Rebecca Wellum (rebecca.wellum@adp.com) is Director of Compliance Programs at ADP Canada Inc. in Toronto, Canada.

The notion that compliance programs roll out because Legal got the policies written and published, and all employees suddenly follow along merrily, is an absolute fallacy. This much is clear, based on a good understanding of the Seven Essential Elements.^[1] Compliance evolves in an organization over time. As the risk potential, appetite, and reality of business operations are examined, there is a need to figure out ways in which compliance can be addressed in all paths simultaneously. There is no way of swooping in, dropping off the recommended plan, and swooshing away just as easily, expecting success.

Although many organizations still think of compliance as a Legal-only play, compliance programs must in fact be a collaboration of both legal and operational minds. A program manager focuses on the long game; they work like this is a marathon and build things from the foundation up. Program managers assess the operational landscape, learn as much as they can about business processes, and then start formulating a plan that aligns with legal obligations and mandates, but works for the day-to-day tasks. Program managers ensure that whatever they build out and deploy is sustainable and can work even without Compliance pulling the levers. What is core is that compliance programs are successful when the culture absorbs their obligations into their day-to-day work, not when the policy is drafted, revised, approved, and posted. In fact, I would argue that embedding these obligations into daily procedures is more effective than annual policy training.