Who owns compliance, and why it cannot be nobody

Three ways nobody ends up owning it

It is given to IT. Reasonable on the surface and wrong, because most of the work is documentation, process, contracts and people. An IT manager can implement a control and cannot decide where the boundary runs or commit the business to a date.

It is shared. A responsibility matrix with eleven names is a description of a discussion, not an owner. Shared ownership is the polite form of no ownership and it is the commonest arrangement.

It is the owner's, notionally. The managing director holds it, cares about it in the week a bid is due, and has no time in the other fifty-one.

One named person, with three things

Named. A person, in a document, whose objectives say so. Not a role, not a committee.

Time. Quantified and protected. For a supplier of a hundred people this is commonly half a role during the programme and a day a week afterwards. An owner with no allocated time will do the work that shouts, and compliance never shouts until it is too late.

Authority. To require evidence from anybody, to stop a change that would break the boundary, and to escalate directly to whoever signs. Without the third, the first two are advisory.

Not necessarily technical

The best compliance owners in small manufacturers are frequently from quality. They already run a documented management system, they understand audits, they are used to producing evidence for somebody external, and they are comfortable telling production that something must be recorded.

That skill set is closer to what this requires than deep technical knowledge, which can be bought by the day and cannot substitute for somebody who knows how to make a record happen.

Somebody senior whose revenue depends on it

The owner needs a sponsor with commercial authority, and the right one is whoever owns the customer relationships that carry the clause. Their interest is direct: without the certification those contracts stop being available to them.

A sponsor from finance or operations works less well, because the programme reads to them as cost. The sponsor should be the person for whom it reads as revenue.

Four things, none of them technical

The contracts, including the clauses. A standing slot with the sponsor, monthly, that survives busy periods. A budget line they can see. And permission to ask people awkward questions about how they actually do their jobs.

The last is the one that has to be granted publicly. An owner walking the floor asking how files really get to a machine needs everybody to know they were sent.

Write down what leaves with them

Compliance ownership concentrates knowledge in one person faster than almost any other role: where the evidence lives, why a control was scoped as it was, what the assessor asked last time, which supplier promised what.

Record decisions with reasons as they are taken, keep the evidence in a shared location rather than a personal one, and have a second person who could find things. Otherwise a resignation costs a quarter, and the entry on slippage is largely about that.

For a supplier of twenty people

One person, two days a week during the programme and a half-day after. A named sponsor. A monthly hour with them. External help bought by the day for the parts that need a specialist.

That is enough. What is not enough is the same person with the same other job and no allocated time, which is what most small suppliers attempt first.

Write one, even for a part-time role

What the person is accountable for, what they may decide alone, what they must escalate, how much time is allocated, and who their sponsor is. Half a page.

Without it the role is whatever the incumbent makes of it, which works while they are good and fails invisibly when they are replaced by somebody who reads the title and guesses.

What to buy in and what not to

Buy specialist knowledge by the day: gap analysis, readiness review, technical remediation. Do not outsource ownership. A consultant cannot require your production manager to record something, and the moment their engagement ends the role is vacant again.

Elsewhere in running the programme

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.