Constructing digital compliance: a connected mindset approach

To address recent calls for better regulatory compliance of business processes (electronic or not), this study synthesizes research findings of nine peer-reviewed systematic literature reviews and state-of-the-art studies on business process compliance to examine Information Technology artifacts used in the compliance of business processes to laws and regulations. Results from the 342 unique studies covered by these reviews demonstrate that eight types of Information Technology artifacts are used in the design, execution and after-execution lifecycle phases of regulatory compliance to perform compliance modeling, checking, analysis and enactment tasks. The results also demonstrate with statistical evidence that compliance enactment (which involves putting mechanisms in place to address changes in the compliance representations, business processes or regulatory requirements) has received the least attention. This is a worrisome situation given the dynamic environment in which businesses operate. We argue that the findings in this work are relevant toward understanding the current state of the domain, providing insights on what phases and tasks need improvement.KeywordsBusiness process complianceIT artifactsMeta-analysisRegulatory complianceRequirementsSystematic reviews

This paper explores the design and implementation of quality control and compliance models tailored to customer-centric service industries, focusing on a process-driven approach to enhance service delivery, customer satisfaction, and regulatory adherence. The research underscores the significance of clear service standards, robust compliance frameworks, and the integration of technology for real-time monitoring. By examining key theoretical frameworks, including Total Quality Management (TQM), Six Sigma, and compliance regulations, the paper highlights how service industries can optimize operational efficiency while ensuring customer satisfaction and legal compliance. The study presents a comprehensive process-driven model that integrates compliance into service delivery, utilizes technology for monitoring, and establishes a feedback loop for continuous improvement. Furthermore, it emphasizes the importance of Key Performance Indicators (KPIs) such as customer satisfaction, operational efficiency, and compliance adherence to measure the effectiveness of these models. The research also identifies key challenges in implementing and maintaining these models, including navigating regulatory complexities and maintaining consistent service quality. Finally, the paper provides actionable policy recommendations for service industry stakeholders to enhance service quality and compliance, ensuring sustainable growth and customer loyalty. Future research should focus on the role of emerging technologies in optimizing quality control and compliance processes.

Purpose: To assess the regulatory compliance of operational processes at a British pharmaceutical manufacturing company (Company X). Provide remediation strategies for any compliance gaps identified to align operations with regulatory approvals. Ultimately, to assure Qualified Persons that finished pharmaceutical products released for sale are compliant with regulatory approvals and manufactured to current quality standards. Materials and methods: A gap analysis between regulatory-approved CTD sections and operational documentation is conducted for a single marketed product at Company X. Inclusion of CTD sections for review is determined according to those likely to contain Established Conditions (EC) as specified in the International Council for Harmonisation (ICH) of Technical Requirements for Pharmaceuticals for Human Use Q12 guideline. A three-tiered review process is used to identify Established Conditions and describe compliance. Tier 3 (Student) identifies Established Conditions by comparing like-for-like (compliant), equivocal (further assessment required) and opposing (non-compliant) terminology in the CTD sections compared to operational documentation. Tier 2 (Subject Matter Experts (SMEs)) reviews and approves Tier 1 outputs. Equivocal terminology is assessed as either compliant or non-compliant. Non-compliant conditions are assessed as regulatory gaps if they deviate from the CTD or quality gaps if they are compliant with the CTD but deviate from Good Manufacturing Practices (GMP). A risk assessment is conducted using a risk priority numbering (RPN) tool and remediation proposals are made. Tier 1 (Governance) reviews and confirms Tier 2 compliance gap outputs and ratifies a final adjudication and remediation strategy. Results and discussion: Data outputs for this study could only be generated at Tier 3 and Tier 2 levels due to time constraints. A total of 62 compliance-related Established Conditions (EC) were identified with 37 representing compliance gaps. 49% (30 conditions) related to regulatory compliance gaps, 40% (25 conditions) were compliant and 11% (7 conditions) were quality compliance gaps. Six categories of regulatory compliance gaps were identified with the most commonly observed being the unavailability of regulatory-approved CTD sections for review. Three categories of quality compliance gaps were identified with the most commonly observed being the misalignment of operational and validating documentation. Conclusions: Company X is presently in a state of non-compliance. The unavailability of regulatory-approved documentation emerges as the most common compliance issue suggesting insufficiencies in regulatory document control may currently exist. A root cause analysis coupled with a corrective and preventative action plan may be beneficial to support sustained compliance. Further work is required to remediate identified compliance gaps to bring operations into regulatory compliance.

