned software changes. A Software Engineering Failure In high-risk sectors such as chemical processing, nuclear energy, and medical devices, safety is paramount, and change is considered a significant source of risk. That's why managing change is regulated to ensure organizations take necessary steps to protect the public, employees, assets, and the environment. It's also why we have process, safety, industrial, and quality engineers to design safety into system processes and ensure it is managed effectively throughout the life-cycle of facilities, products, or services. What appears to be missing is this same level of concern for safety in software engineering and in particular with respect to this incident. The Need to Dig Deeper While the out-of-bounds read error may have caused the sensor failure, there is an argument to be made that it may not be the root cause. To discover the true root cause, we must look beyond technical considerations and proximal causes. We need to dig deeper into the systems that create conditions for vulnerabilities to emerge and lie dormant, waiting for future changes to expose them. There is much to learn from other high-risk domains that can be applied to the practice of software development. However, this knowledge can only be effectively implemented when the real root causes are uncovered. Only then will preventive and mitigative risk measures be truly effective.

Sustainability is often defined as fulfilling current needs without jeopardizing future generations' ability to do the same. In simpler terms, we should not sacrifice the future for short-term gains. However, I believe this definition is incomplete. We must also acknowledge another truth which we learned from our parents, many of whom sacrificed their present needs so that their children could thrive in the future. Interestingly, rather than viewing this as a loss, they counted it as gain. True sustainability is not only about striving for a balance between short-term and long-term objectives. It also involves making an investment: exchanging something of value for something of greater value. This perspective challenges us to rethink our approach to sustainability. It's not just about preserving resources for the future, but also about actively investing in it. Our parents' generation understood this intuitively, making sacrifices that they saw as investments in their children's futures. This expanded view of sustainability invites us to reconsider our approach to global challenges. It suggests that true sustainability isn't just about maintaining a delicate balance or preserving what we have. Instead, it's about making deliberate choices to improve our collective future, even if it means short-term sacrifices. Finding balance is a necessary part of sustainability. However, addressing the most pressing environmental, social, and economic issues will require sacrifice in the present. We should not view this as a loss, but rather as an investment in our future well-being.

Organizations face a complex landscape of regulatory, ethical, and stakeholder expectations. These obligations, both explicit and implicit, shape the operational environment. To thrive, organizations must translate these obligations into tangible commitments or promises. However, true success lies in delivering on these promises, ensuring compliance and building trust. Compliance performance is the bridge between commitments and expectations. By carefully tracking performance against promises – a measure of integrity – organizations gain valuable insights to predict and mitigate risks. This proactive approach is essential for navigating a dynamic regulatory landscape and exceeding stakeholder expectations. Obligations (must happen): serve as the foundational elements, shaping the organization's operational and compliance landscape. They directly influence the promises and commitments that are made. Promises (plan to happen) : are operationalizations of obligations, transforming compliance requirements into concrete actions and commitments. They directly contribute to prediction by providing specific targets and benchmarks. Predictions (forecast to happen): are informed by the performance of promise keeping (integrity). By analyzing historical performance against these parameters, organizations can forecast potential risks and opportunities in meeting obligations. Expectations (should happen) : influenced from obligations are often amplified or modified by predicted performance. The interplay of obligations, promises, and performance is a continuous cycle. As the external environment evolves, organizations must adapt their promises to align with changing obligations. By mastering this dynamic, businesses not only meet compliance requirements but also create sustainable value and build a strong reputation.

When it comes to compliance alignment we need to have answers to the following two questions: 1. How do compliance pillars (programs) depend on each other? 2. How do business functions contribute to meeting pillar obligations? For the first we use a compliance pillar Dependency Structure Matrix (DSM). Each pillar will have a PDP (Policy Deployment Plan (for example, there will be one for safety, security, and so on.) What we want to know is how each pillar depends on any of the others to fulfill their commitments. For example, How much does security support safety? If you ever wondered how to get more than the sum of your compliance parts, this is how you do it. For the second question we do the same analysis across functional groups.  Again, each function will have their own PDP consisting of their promises for each of the compliance pillars. What we are evaluating is each function’s contribution to overall safety, security, and so on. Knowing this information will help you prioritize your efforts to cover all your obligations as well as strengthen pillars and/or functions where compliance risk is the greatest.

