Short answer
Regulatory compliance translates applicable requirements into documented controls, evidence, and timely reporting. The ladder assesses traceable compliance work without promising that an organization will avoid every violation.
About Regulatory compliance
Translates applicable requirements into documented controls, evidence, and timely reporting. The competency supports an organization's compliance process but does not guarantee compliance or replace qualified interpretation.
Use this competency for
- Roles that map applicable requirements to controls, evidence, monitoring, or reporting.
- Functions accountable for compliance obligations, control testing, findings, or remediation tracking.
Do not use this competency for
- Roles that follow a control but do not interpret, monitor, test, or report compliance requirements.
Important distinctions
Contract review
Contract review evaluates obligations in a proposed agreement. Regulatory compliance addresses requirements imposed by applicable regulatory sources.
Risk management
Risk management prioritizes uncertainty and exposure. Regulatory compliance traces applicable requirements to controls, evidence, findings, and reporting.
Expectations by level
IC1
Maintains compliance evidence
Completes defined compliance tasks with guidance, follows current control and evidence instructions, and records gaps without changing the meaning of the source requirement.
Observable behaviors
- Collects evidence against the named control and period.
- Records missing or inconsistent evidence through the defined process.
- Keeps source, control, owner, and status linked in the record.
Examples
- Matched a required approval sample to the control record and noted one missing item.
- Escalated an overdue filing input with the owner and due date recorded.
IC2
Operates compliance controls
Independently maps requirements to controls for a defined area, evaluates ambiguous evidence, and coordinates findings and remediation with accountable owners.
Observable behaviors
- Documents the link between a requirement, control, and evidence.
- Tests whether evidence supports the stated control operation.
- Tracks findings to a dated resolution or accepted decision.
Examples
- Found that a control description did not match the actual approval workflow and opened remediation.
- Prepared a required report from verified inputs and documented unresolved assumptions.
IC3
Designs compliance programs
Defines compliance methods across business areas, frames unfamiliar requirements for specialist decision, and sets control and reporting standards that teams can operate.
Observable behaviors
- Defines requirement mapping, control ownership, and evidence standards.
- Reviews interacting requirements and records interpretation dependencies.
- Uses findings and regulatory change evidence to prioritize program updates.
Examples
- Introduced one control library after duplicate controls produced conflicting evidence.
- Coordinated a new reporting requirement across teams with named interpretations and owners.