Full-stack development and regulatory compliance of the enterprise systems architecture are essential to the operation of ensuring that the software solutions comply with the functional and legal requirements. The paper examines the concept of full-stack development (including front-end and back-end) and how it can be integrated with the ever-growing regulatory landscapes that regulate data privacy, security, and business processes. The paper suggests an exhaustive model of the incorporation of these two dimensions with the emphasis on system design, development, deployment, and maintenance. The framework presents some of the most important elements including regulatory compliance modules, automated testing tools and continuous monitoring systems which make sure that compliance is maintained at all times without compromising on development speed or functionalities. The study explains why regulatory mandates, e.g., GDPR and HIPAA, can be baked into the architecture, using full-stack frameworks, i.e., React, Node.js, and databases, which have the ability to provide encryption and audit trails. The framework eliminates the risks of non-compliance by using automated workflows and secure codes of practice. Industries like the finance and healthcare sectors, in case studies, have shown the application of the framework in real life scenarios, and is seen to have enhanced efficiency in the development process and regulation compliance. The research wraps up with a suggestion of how future enterprise systems should be designed to strike a balance between needs of full-stack development and the necessity of regulatory compliance so as to have sustainable, scalable and legally viable systems.

Artificial Intelligence (AI) is increasingly transforming the regulatory compliance landscape in the oil and gas industry. This paper examines the profound impact of AI on ensuring adherence to complex regulatory frameworks governing this sector. Regulatory compliance in the oil and gas industry involves adhering to a myriad of environmental, safety, and operational regulations, often posing significant challenges due to the volume and complexity of data involved. AI technologies, including machine learning, natural language processing, and predictive analytics, offer innovative solutions to these challenges. AI enhances data management and analysis by automating data collection, processing, and reporting, thereby increasing accuracy and efficiency. Predictive maintenance and risk assessment tools powered by AI can identify potential compliance issues before they arise, allowing for proactive measures. Moreover, AI-driven compliance monitoring systems enable real-time tracking of regulatory adherence, reducing the risk of non-compliance and associated penalties. Automated auditing and inspection processes further streamline compliance checks, ensuring thorough and consistent evaluations. Case studies demonstrate successful AI implementations in regulatory compliance, such as automated reporting systems in offshore drilling and predictive maintenance in pipeline management, which have resulted in improved compliance rates and reduced operational risks. However, the adoption of AI is not without challenges. Issues related to data quality and integration, cybersecurity, and regulatory acceptance pose significant hurdles. Additionally, ethical and legal considerations surrounding AI deployment must be addressed to ensure responsible use. AI holds substantial potential to revolutionize regulatory compliance in the oil and gas industry by enhancing efficiency, accuracy, and proactive risk management. As AI technologies continue to evolve, their integration into compliance processes will likely become more sophisticated, offering greater benefits and addressing current limitations. The future of regulatory compliance in the oil and gas sector will be increasingly shaped by the advancements in AI, driving both operational excellence and adherence to stringent regulatory standards.

