Compliance by design
Compliance by design means building regulatory and policy requirements into products, processes and systems when they are designed or changed, rather than checking afterwards.
Compliance by design treats requirements as design inputs. Each new product, process change or system release starts from the applicable requirements and ends with the controls and evidence that demonstrate them. It is a working principle rather than a defined regulatory term, but supervisors anchor it in change processes.
MaRisk requires the risk control function, the compliance function and internal audit to be involved in the new-product process and before material changes to the organisation or to ICT systems. FINMA Circular 2023/1 requires ad hoc risk and control assessments before major changes in products, activities, processes and systems. For executives, the benefit is less remediation after launch and fewer findings that require costly rework.
Pitfalls are a compliance sign-off at the end of a project when design choices are already fixed, requirements that are not traceable to tests, automated controls that nobody owns, and agile delivery without a defined point at which compliance is assessed.
In practice
- 01Makes the compliance and risk assessment a mandatory gate in new-product and change processes.
- 02Translates applicable requirements into testable acceptance criteria and controls before development starts.
- 03Prefers automated, preventive controls embedded in systems over manual checks after the fact.
- 04Keeps traceability from each requirement to the design decision, control and test evidence.
How MRM-Solution supports it
- 01Generate policies from the modelled processes, so roles and responsibilities in the text match how the work is actually done.
- 02See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com