“We need to move beyond compliance.” I used to think that moving beyond compliance was the answer. Many others did too. It seemed like the obvious next step. But after thinking more carefully over the last 10 years, I've realized that's not the solution. In fact, it could make things worse. When we say, “we need to move beyond compliance” where exactly do we need to move to? This is where the rub lies, and what's bothered me. Let me explain. Traditionally, we've viewed compliance through a narrow lens: ensuring adherence to prescriptive rules imposed by law. While it's essential to meet these obligations, it’s also limiting. It implies that compliance is merely a hurdle to clear or a box to check, rather than a cornerstone of responsible business. While many still view compliance using this narrow lens, the reality is the landscape has changed. Compliance has and continues to expand to encompass a broader spectrum of responsibilities. ISO 37301, for example, defines compliance as fulfilling all obligations, both mandatory and voluntary – those that are compelled by law and others we voluntarily decide to adopt. This definition recognizes that businesses have a duty to operate ethically and sustainably, beyond what the law requires. However, what this means is that: We don’t need to move beyond compliance. We need to catch up to where compliance now is. This does require going beyond “basic compliance” – adhering to legal requirements – towards “total compliance” – fulfilling all obligations, including those imposed by ethical and beneficial motivations. This is the next step, motivated by a genuine commitment to doing what's needed to meet all obligations, not just the basics. It's about assurance that organizations will keep the promises they have made. In fact, on a daily basis, catching up to compliance would look like a continuous process of making and keeping promises (a measure of integrity) associated with organizational, project, and operational obligations: Macro-ends (outcome-based) - outcomes, values, code of ethics, duties & liabilities Micro-ends (performance-based) - targets, key results, outputs Macro-means (management-based) - management standards, plans, processes Micro-means (prescriptive) - design standards (codes), rules, tasks, work instructions, procedures Instead of moving beyond compliance, let’s instead strive to keep our promises.

I've been asked this question several times, so I thought I'd share my answer here: The short answer is no. The longer answer is that Lean Compliance is a new practice area of Lean specifically for compliance, created in 2017 by Raimund Laqua, PMP, P.Eng. (Founder and Chief Compliance Engineer at Lean Compliance Consulting, Inc.). Lean Compliance is a methodology designed to overcome the challenges introduced by old-factory thinking, reactive behaviours, and traditional training, inspection, and audits as the means to ensure obligations are met. The Lean Compliance approach helps organizations eliminate compliance waste, leverage existing talent and capabilities, adopt proactive behaviours, establish operational programs and systems, and engage in continuous improvement to establish a virtuous cycle that effectively contends with modern-day risk, performance, and outcome-based obligations. While the practice of Lean Compliance is new, many of its principles come from existing areas of practice, including Lean Management, Lean Startup, Lean TPS, Engineering, Systems Thinking, Cybernetics, Promise Theory, Uncertainty and Risk Management, Performance Management, and Ethics. This may seem overwhelming; however, so is designing a car. That’s why we have engineers! The good news is that driving a car is much easier and something everyone can learn. It is this reason that we created "The Proactive Certainty Program." This is a four-step process that every organization can easily adopt to transform compliance from procedural or paper-based compliance to operational compliance using the principles of Lean Compliance. The question you need to answer is: Are you ready to learn to drive compliance towards better outcomes?