Artificial Intelligence (AI) is increasingly transforming the regulatory compliance landscape in the oil and gas industry. This abstract examines the profound impact of AI on ensuring adherence to complex regulatory frameworks governing this sector. Regulatory compliance in the oil and gas industry involves adhering to a myriad of environmental, safety, and operational regulations, often posing significant challenges due to the volume and complexity of data involved. AI technologies, including machine learning, natural language processing, and predictive analytics, offer innovative solutions to these challenges. AI enhances data management and analysis by automating data collection, processing, and reporting, thereby increasing accuracy and efficiency. Predictive maintenance and risk assessment tools powered by AI can identify potential compliance issues before they arise, allowing for proactive measures. Moreover, AI-driven compliance monitoring systems enable real-time tracking of regulatory adherence, reducing the risk of non-compliance and associated penalties. Automated auditing and inspection processes further streamline compliance checks, ensuring thorough and consistent evaluations. Case studies demonstrate successful AI implementations in regulatory compliance, such as automated reporting systems in offshore drilling and predictive maintenance in pipeline management, which have resulted in improved compliance rates and reduced operational risks. However, the adoption of AI is not without challenges. Issues related to data quality and integration, cybersecurity, and regulatory acceptance pose significant hurdles. Additionally, ethical and legal considerations surrounding AI deployment must be addressed to ensure responsible use. AI holds substantial potential to revolutionize regulatory compliance in the oil and gas industry by enhancing efficiency, accuracy, and proactive risk management. As AI technologies continue to evolve, their integration into compliance processes will likely become more sophisticated, offering greater benefits and addressing current limitations. The future of regulatory compliance in the oil and gas sector will be increasingly shaped by the advancements in AI, driving both operational excellence and adherence to stringent regulatory standards.

Chatbots are computer programs designed to engage in natural language conversations in an easy and understandable way. Their use has been accelerated recently with the advent of large language models. However, their application in medicine and healthcare has been limited due to concerns over data privacy, the risk of providing medical diagnoses, and ensuring regulatory and legal compliance. Medicine and healthcare could benefit from chatbots if their scope is carefully defined and if they are used appropriately and monitored long-term. The confIAnce chatbot, developed at the Geneva University Hospitals and the University of Geneva, is an informational tool aimed at providing simplified information to the general public about primary care and chronic diseases. In this paper, we describe the certification and regulatory aspects applicable to chatbots in healthcare, particularly in primary care medicine. We use the confIAnce chatbot as a case study to explore the definition and classification of a medical device and its application to chatbots, considering the applicable Swiss regulations and the European Union AI Act. Chatbots can be classified anywhere from non-medical devices (informational tools that do not handle patient data or provide recommendations for treatment or diagnosis) to Class III medical devices (high-risk tools capable of predicting potentially fatal events and enabling a pre-emptive medical intervention). Key considerations in the definition and certification process include defining the chatbot's scope, ensuring compliance with regulations, maintaining security and safety, and continuously evaluating performance, risks, and utility. A lexicon of relevant terms related to artificial intelligence in healthcare, medical devices, and regulatory frameworks is also presented in this paper. Chatbots hold potential for both patients and healthcare professionals, provided that their scope of practice is clearly defined, and that they comply with regulatory requirements. This review aims to provide transparency by outlining the steps required for certification and regulatory compliance, making it valuable for healthcare professionals, scientists, developers, and patients.

The increasing frequency and sophistication of cyber threats in the financial sector have underscored the critical need for robust cybersecurity governance. This study explores the control deficiencies in cybersecurity governance within financial institutions and assesses their impact on regulatory compliance. By adopting a quantitative approach, the research identifies common gaps in cybersecurity controls, measures their correlation with regulatory adherence, and analyzes the consequences of non-compliance. Through surveys, audits, and case studies of financial institutions, the study examines the role of IT governance frameworks, such as COBIT, NIST, and ISO 27001, in addressing cybersecurity risks and ensuring regulatory compliance. The findings reveal that many financial institutions struggle with control deficiencies, particularly in areas like incident response, vulnerability management, and third-party risk oversight. These deficiencies often lead to regulatory non-compliance, exposing institutions to significant financial, legal, and reputational risks. Additionally, the study highlights how an ineffective alignment between IT governance and business objectives exacerbates these challenges. The research further explores the regulatory landscape, including frameworks like GDPR, GLBA, and PCI DSS, which require financial institutions to maintain robust cybersecurity measures and regular compliance audits. In response, this proposes several strategies for enhancing cybersecurity governance, including strengthening IT governance frameworks, improving control measures, and fostering a culture of continuous cybersecurity awareness and compliance. The review emphasizes the need for institutions to invest in resources, tools, and training to address control gaps and ensure effective risk management. Overall, this research contributes to a deeper understanding of how control deficiencies impact cybersecurity governance and regulatory compliance, offering actionable insights for financial institutions to enhance their resilience against evolving cyber threats. Enhancing in: A on Control.

