Compliance Training Management

POSH complaints in India jumped from 71 in 2013-14 to 1,160 in 2022-23, across just 300 listed companies (Centre for Economic Data & Analysis, Ashoka University). That’s a 620% increase in a decade. It might sound like progress in reporting. But after four decades in HR, I can tell you this: The real danger isn’t what’s reported. It’s what’s endured in silence. Because 75% of workplace harassment incidents still go unreported. The real story isn’t in annual compliance reports. It’s in the things people whisper about but never file. + An intern who never came back after her first project. + A series of small, humiliating jokes that weren’t funny. + Proximity that felt off and power plays disguised as feedback. And what makes it worse is that the burden of avoidance is almost always on the person being harassed. Avoid that corridor. Decline that meeting. Smile through discomfort. Globally, 23% of workers experience violence or harassment at work, as per Gallup. But 55% never report it to anyone. That gap between what happens and what gets reported isn’t just a statistic. It’s a leadership failure. We’ve built systems that are excellent at documenting problems, but terrible at preventing them. And while companies lose millions in productivity, we keep treating symptoms instead of fixing the culture. Zero complaints doesn’t mean zero harassment. It means zero psychological safety. Real POSH isn’t about perfect paperwork. It’s about building cultures where speaking up doesn’t feel career-ending and where bystanders become allies, not silent witnesses. So what can you do? ✔️ Train your managers to spot early signs of discomfort ✔️ Create safe, informal channels to raise concerns ✔️ Make your leadership accountable, not just compliant Because at the end of the day, silence isn’t a sign of safety. It’s a symptom of fear. And any culture that counts silence as success is complicit. #poshawareness #thoughtleadership

Compliance isn’t choosing one framework, it’s understanding how they work together. Many organizations view SOC 2, ISO 27001, and GDPR as competing obligations, but the reality is far more integrated. SOC 2 validates data security controls for US-based service providers voluntary but expected by enterprise clients. ISO 27001 provides a globally recognized ISMS foundation with comprehensive risk management and continuous improvement. GDPR legally enforces personal data protection for EU citizens with significant financial penalties for non-compliance. The strategic advantage lies in their overlap: access controls, incident response, vendor risk management, encryption, and breach notification requirements align across all three. Organizations that map controls once and satisfy multiple frameworks simultaneously reduce audit fatigue while strengthening their overall security posture. Rather than treating compliance as separate silos, mature GRC programs build unified control environments that address shared requirements, turning regulatory burden into operational excellence. What’s your approach to managing overlapping compliance frameworks? #GRC #SOC2 #ISO27001 #GDPR #Compliance #InformationSecurity #DataProtection

RESPECT AT WORK | Compliance-based harassment, bullying and discrimination training typically involves defining and providing examples of prohibited potential unlawful and criminal behaviours. Not surprisingly, while this approach transfers knowledge, it does little to prevent those behaviours. Many participants fail to connect cognitively or emotionally with the content because they don't feel it's relevant to their behaviour or their experience. Other participants feel powerless to effect change in others' behaviours. Also, we know that learning and behavioural change are more likely when individuals feel they are part of the solution and not the problem—telling learners what they can do rather than what they can't. Effective respectful workplace behaviour training focuses on the underlying stereotypes and biases that devalue some individuals and groups relative to others and transfers skills for identifying and disrupting harmful beliefs whether they manifest as unconscious biases, casual sexism and racism, subtle slights of exclusion, or prohibited behaviours. While not all employees will experience or witness unlawful and criminal behaviours at work, most employees experience or witness everyday biases. When these lower-level harms are left unchecked, the harmful stereotypes and beliefs that underpin them are perpetuated. These are the same beliefs and attitudes that underpin more serious harm. The negative stereotypes that devalue women, diverse genders, or diverse sexualities that underpin a sexist or homophobic joke are the same negative stereotypes that underpin gendered and sexual violence. When employees are empowered to disrupt everyday biases, they become powerful change agents for preventing more serious harm. We support employers in preventing workplace misconduct through workplace culture reviews, risk assessment, learning and development, and employee focus groups. Email info@cultureplusconsulting.com for further information. Additional resources: Why employers need to step up: https://lnkd.in/gkNg_46R A checklist for boards: https://lnkd.in/gP8TMBzX Leadership considerations: https://lnkd.in/gFB7CvDe Identifying risks: https://lnkd.in/gvVYrDUy Managing risks: https://lnkd.in/gKSpxQu5 Evidence-based training: https://lnkd.in/gUN8cwTd and https://lnkd.in/gFB7CvDe Trauma-informed grievance processes: https://lnkd.in/gP5Z5pcc

