Knowing your duties is the first step; meeting them permanently is the second. A compliance management system ensures that new rules are recognised, owners appointed, controls performed and breaches noticed, even when people change.
Typical elements
Common frameworks describe similar building blocks: a compliance culture with a clear stance from management, objectives, an analysis of compliance risks, a programme of rules and controls, an organisation with roles and resources, communication and training, and monitoring and improvement. The core is usually an obligations register that links each duty to its source, owner and control.
ISO 37301 and IDW PS 980
ISO 37301 is the international standard for compliance management systems and is certifiable. In Germany, the audit standard IDW PS 980 of the Institute of Public Auditors describes how a CMS is audited; many companies use it as a structure. Certification or audit is not mandatory for most SMEs but can help with customers, banks or investors.
Why a CMS protects
A working CMS not only reduces the risk of breaches. In the event of damage it can also show that management took its organisational and supervisory duties seriously. At the same time it prevents the same foundations being rebuilt for every regulation, such as a system inventory or an incident response plan.
Lean in SMEs
For an SME, a maintained register, a few effective controls, short training and a concise report to management are often enough. Regularity matters more than scope. The starting point is a gap analysis of applicable duties; our offer for building a CMS builds on it.