Amid a global economy increasingly subject to regulation, organisations need to keep up with a fast-moving pace of change in compliance requirements. Industry regulators, such as those for finance, healthcare, education, and technology, are increasingly releasing new and stricter mandates with short deadlines for compliance. Historical models of compliance-oriented management have primarily focused upon questions of structural and procedural compliance that centre upon a legalistic/technical perspective of the regulatory environment. However, these efforts frequently overlook an important dimension: the individuals tasked with carrying out the regulatory reforms. Compliance work is likely to be inefficient and met with resistance and unsustainable change if members of the workforce are not educated and activated. This paper presents a human-centric approach to regulatory change management, integrating organizational change management (OCM) into regulatory compliance efforts. It utilizes the Prosci method, including the ADKAR Model, the Prosci 3-Phase Process, and the Prosci Change Triangle (PCT) Model. As described by Prosci, it is a methodical process used to react to regulatory changes by monitoring, examining, and activating changes in policies, systems, and behaviour within an organization. However, the paper suggests that successful RCM goes beyond simply reacting to policy and procedure updates. Instead, what is required is a deliberate change management plan based on human-centered design and stakeholder buy-in. The ADKAR framework, which focuses on the personal transition of individuals through five stages: Awareness, Desire, Knowledge, Ability, and Reinforcement, is a key foundation model for engaging employees to accept and sustain regulatory changes. By approaching change with an understanding of the technology and people side, companies can embed compliance into culture, eliminate pushback, and increase adoption. This research synthesizes real-world examples and empirical evidence collected from highly regulated institutions that have a history of structured change management. For example, SURA, a Latin American financial institution, accelerated digital compliance, requiring six months less than the competition by adopting the methods of Prosci. Microsoft’s Investor Relations team leveraged a 50-step change plan to influence complex earnings release procedures with pinpoint accuracy. At the same time, Velera trained in-house change practitioners to create sustainable compliance skill sets across teams. The onus is on such examples not only to show that structured change management can lower compliance risk, but also that it improves business agility, operational efficiency, and employee morale. In this paper, we also uncover the top challenges faced by organisations when dealing with regulatory change, including: the speed of legislative change, cross-functional complexity, and employee confusion. In the absence of centralized visibility, clear communication, and leadership involvement, organizations end up lagging in their response, which puts them at even more legal, financial, and reputational risk. In this paper, the approach described addresses these challenges by prescribing a multi-layered governance model that integrates compliance management with enterprise-wide change enablement, risk assessments, and leadership-led communications. The results reveal that organizations that have developed sophisticated change management capabilities are much less likely to miss their regulatory targets. The findings reported would encourage embedding change management maturity assessments, such as the Prosci Change Management Maturity Model, in the design and enactment of enforcement programs to prepare and react appropriately. The long-term implications to the organization of treating regulatory compliance as a business change project and not simply a legal requirement are explored in the discussion section. This paper argues for the incorporation of change management into the compliance lifecycle itself, rather than as the mere underpinning and support. Organizations can move beyond a reactive compliance approach to one that is sustainable, proactive, and resilient by aligning compliance strategies with the people it is meant to influence. Regulatory Change will still be a fact of life, but resistance, if not confusion and chaos, does not have to be. By focusing on a disciplined, people-first journey driven by proven change management methodologies, intermediate institutions can succeed within the current regulatory uncertainty and challenges.