A workplace's inaction following reports of harassment, discrimination or incivility sends a message that these behaviors are accepted and perpetrators, rather than victims, are protected. Ignoring or minimizing reports of unethical or violent behavior in the workplace leads to the creation of toxic, unsafe cultures where employees are likely to suffer from psychological distress. Employers have a responsibility to create safe workplaces for all employees. Recently, the Commission for Norms, Equity, Health, and Security in the Workplace updated the Quebec (Canada) law: Employers must now include workplace psychosocial risk factors in their prevention programs or action plans. They present six psychosocial risk factors that should be included in prevention programs: • Autonomy in decision-making • Workload • Organizational justice • Recognition at work • Support at work Implementing structures that will reduce psychological risk factors is necessary to support the creation of safe workplaces for all. We also need to ensure that structures and programs are adequately implemented and that organizations are serious about creating safe workplaces. Employees who report wrongdoing in the workplace need to be protected and supported. Creating structures and programs to reduce psychosocial risk factors will help reduce the occurrence of harassment, incivility, and discrimination in workplaces. One key element in successfully implementing such programs is the support of upper management. Indeed, if you look at all six risk factors presented above, they are all associated with upper management decisions and behaviors (giving employees autonomy, employee workload, organizational justice, employee support and recognition). It is crucial to hire and promote leaders whose values, decisions, and actions align with creating psychologically healthy workplaces to reduce the psychosocial risk factors for harassment and intimidation. Integrating psychosocial risk factors into workplace harassment prevention programs is a positive step. It will require an investment for organizations. However, these organizations will see a return on their investment. Creating a safe workplace will reduce absenteeism due to mental and physical health issues and increase employees' motivation, engagement, retention, and productivity. Seeing such changes and initiatives gives me hope that we are on the right path to creating better workplaces. Take care of yourself and the people around you 💗

The DOJ consistently says that compliance programs should be effective, data-driven, and focused on whether employees are actually learning. Yet... The standard training "data" is literally just completion data! Imagine if I asked a revenue leader how their sales team was doing and the leader said, "100% of our sales reps came to work today." I'd be furious! How can I assess effectiveness if all I have is an attendance list? Compliance leaders I chat with want to move to a data-driven approach but change management is hard, especially with clunky tech. Plus, it's tricky to know where to start– you often can't go from 0 to 60 in a quarter. In case this serves as inspiration, here are a few things Ethena customers are doing to make their compliance programs data-driven and learning-focused: 1. Employee-driven learning: One customer is asking, at the beginning of their code of conduct training, "Which topic do you want to learn more about?" and then offering a list. Employees get different training based on their selection...and no, "No training pls!" is not an option. The compliance team gets to see what issues are top of mind and then they can focus on those topics throughout the year. 2. Targeted training: Another customer is asking, "How confident are you raising bribery concerns in your team," and then analyzing the data based on department and country. They've identified the top 10 teams they are focusing their ABAC training and communications on, because prioritization is key. You don't need to move from the traditional, completion-focused model to a data-driven program all at once. But take incremental steps to layer on data that surfaces risks and lets you prioritize your efforts. And your vendor should be your thought partner, not the obstacle, in this journey! I've seen Ethena's team work magic in terms of navigating concerns like PII and LMS limitations – it can be done!

5 Operational Metrics to Check if Your GRC Program isn't Compliance Theatre Everyone has a GRC program that looks great 3 weeks per year. That works for some time but once your program is out of the honeymoon phase, you need to do something about it. Here are 5 hard metrics to help you separate real GRC programs from compliance theatre: 1. Mean Time to Remediation (MTTR) 📉 Not just how many findings you have, but how fast they get FIXED. If your average remediation time is measured in geological eras instead of days, you've built a museum of vulnerabilities, not a security program. "We'll fix it after this sprint" shouldn't mean "after the heat death of the universe." 2. Cross-Team NPS Score 📊 Ask engineering, product and sales teams: "On a scale of 1-10, how much does GRC help vs. hinder your work?" If your score is close to Arctic temperatures, congratulations – you've created a program that engineers actively avoid like security awareness training from 2023. 3. Evidence Collection Automation Percentage 🤖 What percentage of your evidence is collected through APIs vs. screenshots? If you're still sending "friendly reminders" for screenshots in 2025, you're operating a digital paperwork sweatshop with slightly better coffee. 4. Risk-to-Remediation Ratio 📈 How many risks in your register have actually resulted in implemented fixes vs. eternal "monitoring until next review"? If your risk acceptance rate matches your deployment frequency, you're running an expensive vulnerability documentation service. 5. Random Audit Readiness Score 🎯 Give yourself 24 hours to produce evidence for 10 random controls without warning. Score from 0-100%. If your score is perfect during scheduled audits but drops faster than the stock market today after a random check, you've mastered compliance theatre, not security. A GRC program can have perfect documentation and still provide very limited security value. What must-have GRC metrics do YOU use to ensure your program delivers more than just paperwork? Let me know! #GRCEngineering #SecurityCompliance #MetricsThatMatter

