Introduction
If you’re a micro/small/medium enterprise, you probably don’t spend much time thinking about risk. This for the most part is probably a good thing, because thinking about everything that could impact you can be overwhelming and harmful in itself, it can also become a barrier to achieving more resilient business.
This adaptation of the COCO framework (Hopkin, 2012) provides 4 easy questions that anyone can use to identify potential business risks, plan for them, and increase resilience. I must caveat this article by saying that the brief risk examples included are extremely generic and are unlikely to resonate with you or your situation on their own.
In the first post of this four post series, we’re going to tackle four questions, starting with a very dry subject – Compliance.
The first question:
What obligations do other stakeholders expect us to meet?
This question is
There are two main types of obligation:
Legal obligations (Unconditional Rules) – these can come from different areas of government and are outlined in your countries legal system (for the UK this can be found on https://www.legislation.gov.uk/) If these are violated there are criminal consequences, including fines, sanctions and even prison time for individuals responsible in some circumstances.
If you trade internationally, you need to comply with the laws of the countries you are operating in, these may differ drastically to those of your own country.
Contractual obligations (Conditional Rules) – these can be found in service level agreements/contracts/tenders and other terms of engagement that come from your clients or suppliers. If violated these may result in termination of contracts, loss of clients or suppliers and potentially civil proceedings (fines & judgements).
You could consider societal obligations (Expectations) a third type of obligation, but it’s very difficult to satisfy societal expectations in today’s world and the impacts can vary wildly.
Compliance Strategy
A compliance strategy should be simple – identify the obligations, understand the obligations, fulfil or don’t fulfill the obligations.
A good generic treatment strategy would be to comply with unconditional rules in totality, meet conditional rules based on the benefit of them to the business (if the accreditation costs more than the contract is worth, e.t.c.) and fulfill societal expectations where you can and inline with your values.
Unconditional Rules
In truth, we should aim to comply with unconditional rules totally, no amount of operating outside the law is risk free – if we can eliminate serious risks like these, why wouldn’t we?
The event tree from a company breaking the law to being prosecuted can be vast and complex, but in most western countries enforcing state regulation is now a priority with many governments taking a zero tolerance approach.
Conditional Rules
These rules are conditional on us conducting business with the client or supplier which has placed the obligation on us, with these obligations we have a choice whether we want to accept them or not.
We should pick and choose which conditional rules we subject ourselves to when deciding who our clients and suppliers are. Some of these conditional rules may force us to improve our operating model and innovate, others may prove to be a burden on our business – we must choose wisely.
Societal obligations
As I said earlier, it’s hard to consider these obligations – the expectations are fluid and so are the impacts, these can loosely be estimated and “managed” but they become increasingly more complex the more involved your organisation gets.
There is no longer one idea of morality and the business sphere is becoming increasingly politicised, aligning yourself with one agenda or group may alienate another.