What is compliance? In short, compliance means that a company meets the requirements it is subject to or has committed to follow. These may include legislation, regulatory requirements, EU regulations, standards, customer requirements, contracts, and internal policies.
Compliance is therefore not only about understanding the rules. The company must also translate relevant requirements into responsibilities, workflows, and controls – and follow up to ensure that the requirements are actually being met.
For Danish companies, compliance may cover everything from personal data and occupational health and safety to information security, quality, environmental matters, and industry-specific requirements. Which requirements are relevant depends, among other things, on the company’s activities, size, customers, markets, and its own commitments.
Consulting & System
Do you need help turning requirements into practice?
Learn more about how we help companies with structured compliance consulting, or try our management system for free.
What Does Compliance Mean?
The direct meaning of compliance is adherence or conformity. In a business context, the term describes the process of identifying relevant requirements and ensuring that the company operates in accordance with them.
The question “What is compliance?” therefore cannot be answered with one fixed list of requirements that applies to every company.
Requirements may come from different sources:
- Danish legislation and regulatory requirements
- EU Regulations
- International and National Standards
- Industry Requirements
- Certification Requirements
- Contractual Requirements from Customers and Business Partners
- Internal Policies and Procedures
- Ethical Guidelines and Codes of Conduct
The relevant compliance requirements depend on the company’s specific situation.
A simple compliance example could be a requirement for regular inspection of specific production equipment.
The requirement describes what the company must ensure.
The practical action is that a responsible employee carries out the inspection according to the established procedure.
The documentation may show when the inspection was performed, who carried it out, what the result was, and how any issues were handled.
In this way, requirements, actions, and documentation are connected.
What Does It Mean to Be Compliant?
Being compliant means that a company meets a specific requirement or a relevant set of requirements at a given point in time.
It is important to distinguish between compliance as an ongoing discipline and being compliant with a specific requirement.
For example, a company may be able to document that a particular process meets a current requirement. However, this does not mean that compliance is permanently ensured.
Requirements can change. The same applies to the company’s products, organization, suppliers, IT systems, employees, and risks. A workflow that works today may therefore need to be adjusted later.
Compliance in companies requires ongoing attention. Among other things, the company must monitor relevant changes, verify that processes are working as intended, and respond when errors or non-conformities occur.
Examples of Compliance in Danish Companies
Many people searching for an answer to the question “What is compliance?” are especially looking for practical examples from day-to-day business operations. The following situations show how different types of requirements can be translated into practical actions and follow-up.
GDPR and Personal Data
A company that processes personal data must have a lawful basis for the processing and comply with the relevant data protection rules.
Consent is not the only possible legal basis for processing. The appropriate legal basis depends on the specific processing activity and the applicable rules. The Danish Data Protection Agency describes several possible legal bases for processing personal data.
Read the Danish Data Protection Agency’s official guidance on the processing of personal data.
- Why Personal Data Is Processed
- Who Has Access to Specific Information
- How Information Is Protected
- How Requests from Data Subjects Are Handled
- Who Is Responsible for the Relevant Processes
Documentation and follow-up may include descriptions of processing activities, access procedures, areas of responsibility, and records of relevant actions.
Whistleblower Scheme
As a general rule, workplaces with 50 or more employees must have an internal whistleblower scheme. The Danish National Whistleblower Scheme describes this threshold and the general reporting options available.
In practice, the company must establish a process in which relevant reports can be received and handled. This requires clearly defined responsibilities and an understandable process for the people who may use the scheme.
Documentation and follow-up depend on the specific scheme and the requirements that apply to the company.
Learn more about a whistleblower scheme from MasterQMS.
Occupational Health and Safety and Workplace Assessment
All workplaces with employees must carry out a workplace assessment. The Danish Working Environment Authority describes this as a process for systematically identifying working environment conditions and addressing any issues that are identified.
Read more from the Danish Working Environment Authority about workplace assessment requirements.
In practice, the company assesses relevant conditions within both the physical and psychosocial working environment. Identified issues must then be addressed, responsibilities assigned, and relevant actions followed up.
Documentation may, for example, include assessments, action plans, allocation of responsibilities, and follow-up on identified occupational health and safety issues.
ISO 9001 and Quality Management
ISO 9001 is an international standard for quality management systems. ISO describes the standard as a framework containing requirements for establishing, implementing, maintaining, and continually improving a quality management system.