Historically, the responsibility of decision-making has predominantly fallen upon humans. However, with the rapid evolution of artificial intelligence, the landscape has shifted, and decisions are now frequently made by machines. Here are examples of questions that need to be answered? Should autonomous decision-making determine what is safe? Should it make decisions within what is already determined as being safe? When should human oversight and intervention occur? How much uncertainty is necessary and risk before this is needed? How should the use of AI be governed when used in safety devices or as part of a safety component? This poses a fundamental question: which decisions are appropriate for computers to make, and by what standards should these by governed? In this article, we will examine the use of decision support systems (DSS) and their role in decision-making, including their ability to function as autonomous decision makers. Furthermore, we will explore the implications of this shift on organizational compliance for entities that opt to utilize this technology. Decision Support Systems Decision Support Systems (DSS) are a class of information systems that help individuals or organizations make choices by providing relevant data and models to facilitate analysis, visualization, and interpretation of information. The ultimate goal of a DSS is to support decision-making processes by providing users with the necessary information and insights to make informed decisions based on a variety of criteria, such as cost, risk, efficiency, and effectiveness. DSS typically includes software tools, techniques, and models that enable users to access and analyze data from different sources, perform “what-if” analyses, create scenarios, and generate reports. Examples of decision support systems include financial planning software, inventory management systems, and supply chain optimization tools. How Have DSS Changed? Decision support systems (DSS) have been enhanced in recent years by the integration of artificial intelligence (AI) technologies. AI-enabled DSS can provide more accurate and personalized recommendations, improve decision-making speed, and reduce human errors. Here are some of the ways AI have improved DSS: Automated Data Analysis : AI algorithms can automatically process large volumes of data and identify patterns, trends, and anomalies that may be overlooked by human analysts. This capability can help users make more informed decisions by providing them with accurate and timely information. Personalized Recommendations : AI-enabled DSS can provide personalized recommendations based on an individual user's preferences and past behaviors. This approach can improve decision-making outcomes by tailoring the suggestions to the specific needs of each user. Predictive Analytics : AI-powered DSS can perform predictive analytics to anticipate future trends, events, and outcomes. This can help users identify potential risks and opportunities and adjust their decisions accordingly. Natural Language Processing : AI algorithms can understand and interpret natural language inputs, such as text or speech. This capability can improve user experience by enabling them to interact with the DSS in a more natural and intuitive way. Machine Learning : AI-enabled DSS can use machine learning algorithms to improve the accuracy of its predictions and recommendations over time. The system can learn from its past decisions and outcomes and adjust its models and parameters to optimize its performance. AI technologies have transformed decision support systems by enhancing their accuracy, speed, and personalization. This evolution has enabled organizations and individuals to make better-informed decisions, improve their efficiency, and gain a competitive advantage. However, DSS now have something else to offer – the possibility of autonomous decision-making. Autonomous Decision-Making Decision support and autonomous decision-making are both capabilities to assist with decision-making processes. However, they differ in their level of automation and human involvement. Decision support, including those enhanced by AI, focus on supporting decision making rather than making decisions. Decision support systems typically require human input to generate recommended decisions. The ultimate decision-making power remains with the human user, who can choose to accept, reject or modify the recommendations generated by the DSS. On the other hand, autonomous decision-making involves the use of artificial intelligence algorithms to make decisions automatically without human intervention. The AI algorithms analyze data, learn from patterns, and generate decisions based on this analysis. The decision-making process is entirely automated, with no human input required. Here are some advantages and disadvantages of decision support systems (DSS) and autonomous decision making using AI: Advantages of Decision Support Systems (DSS): Improved decision-making : DSS can provide decision-makers with access to more comprehensive and accurate data. This can improve the quality of decision-making and help organizations make more informed decisions. Speed and efficiency : DSS can automate the process of data analysis and provide real-time decision support. This can help organizations make faster and more efficient decisions. Flexibility: DSS can be designed to meet the specific needs of an organization or department. This means that decision-makers can customize the system to address their unique needs. Disadvantages