The Hierarchy of Controls

If a risk is simply controlled by a policy, a training course and a monitoring test then it is primarily controlled by and relies on people. Sometimes that is appropriate but sometimes it is not strong enough. This infographic learns from another industry - safety - where understanding a control's strength is a matter of life of death. It applies the safety professions' hierarchy of controls to compliance: five tiers from strongest to weakest, who owns each, compliance's part, and what each relies on.

The Compliance Scaling Arithmetic (Example)

The Compliance Scaling Arithmetic: Worked Example is the Excel model behind the workbook of the same name. It includes the worked example and a template you can use yourself to carry out the same analysis for your firm.

The Compliance Scaling Arithmetic

The Compliance Scaling Arithmetic: Worked Example is the Excel model behind the workbook of the same name. It includes the worked example and a template you can use yourself to carry out the same analysis for your firm. This is a companion spreadsheet to the workbook of the same name (which is a separate Periscope Library resource).

The Culture Maturity Matrix

The Culture Maturity Matrix is an assessment framework for scoring a firm's compliance culture across five dimensions and three maturity levels. It tests the claim behind "we have a great culture" against what happens when nobody is watching and the commercial stakes are high; this is an honest assessment rather than an unsubstantiated boast.

Assessing Your Team's Fitness for Purpose

Assessing Your Team's Fitness for Purpose is a framework for mapping the capabilities a compliance function needs against the people who hold them. Compliance leaders use the capability heatmap to see where coverage relies on one person, where depth is missing, and where capability is in the wrong place — with four supporting techniques for when the heatmap is not the right answer.

The Five Lenses: How Effective Is Your Compliance Framework?

The Five Lenses is a diagnostic for testing whether a compliance framework will hold up under pressure. Monitoring results and audit outcomes give a one-dimensional view; this diagnostic adds five further lenses to evaluate a framework through, so compliance leaders can sense-check effectiveness before events do it for them.

Compliance Scaling Decision Matrix

The Compliance Scaling Decision Matrix is a framework for deciding which compliance processes to scale first. It scores each process on whether it SHOULD scale (risk, volume, evidence, debt) and whether it CAN (feasibility, mandate), giving compliance leaders a defensible sequence when scaling the likely 30–50 processes they are responsible for all at once is not an option.

Compliance Scaling Decision Matrix: Worked Example

The Compliance Scaling Decision Matrix Worked Example is a fully scored application of the matrix to eleven processes at a hypothetical regulated firm. It scores each process on the SHOULD and CAN axis, draws conclusions about sequencing, and shows the finished analysis a Compliance Director could take to a Board. It acts as a template for running the exercise on your own function.

The Ambiguity of Compliance Success

The Ambiguity of Compliance Success is a guide to differentiating a good compliance year from a lucky one. It separates "comfort signals" — the things that look like success — from "control confidence", the things that actually evidence effectiveness, giving compliance leaders different ways of answering the question "how do you know it's working?"

The First Line Accountability Contract

The First Line Accountability Contract is an infographic making the working contract between compliance and the first line explicit: what compliance owes the first line, and what the first line owes compliance, across five key areas. It is the counterpart to the Board Accountability Contract, also found in the Periscope Library, for a relationship too often defined by what each side resents about the other.

One Function. Five Audiences.

One Function. Five Audiences. is a guide to adapting how compliance presents itself to different key stakeholders: the Board, the CEO, the first line, the regulator, and the wider firm. It argues that using one approach for all five is a mistake, and suggests what each audience needs from compliance in order to trust it and act on what it says.