In practice, a company may work with areas such as:
- Quality Objectives
- Defined Processes
- Clear Responsibilities
- Management of Non-Conformities
- Follow-Up on Results
- Continual Improvement
Documentation and follow-up should support the company’s specific management system. This may include documented processes, records, follow-up on non-conformities, and evaluation of implemented improvement actions.
ISO 27001 and Information Security
ISO 27001 is a standard for information security management. ISO describes ISO/IEC 27001 as a standard that specifies requirements for an Information Security Management System (ISMS).
In practice, a company may identify information security risks, assess them, and plan appropriate risk treatment.
This may lead to security controls in areas such as access control. The relevant controls should be considered in the context of the organization, its risks, and its needs – rather than as isolated activities.
The documentation may include risk assessments, decisions on risk treatment, areas of responsibility, relevant controls, and follow-up on incidents or identified weaknesses.
Who Is Responsible for Compliance?
An important part of answering the question “What is compliance?” concerns responsibility. Who is responsible for ensuring that relevant requirements are identified, translated into action, and followed up?
The answer depends on the company’s size, industry, risk profile, and organizational structure.
In some companies, a compliance manager or Chief Compliance Officer coordinates the work. In others, quality managers, QHSE/HSEQ professionals, information security managers, or a CISO may play central roles.
In the area of data protection, a DPO may have a specific role when the company is required to appoint a Data Protection Officer.
The key point is that compliance is not simply an administrative task for one person.
Management sets the direction, allocates resources, and assigns responsibilities.
Subject matter experts translate requirements into relevant processes and controls.
Managers and process owners follow up within their respective areas.
Employees comply with the relevant requirements and workflows in their day-to-day work.
Clear compliance responsibility therefore does not mean that everyone has the same tasks. It means that roles, decision-making authority, and responsibility for follow-up are clearly defined.
What Is Non-Compliance?
Non-compliance means failure to meet a relevant requirement.
This may, for example, occur when:
- an established procedure is not followed
- documentation is missing or outdated
- a registered non-conformity is not followed up
- a relevant requirement is not implemented
- an agreed control is not carried out
- responsibility for a task is unclear
- a process operates differently in practice than described
The consequences depend on the nature of the requirement and the seriousness of the situation.
Non-compliance can lead to operational issues, repeated errors, loss of customer trust, or contractual consequences. During an audit, failure to meet requirements may result in recorded non-conformities and the need for corrective actions. Where legislation is involved, any regulatory response will depend on the specific legal framework and the circumstances of the case.
The purpose of compliance work is not to create the impression that errors can never occur. An effective compliance approach should also help the company identify problems, understand their causes, and follow up on them.
Compliance, Management, and Risk Management – What Is the Difference?
Compliance, management, and risk management are closely related, but the terms describe different aspects of how a company is governed and controlled.
Management
Management concerns how the company is directed and controlled. This includes areas such as allocation of responsibilities, decision-making authority, oversight, and control.
Risk management
Risk management concerns how the company identifies, assesses, prioritizes, and manages risks and uncertainties.
Compliance
Compliance is about identifying relevant requirements and working systematically to meet and document them.
Example
A company identifies a new requirement that affects a key process.
The management structure determines who owns the responsibility and has the authority to make decisions.
Risk management helps assess the consequences of non-compliance and prioritize the necessary actions.
The compliance process then translates the requirement into concrete actions, responsibilities, controls, documentation, and follow-up.
The three areas therefore overlap, but they are not the same.
Why Is Documentation Important for Compliance?
Compliance requires more than having a policy or rule in a document.
There is a difference between:
- having a rule
- having a documented procedure
- following the procedure in practice
- being able to document that relevant activities have been completed
- following up when something does not work
Good documentation creates traceability. The company can see what has been decided, who is responsible, which version of a document is current, and whether the necessary activities have been completed.
At the same time, documentation is only valuable when it reflects actual practice. A procedure that no one follows does not, in itself, create compliance.
This is why documentation is closely linked to follow-up. Non-conformities should be assessed, and relevant corrective actions should have clearly assigned responsibility. The company should then follow up to determine whether the actions have resolved the issue.
An internal audit can be a relevant method for systematically assessing whether processes and workflows operate as described and in accordance with the criteria against which the audit is conducted.
