Compliance articles and resources

Employees do not read compliance policies because the policies are hard to find, too long, written in legal language and scattered across PDFs, email attachments and shared folders, not because they do not care. The fix is not another document: put every policy in one place that works on any device, lead with the rule itself, give guidance instead of text, and measure who has actually read and understood it.

The SFO evidence test is simple: a written anti-fraud policy that nobody is trained on, that is not monitored and that leaves no record of its own operation will not satisfy the reasonable procedures defence under section 199 of the ECCTA, in force since 1 September 2025. What protects an organisation is evidence that the procedure runs: training records, monitoring, reporting channels and documented follow-up.

Policy management compliance means proving that policies are followed, current and applied consistently, not that they exist. Regulators now look at three things most organisations cannot see: whether employees actually access the policies, whether everyone works from the latest approved version, and whether teams apply them the same way. Closing those gaps needs distribution, version control and read confirmation, not more documents.

The last mile of compliance is the gap between writing a policy and getting it into the hands of the people who make decisions every day. Most compliance failures happen there: the policy exists, but employees never see it, cannot find it or do not understand it. Closing the gap means distributing policies digitally to every device, confirming they were read and measuring who engages with them.

Venture capital funds price product, market and founder risk carefully but leave portfolio compliance unpriced. Failing to mandate a code of conduct, training and a whistleblowing channel across portfolio companies is a fiduciary risk: regulators apply failure-to-prevent standards to systems and evidence, governance failures derail exits and valuations, and without policies and records there is nothing to defend with. The fix is a light portfolio-wide governance floor.