Compliance Management

A robust compliance management system translates a company’s individual risk profile into clear responsibilities, transparent processes and reliable decision-making procedures. A Compliance Management System (CMS) encompasses the principles and measures by which a company ensures compliance with legal requirements and internal policies, prevents breaches, detects them and responds appropriately. The impetus for establishing or further developing such a system often stems from new regulatory requirements, international growth, corporate transactions, changes to supply chains or identified weaknesses in the existing system. Anyone wishing to establish or further develop a compliance management system should prioritise relevant risk areas and create suitable structures for compliance with both internal and external requirements.

The design of the individual elements depends on the company’s size, sector, international reach and risk exposure. A CMS should be appropriately scaled: it should effectively address the key risks without burdening the organisation with unnecessary complexity.

The starting point is a structured compliance risk analysis. This takes into account the business model, markets, supply chains, business partners, regulatory requirements and potential operational risks. Typical risk areas include corruption and bribery, antitrust and competition law, sanctions and export control legislation, anti-money laundering, data protection and information security, labour and human rights throughout the supply chain, as well as tax and product-related obligations. Added to these are requirements under the Supply Chain Due Diligence Act, the Corporate Sustainability Due Diligence Directive and the Whistleblower Protection Act, as well as the organisational and supervisory obligations under Sections 30 and 130 of the German Administrative Offences Act (OWiG). On this basis, responsibilities, control activities, escalation procedures and reporting processes can be structured in such a way that they are tailored to the organisation and function reliably in day-to-day operations.

A proven approach is to allocate tasks across the three lines of defence: the operational units are responsible for risks and controls within their processes. Compliance and other monitoring functions define methods, collate information and scrutinise their adequacy. Internal Audit assesses, independently and in a risk-based manner, whether the intended mechanisms are operating as planned.

This provides management with a sound basis for deploying resources in a targeted manner, identifying operational risks at an early stage and managing compliance with relevant requirements in a transparent way. Clearly defined interfaces with risk management, the internal control system and the Internal Audit function reduce overlapping structures and facilitate the long-term integration of these processes into day-to-day operations.

The assessment of a CMS distinguishes between two levels: Adequacy examines whether the principles and measures are suitable for mitigating the identified risks with reasonable assurance. Effectiveness examines whether they were actually applied as intended within a defined period. Both assessments can be independently verified as part of an audit in accordance with IDW PS 980.

Measures that provide meaningful insights may include, amongst others: the scope and timeliness of the compliance risk analysis; training rates and participation deadlines for high-risk target groups; the number and processing time of reports received; the results and exception rates of control tests; the number of outstanding and overdue measures; and the findings of the Internal Audit. Regular evaluation highlights where adjustments are required and in which areas operational risks persist.

Reporting tailored to the relevant audience helps senior management and supervisory bodies to assess developments, monitor compliance with defined requirements and document decisions in a transparent manner. If defined thresholds are exceeded, clearly defined escalation and decision-making procedures are required.

KPMG supports companies with compliance management consultancy in the design of target frameworks, role models, processes and management information. This includes an assessment of the current situation using a maturity model, a prioritised implementation roadmap, the integration of new requirements into day-to-day operations, and the incorporation of digital data flows and GRC solutions. In addition, independent audits in accordance with IDW PS 980 can provide reliable insights into the adequacy and effectiveness of the CMS. This results in a scalable approach that enables companies to adapt to regulatory changes and address operational risks in a targeted manner.