of Decision Support Systems (DSS): Complexity : DSS can be complex and difficult to use, requiring specialized knowledge and training. This can make it challenging for non-experts to use the system effectively. Dependence on data quality : DSS rely on data quality to generate accurate recommendations. If the data used by the system is flawed or incomplete, it can lead to inaccurate or biased results. Limited scope : DSS are designed to provide decision support for specific tasks or processes. This means that they may not be effective for more complex decision-making processes. Advantages of Autonomous Decision-Making using AI: Speed and efficiency: AI can analyze data at a much faster rate than humans, allowing for faster decision-making and improved efficiency. Consistency : AI algorithms can make decisions consistently, without the variability that can come with human decision-making. Scalability : AI can handle large volumes of data, making it an effective tool for organizations dealing with big data. Disadvantages of Autonomous Decision Making using AI: Lack of human oversight: AI systems can make decisions (an act on them) without human input, leading to potential biases or errors. Dependence on data quality: Like DSS, AI systems rely on data quality to generate accurate results. If the data used is flawed or incomplete, it can lead to inaccurate or biased results. Complexity: AI algorithms can be complex and difficult to understand, making it challenging for non-experts to use or interpret the results. While DSS and autonomous decision-making have their own advantages and disadvantages, it is important for organizations to carefully consider their needs and goals before implementing these systems. Additionally, it is crucial to ensure the accuracy and integrity of the data used in decision-making processes, regardless of the system used. What Impact Does Autonomous Decision-Making have on Compliance? Autonomous decision making using AI can have both positive and negative impacts on compliance, depending on how the technology is implemented and monitored. On the positive side, AI-enabled autonomous decision-making systems can help organizations improve compliance by: Reducing Bias : AI algorithms can make decisions based on objective data and criteria, which can reduce the impact of human biases that may lead to non-compliant actions. Enhancing Accuracy: AI-powered systems can process large volumes of data and analyze it accurately and consistently, which can help organizations identify potential compliance issues and take corrective actions quickly. Improving Efficiency: AI systems can automate routine compliance tasks, such as monitoring and reporting, which can reduce the workload of compliance staff and improve their productivity. Enabling Predictive Compliance : AI can analyze historical data and identify patterns and trends that may indicate future compliance risks. This approach can help organizations anticipate potential compliance issues and take preventive actions before they occur. However, there are also potential risks and challenges associated with the use of autonomous decision-making systems in compliance: Lack of Human Oversight: Autonomous systems may make decisions that violate ethical or legal standards if not adequately monitored by human experts. Therefore, organizations must ensure that human oversight and control mechanisms are in place to avoid such risks. Limited Transparency: The use of complex AI algorithms can make it difficult for compliance staff and external regulators to understand how decisions are made. Lack of transparency can undermine trust and confidence in the system and raise compliance risks. Unintended Consequences : Autonomous systems can generate unexpected results that may lead to unintended consequences that violate ethical or legal standards. Therefore, organizations must ensure that their systems are designed to anticipate and mitigate such risks. While autonomous decision-making using AI can help improve compliance, it is critical to balance the potential benefits with the potential risks and challenges. Organizations must ensure that their systems are transparent, explainable, and subject to appropriate human oversight and control mechanisms to achieve the desired outcomes. Not My Final Thoughts When making decisions, and more importantly acting on them, involving uncertainty where people, public, or the environment may be at risk, it becomes a moral imperative. It is up to humans to determine what level of safety is acceptable and what risks are tolerable, not machines. Therefore, it is the responsibility of humans to establish the parameters within which AI operates, including the acceptable level of risk. This ultimately holds people accountable for the outcomes of their decisions, a responsibility that machines are unable to fulfill, regardless of its level of "intelligence". Where does the science experiment end and responsible engineering begin? The idea of unsupervised or autonomous decision-making by AI systems promotes a use where decisions can step outside the lines and create risk. To provide assurance that organizations stay within appropriate boundaries, they must ensure that their employees, as well as their systems (including AI), are operating ethically and within regulatory frameworks. Perhaps, the risk is not so much in making decisions but on deciding which ones to act on which should probably be left to humans to decide particularly when the things we care about are at risk. What do you think?

