To analyze the key elements of a Management System Compliance (hereinafter, SGC), we must start from the definition of the SGC itself, that is, “a set of practices that help prevent, detect and manage the risks associated with regulatory compliance that affect an organization.”
- First of all, it is important to know that a effective QMS must be built on a solid foundation of ethics and integrity fully supported by senior management, who must have and show commitment to compliance with the law and the values assumed internally in a sustained manner over time.
- On the other hand, according to the standard UNE ISO 19600 of Management Systems Compliance (soon to be replaced by ISO 37301), the organization should determine and provide the necessary resources (financial, technological and human) for the establishment, development, implementation, evaluation, maintenance and continuous improvement of the QMS in accordance with the determined parameters during the exercise of understanding the organization and its context.
Fundamental elements of a QMS
This designation of resources is essential so that a correct identification of the compliance risks that must be addressed can be carried out within the organization. analyzed, evaluated and reviewed. In summary, we are talking about good detection and management of the risks of Compliance with the objective of establishing the appropriate control measures that allow preventing and deterring inappropriate behavior that may pose possible risks to the organization.
As a consequence, the next essential element of a QMS is the implementation of control mechanisms. After the identification of non-compliance risks, it is necessary to identify and establish controls to try to mitigate or, at least detect, these risks within a reasonable period of time.
In summary, controls serve to manage risks and the control function Compliance can detect whether certain processes or employees are carrying out their activity in parallel with the regulations and values assumed by the company.
In another order of ideas, the organization must focus on the training, awareness and communication. The organization must promote training among all its employees in matters of Compliance, so adequate, effective and proportionate to the organization and jobs. Awareness campaigns will also be necessary, as well as the establishment of communications that contain the expectations that the organization has regarding the culture of compliance. With the aim that the SGC do not lose effectiveness and do not become obsolete in the short term, it is essential that the organization monitors the QMS, that is, measures the adequacy and effectiveness of the QMS, through supervision and verification.
Lastly, the organization must also establish a disciplinary system that imposes punishments to those employees who fail to comply with the organization's policies and procedures, in a manner proportionate to the non-compliance or infraction committed.
