The elements of a compliance programme

1. Regulatory Concept & Core Standards

This video's topic is the elements of a compliance programme. By the end, you should be able to connect risk assessment, conduct rules, training and reporting. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. Prevention connects risks, conduct, controls and reporting. Assess the scope of the Estonian reporting Act separately from the Anti-Corruption Act. Risk-management examples are recommended methods. Each legal duty needs its own source and an assessment of the organisation’s role.

Risk assessment identifies controls, conduct rules guide decisions, training practises application and the channel may reveal weaknesses. This is a recommended management model. KVS section 3(3) imposes specified awareness and oversight duties for public functions, but does not make the entire model mandatory for every company.

Apply the following rule: Section 13 requires reasonable grounds at reporting to believe that a breach has directly begun or been completed and falls within scope. Do not automatically extend this to every hypothetical future concern. KVS primarily addresses public functions and contains specific corruption-reporting provisions. Portuguese RGPC is not Estonian law. Risk matrices, internal plans and teaching methods are recommendations unless a specific legal duty is identified.

2. Practical Implementation & Procedure

Trace one supplier-selection risk through its control, rule and training example. Check whether staff can report concerns. Define how case findings inform prevention without unnecessary identification. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An organisation uses selection criteria, interest declarations and procurement training. A report alleges that criteria were bypassed. The outcome may show that approval controls need improvement. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: What is missing when a published code exists but staff cannot find the channel? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

The link between the rule and a usable procedure. Improve access and guidance, then check actual use. Documents alone do not demonstrate operation.

One mistake to avoid is: equating a collection of documents with functioning prevention.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should it correct the claim?

Separate actual Estonian duties, their scope and recommended management methods. KVS public-function duties do not automatically apply to every private company. Each duty needs a source, while each internal choice needs a purpose, owner and evidence. Portuguese RGPC does not replace Estonian law.