Building an audit-ready compliance program is the dream. You know that your firm is prepared to meet any document request or regulatory inquiry with ease. You go to sleep each night confident that your firm is in compliance and your team is well-prepared to demonstrate that to the SEC.
It sounds terrific on paper, but how do you know you’ve built an audit-ready compliance program in reality? Here, we explore the signs your program is audit-ready and provide a checklist all CCOs can use to reach that goal.
Signs Your Compliance Program Is Audit-Ready
All audit-ready compliance programs share specific characteristics.
It starts with your firm’s culture. Everyone on the team promotes a culture of compliance. Compliance is not something to fear–it’s something to celebrate. All employees feel empowered to discuss the basics of robust regulatory compliance. This spirit of openness extends to the boardroom. Compliance has a seat at the management table and is included in all early business planning.
Similarly, the compliance team is empowered. CCOs and other compliance professionals have the autonomy and authority to do what they need to do. When they ask for necessary resources, leadership is happy to support them.
Finally, an audit-ready compliance program is proactive, not reactive. A firm with a healthy compliance culture builds an adequately-resourced program from a staffing, training, and technology and systems perspective.
Your Audit-Ready Checklist
Now that you understand the characteristics of an audit-ready program, you may be wondering how to get there.
The process is sequential. It begins with establishing appropriate processes and procedures and ends with creating a system where you can provide evidence of compliance at any time.
Walking through this checklist will help you understand current deficiencies in your program. Once you can check off all of these boxes, you can rest assured you have built an audit-ready firm.
1. Establish Your Compliance Processes
- Design and implement a compliance program that adequately addresses your firm’s risks
- Inventory and prioritize/rank the firm’s risks
- Identify controls to help mitigate those risks
- Create procedures to execute the controls
- Perform your Annual Review, as per SEC Requirements, to ensure the controls are appropriate and functional, and to identify any new risks
- Assign the controls to owners responsible for executing at a defined frequency
- Establish transparency in the completion of assignments
- Retain evidence of controls testing
- Educate your colleagues on compliance processes
- Run mock scenarios to coach responses to examiner’s inquiries (“no” is a complete sentence)
- Ensure the team is confident in its ability to produce records/evidence as requested
- Have the capability to identify and extract the relevant, in-scope records efficiently, accurately and completely, with supporting evidence
- Produce statistics and summaries of trends (where the exceptions are occurring), which inform the strengthening of your control framework
0939-OAT-5/27/2022