What does compliance mean?
The term compliance originates from the business and legal “adherence to rules” of companies in order to comply with laws, guidelines and voluntary codes. The principles and measures for avoiding breaches of rules are described by the government commission “German Corporate Governance Code (DCGK)” as a compliance management system and describes the responsibility of management or the Management Board to comply with legal provisions and internal company guidelines.
“The term compliance stands for adherence to legal provisions, regulatory standards and the fulfillment of other essential ethical standards and requirements, usually set by the company itself.”
– Eberhard Krügler
The diversity of meanings in relation to compliance.
Compliance therefore refers to all measures and processes for adhering to all legal framework conditions. The following regulations are covered in detail.
- Legal regulations
- Contractual framework conditions
Legal regulations.
Compliance with legal regulations by companies is based on Sections 9, 30 and 130 of the German Administrative Offenses Act (OWiG), according to which laws must also be complied with by legal entities and companies must ensure that no violations of the law occur. If organizational and supervisory measures are not taken, the company management and the company itself can be sentenced to penalties. Sanctions under Sections 130 and 30 OWiG are not necessarily limited to the individual company and can also be imposed on group companies, even though the punishable infringement takes place within the sphere of the subsidiary.
A large number of legal regulations govern the company’s direct duties and responsibilities, and the company may face penalties if it fails to comply with them. There is also an obligation to ensure compliance with regulations under Sections 91 and 93 of the German Stock Corporation Act (AktG) and Section 43 of the German Limited Liability Companies Act (GmbHG) to prevent economic damage to the company. Any non-compliance with the rules can lead to corporate penalties, fines, profit absorption or the forfeiture of the profit generated by the breach of the law. These direct losses are increased by additional external and internal costs for proceedings, claims for damages and reversals. Compliance with the law is mandatory to ensure the survival and continued existence of every company.
Contractual regulations.
In addition to the legal framework, the term compliance also covers all rights and obligations defined by contracts. In particular, the contractual obligations arising from software licenses often entail unimagined complexity. In large companies, this results in an unmanageable diversity of IT systems across different business units and business areas, which cannot be easily monitored and controlled centrally. Responsibility for compliance with these contractual obligations is not clearly defined in most companies.
For comprehensive compliance management, companies need specialist or product-specific, legal and licensing core competencies, which ideally need to be brought together in one person, department or competence team. It would also be necessary to define what powers such a body should have. This question is essential for the organizational structure of a control mechanism.
The contractual provisions include:
- Industry-specific standards and process regulations
- Contractual SLA
- Product and service specifications
- Company agreements
- License agreements for software products used, which are often supplemented by 3rd party terms of use
General standards and industry-specific standards.
Everyone is familiar with ISO 9001, which is valid across all industries. For most companies, this standard represents the minimum requirements of the compliance management system in order to be perceived as a trustworthy supplier on the market. In addition, there are industry-specific variations that specify or tighten the requirements for the company to introduce, monitor, control and document specific processes. In simple terms, this means that all certified companies are obliged to introduce a structured quality and process management system.
These standards serve as the lowest common denominator to ensure fair competition between market participants and to ensure compliance risk management. In addition, a minimum standard for product, service and process quality is defined, which also extends to documentation obligations. Compliance management systems form the basis for a successful market presence and are therefore a basic requirement for successful companies.
You can find a list of all current, industry-specific regulations and standards here:
https://www.managementnormen.de/de/branchen/normen
To comply with these rules and standards, compliance management software that documents the process in detail, defines responsibilities and regulates measures to rectify and prevent deficiencies and deviations is an advantage. The following points are required to achieve and ensure sustainable ISO compliance:
- Clearly structured responsibilities and competencies
- Catalogs of measures
- A documentation solution
- Sophisticated process management
- Quality culture among all process participants down to store floor level
Product and service specifications (SLA).
Product specifications are contractual service descriptions and are therefore also subject to the overarching concept of compliance. The customer has contractual claims to the delivery of the services defined in the product or service description. In this paragraph, we are therefore primarily talking about quality management, quality assurance and process quality. How can quality be measured and how can consistent and stable product quality be achieved?
Each individual work step can be specified by a detailed work instruction and each product, sub-product or component can be checked and approved based on the given specifications. The secret to success here lies in a smart and efficient quality management system that is geared towards optimum usability on the store floor. The corresponding tooling should be able to be seamlessly integrated into the work processes and, if possible, not generate any additional work for testing and documentation. The involvement of all stakeholders in the overall process represents a decisive added value here, as information and accountability processes must ultimately also be integrated as part of the quality management documentation.
In the end, the person responsible for quality is usually not directly involved in the production process, which is precisely why it should be ensured that data-based insights into each individual process step are possible. At the same time, such data-based insights enable a continuous improvement process (CIP) and higher customer satisfaction and contribute to a genuine quality culture in the long term.
Company agreements & ethical rules of conduct.
In the context of employee co-determination, works agreements and, where applicable, a code of conduct drawn up by the company are also among the regulations affected by compliance. Works agreements generally contain agreements that have been negotiated by the works council and management and are binding for all or some of the employees. These agreements often concern issues relating to time recording, overtime regulations, breaks, special payments or voluntary additional benefits. The works council or the employees themselves are responsible for monitoring compliance with the regulations. It is not uncommon for only the management or specific specialist departments, such as HR, to have access to the actual processes and data.
License agreements.
A very exciting aspect of compliance are license agreements, which are a basic building block of every software solution. License agreements include:
- The scope of use of the software (how many users may use the software)
- The rights of use (who is the owner, processor and user of the data)
- The function of the solution (purpose and functionality of the solution)
- 3rd party rights of use (to what extent interface connections are feasible)
Other contractual agreements (e.g. cooperations, partnerships, etc.)
Many companies work closely with partner companies or cooperation partners in order to optimally exploit sales potential or increase the reach of products and services. Corresponding contracts primarily regulate responsibility, data sovereignty and remuneration and are usually supplemented by a target agreement. However, the question of compliance is usually only treated superficially and neglected. In principle, a cooperation or partnership agreement is also a contractual regulation, compliance with which must be monitored by a management system and audited on an ongoing basis.
Conclusion.
Compliance includes a wide variety of rules to be followed, which are perceived by companies in varying degrees of importance. The focus is on legal regulations, ISO 9001 or related standards for the structure and process documentation of the quality management system, as well as other relevant industry-specific quality standards. Non-compliance with the individual rules has very different consequences and side effects for the success of the company:
- Legal violations can jeopardize the continued existence of the company
- Breaches of contract such as SLAs and deficiencies in product quality damage reputation
- Ethical and internal violations undermine employee satisfaction
- Violations of license agreements usually go undetected, but carry an enormous risk of penalties and even the loss of essential software solutions and possibly data from historically grown process chains.
Ultimately, the company management decides which voluntary and contractual rules the company wants to commit to and how important sustainable process quality is in the various areas. In all cases, compliance management is required to monitor the implementation of and adherence to the rules, initiate measures in the event of breaches and carry out regular audits. Without the appropriate competencies and powers, compliance with rules is dependent on the daily form of the employees or the level of the general quality culture in the company.