Many organizations begin meeting compliance obligations using Compliance 1 practices. These are founded on basic capabilities that are mostly reactive in nature focused on meeting prescriptive regulatory requirements. Compliance is added "on top" of what is already happening. The hope is that this will be enough to satisfy external regulators and maintain a regulatory license to operate. While this is how most start it is not the way compliance should continue. Obligations today have expanded beyond regulatory prescription to encompass a broader set of commitments. Many of these are risk-based focused on performance and advancing outcomes such as net zero emissions, zero incidents, and so on. These have more to do with providing legitimacy for a social license rather than strictly regulatory adherence. To contend with these broader obligations many organizations scale up their compliance by doubling down on their existing practices. Unfortunately, Compliance 1 practices lack the capability to provide the assurance that stakeholders require. Today's compliance challenges requires proactive and systems capabilities that integrate with the business and not just sit on top of it. It also has to contend with uncertainty and risk. We call this Compliance 2 which compared with Compliance 1 is analogous to the difference between total quality management (TQM) and quality control & assurance (QC/QA), or Safety 1 and Safety 2 from the safety domain. Adopting Compliance 2 requires establishing processes to define the lines followed by the operational capabilities to stay within them. Operational compliance is responsible to implement these capabilities and processes. The internal audit function still has a role under Compliance 2. However, auditing now focuses on evaluating effectiveness as measured against compliance outcomes. This will include evaluating the level of compliance and operational risk. If you are ready to elevate your compliance consider joining The Proactive Certainty Program™

I realize this statement may be controversial or even provocative to some, but I kindly ask that you hear me out. For many organizations, compliance sits apart from what the organization does. It’s often seen as an obstacle in the way of innovation and getting things done. This perspective often arises from having a narrow view of compliance influenced by years of prescriptive and legal regulations. However, this perspective is only part of what compliance now means and why we need to think about compliance differently. Let’s start with the definition of compliance found in the international standard ISO 37301:2021, Compliance is the outcome of meeting all your obligations. This definition implies there are two aspects to compliance: Compliance is an outcome, that arises from Meeting all your obligations This parallels the dictionary definitions for compliance most often described as: The state of conformity with official requirements The act or process of complying Let's look at the first part. Compliance as Obligations The first thing we can say about compliance is that it involves obligations. Without obligations there is no need for compliance. Obligations are explicit requirements that in some cases will be legal in nature, some will be ethical, and others are beneficial to mission success. Whatever the motivation, these requirements are explicitly defined and are intended to create outcomes beyond just that of conformance. It's also generally understood that not meeting obligations may also create outcomes: losses arising from not meeting the obligation (penalties, fines, sanctions, etc.), and loss of value associated with unrealized obligation outcome Obligations can be expressed in several ways that include: rules to be adhered to, practices to follow, targets to achieve, or outcomes to advance. No matter the shape or size, or when compelled by law, moral values, or corporate strategy, obligations give rise for the need of the act of compliance. Compliance Promises This brings us to the second part of the definition: meeting the obligation – the act or process of complying. When a company decides to accept an obligation, for example: to achieve carbon neutrality by 2035 they are making a commitment, in this case with an environmental obligation. However, in practice this can be any obligation imposed from outside or inside of organization. Until the obligation is accepted, there is no need for the act of compliance. When it is accepted, a commitment is made to engage in the act of complying. According to Promise Theory (Mark Burgess), compliance commitments describe promises an organization makes and intends to keep to meet a given obligation. Promises shape policy, strategies, goals and objectives for the organization to meet all their obligations. In essence, promises define the means rather than the ends. Compliance as a Regulatory Process Now we come to the heart of the matter. The primary means by which compliance meets organizational obligations is by regulation. I don't meet regulations, but rather the regulatory process. Many organizations view regulation narrowly as: Rules : A set of rules or principles that control how something is done. These rules are often set by an authority, like a government agency, to ensure safety, fairness, or a certain standard. It can also be define by internal policy. The act of controlling : The process of enforcing these rules or principles. This can involve things like inspections, licensing, and