This paper seeks to understand the transmission and reception of legal rules as a component of the regulatory compliance process. It adopts a frontline approach (Almond and Gray 2017) to regulatory compliance that traces the grassroot functioning of compliance processes from regulator, to compliance managers to individual employees. Through a multilevel and multi-sited ethnography of worker safety protection in Chinese construction industry, this paper shows that in the cases studied there is a fundamental disconnect in the transmission and reception of law from regulator to organization and within the regulated organization. Yet at the same time, the paper finds that employees did comply with the law, and that thus compliance can exist without a full transmission and reception of legal rules into and within the regulated organization. By expanding the frontline approach to study regulation and compliance to look at the grassroots operation across three different frontlines, this study has been able to assess the legal assumptions inherent in existing regulatory compliance research. Not only does it find that compliance in these cases was not a top-down process and that we need to look at the grassroots operation inside organizations, it also shows that law does not always play a central role in regulatory compliance and that we need to reassess the implicit focus on law in regulatory compliance scholarship.

The oil and gas industry operates in a complex and highly regulated environment where ethical considerations and legal compliance are paramount. This paper proposes an Ethical and Legal Project Management Framework specifically designed for the oil and gas sector, aiming to enhance project execution while ensuring adherence to ethical standards and legal requirements. The framework integrates ethical principles with legal obligations, fostering a culture of integrity and accountability within organizations. At its core, the framework emphasizes the identification and assessment of ethical risks throughout the project lifecycle. By incorporating ethical risk management into project planning and execution, organizations can proactively address potential ethical dilemmas, thus minimizing the risk of legal issues and reputational damage. Key components include stakeholder analysis, transparency in decision-making, and mechanisms for reporting unethical behavior. Legal compliance is another critical element of the framework. The oil and gas industry is subject to a myriad of local, national, and international regulations. The framework outlines best practices for ensuring compliance with environmental laws, labor regulations, and health and safety standards. This involves regular legal audits, staff training, and the establishment of compliance protocols to keep pace with evolving legal requirements. Furthermore, the framework highlights the importance of stakeholder engagement in promoting ethical and legal practices. Engaging with local communities, regulatory bodies, and internal stakeholders ensures that diverse perspectives are considered, enhancing decision-making processes and fostering trust. In addition, the integration of technology and data analytics plays a crucial role in supporting ethical and legal project management. By utilizing advanced tools for monitoring compliance and ethical conduct, organizations can enhance transparency and accountability. In conclusion, the Ethical and Legal Project Management Framework serves as a comprehensive guide for oil and gas companies striving to balance project efficiency with ethical integrity and legal compliance. By embedding these principles into their project management practices, organizations can achieve sustainable success in a challenging industry landscape. Keywords: Ethical Framework, Legal Compliance, Project Management, Oil and Gas Industry, Stakeholder Engagement, Risk Management.

The financial services industry's growing complexity in terms of regulatory requirements has made compliance a top priority for organizations across the globe. With the compliance requirements implemented by regulators becoming more stringent, financial institutions are continuously opting for software products to enable and support their compliance processes. This research explores the role that software plays in helping financial institutions comply with regulatory requirements, focusing on specific categories of compliance software, their operational competencies, and the benefits each category offers. It also discusses the difficulties encountered by financial institutions in implementing these tools, as well as the future of RegTech. This research clearly explains the added value of embedding technology in the evolving world of regulation by exploring the potential for streamlining efficiency, accuracy, and transparency through software solutions in fulfillment of compliance needs.

In the modern era of digital transformation in the financial sector, the role of banking compliance in ensuring the legality and transparency of transactions is growing. In particular, operations with virtual assets, which are becoming increasingly widespread, pose new challenges for banks related to customer identification, money laundering risk management, terrorist financing, and regulatory compliance. The lack of unified global regulatory standards, along with rapid technological changes in cryptocurrencies and blockchain technologies, complicates the adaptation process of banking institutions to the new realities of the financial market. Banking compliance for virtual asset transactions covers a wide range of measures aimed at transaction monitoring, risk analysis, and the development of effective compliance policies. Implementing such measures requires banks not only to integrate advanced technological solutions but also to closely cooperate with regulatory authorities to prevent violations in financial monitoring and sanctions control. The relevance of this topic is due to the fact that banking institutions, as key participants in the financial system, play an important role in ensuring the stability and reliability of financial flows. Insufficient control in the field of operations with virtual assets can lead to significant legal, financial and reputational risks, as well as increased vulnerability of banks to fraudulent schemes. At the same time, effective regulation of this segment contributes to the creation of a transparent and safe environment for the use of virtual assets in banking. This study examines the key challenges and prospects of compliance in the field of banking operations with virtual assets. Special attention is given to the analysis of modern regulatory initiatives, the role of compliance departments in banks, and the implementation of technological solutions for automating compliance processes. The study of these aspects will help assess best practices and identify possible ways to improve banking compliance in the rapidly digitalizing financial market.

