What is compliance? The term refers to adherence to all laws, regulations, contracts, and self-imposed rules that apply to a company and its employees. The German term for this is regulatory compliance or rule adherence. Compliance therefore encompasses both the observance of external requirements—such as those from data protection, labor, or competition law—and adherence to internal guidelines, such as a code of conduct.
The term describes not only a state of being, but also the entirety of organizational measures a company uses to ensure that rules are known and followed. This includes policies, training, controls, and reporting channels.
Several established terms have emerged around the topic of compliance. Regulatory compliance and rule adherence are the common translations and are usually used synonymously.
The legal duty describes the management's responsibility to ensure the company acts lawfully. It is derived from the general management and due diligence responsibilities of corporate bodies—such as the duty of care of a diligent and conscientious manager under the Stock Corporation Act or the duty of care of a managing director under the Limited Liability Companies Act. For management, compliance is therefore not a voluntary extra task, but part of their organizational responsibility. Additionally, Section 130 of the Regulatory Offences Act (OWiG) governs the operational supervisory duty of business owners and management—this provision is one of the central legal reasons why companies establish systematic compliance management.
GRC stands for Governance, Risk, and Compliance. The term combines corporate governance, risk management, and regulatory compliance as three closely integrated management disciplines that are considered together in many organizations.
Compliance organizes a broad field of mandatory topics that would otherwise exist side by side. Data protection, information security, anti-money laundering, occupational health and safety, the protection of whistleblowers under the Whistleblower Protection Act and the prohibition of discrimination based on the characteristics mentioned in Section 1 of the General Act on Equal Treatment (AGG) are typical sub-areas – each with its own rules and often its own training requirements. A systematic compliance approach bundles these topics, assigns responsibilities, and makes rules understandable in everyday work.
For small and medium-sized enterprises and public administration, it is less about a massive set of rules and more about knowing the relevant obligations, regularly raising awareness among employees, and being able to document compliance.
Larger organizations structure their compliance through a Compliance Management System, or CMS for short. This is the organizational framework of principles, goals, responsibilities, and measures for ensuring regulatory compliance.
Two standards shape the German-speaking region. The international standard ISO 37301:2021 describes requirements for a compliance management system and is certifiable. The auditing standard IDW PS 980 the Institute of Public Auditors sets out principles for auditing such systems and identifies the compliance culture as a fundamental pillar. Both standards serve as frameworks for guidance – their application is not mandatory. You can find an overview of other compliance topics in the compliance section of the Bridgly Knowledge Base.
Compliance means that a company adheres to all laws, regulations, and internal policies applicable to it. It refers to both the state of rule-abiding behavior and the organizational measures—such as policies, training, and controls—that a company uses to ensure that rules are known and followed.
Compliance is the adherence to laws and internal rules. GRC stands for Governance, Risk, and Compliance and describes the overarching interaction between corporate management, risk management, and regulatory adherence as three closely linked management disciplines that are often considered and managed together in many organizations. Compliance is therefore an important component of GRC, not a replacement or synonym for it.
Responsibility lies primarily with the management: their duty of legality—for example, under Section 93 of the German Stock Corporation Act (AktG) or Section 43 of the German Limited Liability Companies Act (GmbHG)—entails the obligation to ensure lawful conduct throughout the entire company. In larger organizations, this task is additionally organized and documented through a Compliance Management System, designated compliance functions, and regular training for all employees.
Compliance includes, among other things, data protection, information security, anti-money laundering, occupational health and safety, whistleblower protection under the Whistleblower Protection Act, and the prohibition of discrimination under the General Act on Equal Treatment. Each of these areas brings its own rules, often including specific training and documentation requirements for employees, which a company-wide Compliance Management System consolidates and makes transparent in day-to-day operations.
Insights into the future of digital learning, with a focus on AI, compliance, and modern training solutions. Discover the latest posts and articles to gain practical insights into legally compliant, efficient, and automated corporate training.
Audit-proof, simple, and tailored training and professional development.
We support the IHK initiative "Pack ma's digital" to help businesses in Upper Bavaria with digitalization and secure the future of the region.Note: Some text, images, and videos on this website were generated using artificial intelligence.
All content is for informational purposes and has been carefully reviewed from a journalistic perspective, but does not claim to be exhaustive or legally binding.