penalties for non-compliance. As a result of changes in the compliance landscape in recent decades, meeting obligations has become more than adherence to rules or the establishment of controls. Fundamentally, compliance involves regulating organizational behaviours and actions to meet accepted obligations of all shapes and sizes. This regulatory process is not the responsibility of the compliance function or limited to what is traditionally considered as compliance obligations. In fact, meeting such things as production schedules, sales quotas, or new product launches also requires a regulatory function which for the most part reside with functional managers although they simply call this activity – management . When we look more broadly, we can see that every part of the organization is working to achieve compliance with respect to their specific goals and objectives. You may recognize this as the chain of accountability. Employees are meeting obligations from Managers Managers are meeting obligations from Directors Directors are meeting obligations from General Managers General Managers are meeting obligations from the CEO CEO is meeting obligations from the Board The Board is meeting obligations from Stakeholders Everything an organization does is compliance. Now, I am not saying management should now adopt a check-box or audit approach that is followed by traditional compliance functions. In fact, just the opposite. Compliance should adopt an operational and performance-based approach found in functional departments. Functional managers know how to negotiate operational goals and objectives, develop strategies and plans, monitor performance, and continuously improve. While their obligations are related to operational objectives they still require a commitment (a promise) that must be kept. This is the contract between one accountability level and another. In this sense, functional managers have been practising the act of compliance for years and many excel at it. Pressing the point further, some use the Lean practice of Hoshin Kanri (policy deployment) / Catchball to align operational goals and objectives with organizational values and outcomes. What is unfortunate is this process traditionally has not included compliance obligations. This presents an opportunity for organizations to leverage these capabilities to better operationalize all their obligations. Eating the Other Half of the Elephant We have observed in recent years that at least half of an organization’s obligations come from internal policy and not from external regulations. These obligations are not compelled by law but instead are voluntarily chosen to support stakeholder expectations. These obligations are often associated with quality, environmental, ethics, safety, security, sustainability and other expectations that have more to do with a social license rather than a legal license to operate. While these obligations do overlap with legal obligations they require operational capabilities similar to those found in functional units across other parts of the organization rather than a compliance department. This is Not a New Path I realize many do not view compliance in this way which is not surprising. Their compliance experience for the most has come from finance and legal where obligations are prescriptive and enforcement is reactive. They do not know what compliance looks like from an operational and proactive perspective. This is not the first time organizations have faced this situation. Back in the 1980s a similar thing happened with the quality movement. Back then we strove to achieve zero-defects utilizing quality control (QC) and quality assurance (QA) roles. This is not fundamentally different from achieving vision zero targets such as: zero incidents, zero non-conformance, or zero violations. What is different is we don't need to do it like we did back in the 80s. What we have learned since then is that inspection and audits seldom improve quality. Instead quality needs to be designed into products, services, and processes. Today, we can't imagine managing quality without managing it in every part of the value creation process. This approach is what is needed now to meet safety, security, sustainability, environmental, ethical, and even regulatory compliance obligations. We need to manage all our obligations in every part of value creation. The good news is that organizations have been doing the act of compliance with respect to operational objectives for years in production, sales, marketing, HR, and other business functions. They have for the most part the capabilities needed to meet all their obligations. They just need to leverage the capabilities they already have. However, this won't happen until they realize that everything an organization does is compliance.

When it comes to AI we must: Keep Humans In The Loop When there is a chance of harm, the decision to proceed is an ethical choice and can only be made by humans. AI should not make ethical decisions for you. They are not accountable and cannot answer for the outcomes. However, having humans in the loop means more than participating in an approval control process and checking a box. Accountable and responsible parties must be involved in identifying ethical dilemmas, impacts & risks, solutions, and arriving at a decision that is consistent with organizational values. What steps can you take starting today to ensure your organization is responsible with its use of AI?