In line with TOTAL’S commitment for Respecting Laws and Regulations, TOTAL E&P INDONESIE (TEPI or the so-called COMPANY) management decided to implement a system to manage Permit and improvement to existing condition of Regulatory Compliance. The system is called Permit Management System and Regulation Compliance (PMS RC). The system is designed to ensure regulatory compliance and on time awarding of Permit required for the affiliate operations, in accordance with local and national Regulations. PMS RC provides Regulation and Permit data base complete with its compliance status, accessible to authorized users in a friendly manner. This paper is made to describe the background and benefit as well as the mechanism on how the COMPANY runs PMS RC. PMS RC is a complete management system which more than just a database in the computer, is a series of compliance processes such as Applicability Review, Compliance Assessment, Risk Assessment and Task Management. PMS RC's final goal is to ensure the sustainability of the compliance with respect to the applicable law, Regulations and Permit requirement within COMPANY. It minimizes the risk of operation disturbance by assuring Permit granted on time, compliance with the Regulation's requirement and preventing violation of the law and Regulations that leads to an incident. The implementation of PMS RC safeguards the proper application of the relevant Regulation in COMPANY's operations. As a consequence it reduces the risks of incompliance and possible operational, financial, and legal consequences. This system is a guideline for Line Management and related entities to review and evaluate the applicable and updated Regulation and Permit compliance status regularly. The implementation of this procedure also helps in reducing incompliance status by implementing corrective actions with risk-based priority to the entity which is not yet in compliance. This Project was triggered by: First, the difficulties faced when running a very complex set of facilities, for which it is critical to ensure compliance with numerous applicable Regulations and also, these Regulations require hundreds of Permits that have to be delivered on time. The second trigger is from the HSE Management System which rightly insists on having a robust system by respecting Laws and Regulations. The third trigger is intensive law enforcement by authorizing body in particularly from Environmental Ministry, Forestry, Oil & Gas Authorities and more over by Local Government where the operational fields are located. During the establishment of the system, joint project was formed with representatives from various entities, such as Health Safety and Environment (HSE), Information System and Telecom (IST), Marine and Logistic Operation (MLO) and Legal (LEG). The final goal of the PMS RC system is having zero disturbances to operations and legal safeguard by ensuring that the Regulations are complied and all Permits are available in due time.

The rapid expansion and creativity in fintech have disrupted the financial services space by providing faster, more accessible, and consumer-driven solutions. But the shift comes with growing, difficult and expensive regulatory hurdles that stifle fintech. Good leadership can make or break this regulatory maze in a way that doesn't stifle innovation. This article focuses on the leadership approaches needed to address regulatory compliance in fintech innovation. It stresses the importance of engaging regulators from the very beginning to anticipate, communicate and influence the development of regulation. Secondly, it emphasizes the merit of fostering a strong organizational culture that promotes compliance, ethical behavior, and risk consciousness at all levels within the firm. The adoption of innovative compliance technologies, including automated monitoring and AI/advanced analytics, is also assessed as a way to improve regulatory compliance and be agile. By way of case studies and best practices, the report offers tangible frameworks that fintech CEOs and leadership can utilize to balance innovation and regulatory needs thoroughly. In the end, investing in these leadership levers equips fintech to offset legal and reputational risks, maintain a competitive edge and secure long-term viability in a fast-changing financial world.