Compliance

Updated 28 Jul 2026

•
def
- •
  meeting the standards set by applicable laws, policies, and regulations
•
penalties
- •
  fines, loss of employment, or incarceration; scope may be domestic or international
•
reporting
- •
  internal — monitoring/reporting on an organization's own compliance efforts, often overseen by a Central Compliance Officer (CCO)
- •
  external — documentation required by outside/industry regulators, sometimes annually; missing or invalid reporting can trigger fines or sanctions
•
regulatory examples
- •
  Sarbanes-Oxley Act (SOX) — the Public Company Accounting Reform and Investor Protection Act of 2002
- •
  HIPAA — extensive healthcare data storage, use, and transmission standards
- •
  Gramm-Leach-Bliley Act (GLBA, 1999) — disclosure of privacy information from financial institutions
•
consequences of non-compliance
- •
  reputational damage (e.g., the 2016 Uber breach — 25.6 million records exposed, not disclosed until November 2017, resulting in $148 million in fines and a former CSO sentenced to probation)
- •
  loss of license, or contractual breach (some deals require a minimum compliance level)
•
compliance monitoring
- •
  due care (internal activities) vs. due diligence (third-party activities) — a duty to act honestly and investigate/verify
- •
  attestation and acknowledgment — someone must formally sign off on compliance documentation, and is ultimately responsible if it's incorrect
- •
  automation — a must-have for large organizations, collecting and compiling compliance data across systems
•
related
- •
  Privacy
- •
  Audits and Assessments

Linked references 4

◌ Explore connections in Graph view