7 Organizational Principles
Compliance works best when it is integrated into day-to-day operations. The following principles can provide a strong foundation.
1. Create an Overview of Relevant Requirements
Identify the requirements that apply to your company, activities, and processes. At the same time, assess which parts of the organization each requirement affects.
An overview of requirements has limited value if no one understands how those requirements affect day-to-day work.
2. Assign Clear Responsibilities
It should be clear who owns a requirement or area, who carries out the specific actions, and who is responsible for follow-up.
Unclear responsibilities increase the risk that necessary tasks fall between different areas of the organization.
3. Translate Requirements into Clear Workflows
Employees need to understand what the requirements mean for their specific work.
A legal text, contract, or standard is rarely a practical work instruction in itself. Requirements should therefore be translated into workflows that fit the organization’s day-to-day reality.
4. Keep Documentation Up to Date and Accessible
Procedures and instructions should reflect current practices.
Employees must also be able to find the information relevant to their tasks, so that outdated or parallel versions do not create confusion.
5. Make Employees Aware of Their Responsibilities
Information, training, and ongoing communication should be tailored to employees’ roles.
Not everyone needs to know every requirement that applies to the company. Instead, employees should understand the requirements and workflows that are relevant to their own responsibilities.
6. ollow Up on Errors, Non-Conformities, and Risks
Recording a problem is only the first step.
The company should assess the causes, responsibilities, and need for action. It should then follow up to determine whether the chosen action has had the intended effect.
7. Review Changes on an Ongoing Basis
New regulations are not the only reason to revisit compliance work.
New products, markets, suppliers, employees, technologies, and processes can also affect the company’s requirements and risks.
From Requirements to Practical Compliance
The answer to the question “What is compliance?” ultimately involves more than simply knowing the rules. Compliance should create a clear connection between requirements, responsibilities, workflows, documentation, and follow-up.
This does not mean that compliance should become an isolated activity alongside day-to-day operations. On the contrary, relevant requirements should be integrated into the processes and decisions the company already works with.
For compliance to work in practice, there must be a clear connection between requirements, responsibilities, and follow-up. Get professional compliance consulting and learn how we can help you achieve your goals.
Frequently Asked Questions About Compliance
What Does Compliance Mean in Danish?
Compliance is typically translated into Danish as “efterlevelse” or “overholdelse.” In a business context, the term refers to the work involved in identifying and meeting relevant requirements. These requirements may come from legislation, regulatory authorities, standards, customers, contracts, or the company’s own policies.
What Does Compliant Mean?
Being compliant means meeting a specific requirement or a relevant set of requirements. The term should not be understood as a permanent status. Requirements and business activities may change, which means that continued compliance requires ongoing follow-up.
Who Is Responsible for Compliance in a Company?
Management plays a central role in setting direction, allocating resources, and assigning responsibilities. The practical work may be distributed across compliance managers, quality functions, QHSE/HSEQ, information security, process owners, and managers. Employees must also follow the requirements and workflows that apply to their own tasks.
Is Compliance Only Relevant for Large Companies?
No. Companies may be subject to relevant requirements regardless of size. However, the specific requirements and the need for formalization will vary. A smaller company may have fewer specialized roles, but it must still identify and comply with the requirements that apply to its activities.
What Is the Difference Between Compliance and Management?
Management concerns the company’s overall governance, responsibilities, decision-making processes, and controls. Compliance focuses on identifying and meeting relevant requirements. Management therefore provides part of the framework for responsibilities and decisions, while compliance work focuses on actual adherence to those requirements.
What Is Non-Compliance?
Non-compliance means failure to meet a relevant requirement. This may involve a procedure that is not followed, a control that is not carried out, missing documentation, or a requirement that has not been implemented in practice. The consequences depend on the nature of the requirement and the extent of the non-compliance.
Can a Company Be Compliant Without Documentation?
That depends on the specific requirement. Some requirements include explicit documentation obligations. In practice, however, relevant documentation is often important for creating traceability, following up on activities, and demonstrating how the company works with compliance.
How Does the System Handle Errors or Non-Conformities in Day-to-Day Operations?
When errors occur, they can be registered in the MasterQMS non-conformity management system. The system helps you monitor risks so you can respond quickly. You can create specific action plans, carry out risk and opportunity assessments, and register improvement proposals directly in the platform. This helps prevent recurring issues and supports continual improvement of your compliance efforts.
