Systems & Continuity
Let's start with the foundation - how your compliance systems work and whether they keep running when people are away.
Gut check before we look under the hood
If an auditor arrived tomorrow, how ready would you feel?
Do you have a standing compliance agenda?
A regular rhythm for reviewing compliance matters
What 3/3 looks like: A simple, published rhythm that runs without prompting.
One list, not seven
When something needs doing (policy review, incident follow-up, risk action), where does it live and how is it tracked?
What 3/3 looks like: Everything flows to one list with owner/date, nudged automatically, and closed with proof.
Continuity, not heroics
Whose job is it to keep compliance/governance moving?
What 3/3 looks like: Named owners + backups + auto-escalations so cadence survives leave.
Cadence that survives leave
What tends to happen if the usual coordinator is away?
What 3/3 looks like: Agenda, reminders, and delegations keep work flowing without extra chasing.
Board pack in minutes, not nights
Can you share a clean snapshot without manual compiling?
What 3/3 looks like: One-click snapshots of actions, risks, closures with evidence attached.
Clarity at the top
Could your directors/key people comfortably explain how you meet the modules, standards and indicators?
What 3/3 looks like: Shared, confident narrative backed by a simple map to controls and evidence.
Role-clear, not folklore
For each role, are compliance duties clear, current, and tracked?
What 3/3 looks like: Role matrix with alerts; exceptions → actions and close with evidence.
Managers who can pass an audit—on a Tuesday
Do supervisors/managers have planned training and refreshers on compliance and evidence standards?
What 3/3 looks like: Planned curriculum, tracked completion, exceptions → actions, evidence filed.