What is organizational responsibility in protecting employees from #bullying? 😖💔 The feeling of a bullied employee being told that "bullying is not illegal" - and hence, there is no recourse - is one of the most heartbreaking things I can think of. Yes, bullying protections in the US (which vary by state) often are insufficient for addressing bullying, especially when it occurs within the same demographic (involving people of the same gender, race, or age), as it often does - or in the cases of upward bullying. But that does not mean organizations should just sit back and let the abuse continue. Whether it is technically illegal or not, human and organizational well-being call for creating systems that prevent bullying and nip in in the bud when it does occur. I am thrilled to have been quoted in Lisa Nagele-Piazza, SHRM-SCP article that looks at both legal and organizational aspects of addressing bullying. My key suggestion for employers is to focus on structural and systemic prevention of bullying. Prevention integrated within #HumanResources and #Management systems is the key to success and creating healthy organizations. In addition, organizations can: ❗Set clear expectations and be consistent. Employers that do not consistently enforce their policies risk negatively affecting morale. Plus, inconsistencies can create legal liability. ❗Train employees. Employers may want to add anti-bullying to their harassment prevention program. Notably, some employers must already do this under state law. In California, for example, employers with at least 50 employees must include “abusive conduct” prevention as a component of their mandatory anti-harassment training. ❗Establish a reporting process. “Employers should strive to create an environment in which employees feel free to raise concerns and are confident that those concerns will be addressed,” according to the EEOC. ❗Promptly and thoroughly investigate complaints. Take complaints seriously, and consider designating an experienced person or team to conduct investigations. ❗Assess company culture. Regularly assess organizational culture to detect early signs of a toxic environment.  We can do better. Do not tolerate toxic 🛑⚠ behavior.

Risk Management in Medical Devices: More Than a Checklist In medical devices, risk management is not a one-time activity—it’s a continuous process that directly impacts patient safety and product reliability. Under ISO 14971 and aligned with ISO 13485, risk management is integrated into every stage of the product lifecycle—from design to post-market use. At its core, risk management is about answering three simple but critical questions: What can go wrong? How likely is it? And what is the impact? The process typically begins with hazard identification. This involves identifying all possible sources of harm—electrical, mechanical, biological, usability-related, or even software failures. In daily work, this often happens during design discussions, failure analysis, or even while reviewing customer complaints. Once hazards are identified, the next step is risk analysis and evaluation. Here, risks are assessed based on severity and probability. Not all risks can be eliminated, but they must be reduced to an acceptable level. This is where teams often make a mistake—accepting risks without proper justification or documentation. The most critical step is risk control. Controls can include design changes, protective measures (like alarms or insulation), or clear instructions in labeling. The priority should always be to eliminate risk through design rather than relying only on warnings or user instructions. An important but often overlooked aspect is residual risk evaluation. Even after controls are applied, some level of risk remains. This must be evaluated to ensure it is acceptable when weighed against the device’s benefits. Risk management does not stop after product release. Through post-market surveillance, real-world data such as complaints, adverse events, and user feedback must be continuously reviewed. If new risks are identified, they should feed back into the risk management file and trigger updates. In practice, risk management is closely linked with CAPA, design changes, and regulatory compliance. A poorly maintained risk file is one of the most common findings during audits. A mature organization treats risk management not as documentation, but as a decision-making tool. It guides design choices, improves product safety, and builds confidence with regulators and users. Ultimately, effective risk management ensures that innovation does not come at the cost of safety—and that every device delivered performs reliably in real-world conditions.

The era of standalone sustainability reporting is officially over 🌎 With the latest updates to the UK Sustainability Reporting Standards (UK SRS), nonfinancial data is now subject to the exact same rigorous audit scrutiny as your core financials. For C-Suite executives and Sustainability Managers across the UK, EU, and the US, this represents a fundamental shift in corporate governance. Recent geopolitical instability and energy market disruptions have made one thing clear: Understanding your environmental impact and supply chain vulnerabilities is no longer just about compliance. It is about sheer business survival and operational resilience. In my recent conversations with enterprise CFOs, the tone has completely shifted. CFOs are no longer simply asking if their company is compliant. They are asking if their ESG data can survive a financial audit. If your organization still relies on fragmented workflows and manual spreadsheets, you are carrying a massive business risk. Here is what the new standard of "audit-ready" sustainability requires: 📊 Moving beyond manual processes: Manual data collection leads to credibility gaps and poor transparency. At Sweep we work with companies who tell us they need consistent, entity-level data that flows seamlessly across distributed operations. 🔗 Mastering Scope 3 emissions: Over 90% of a company's carbon footprint is typically hidden within its value chain. Tackling this requires systems capable of real-time tracking across complex, global supply chains. 🤝 Breaking down data silos: Sustainability, finance, procurement, and risk teams must operate from a single source of truth. Every reported number must be backed by documented methodologies that can stand up in the boardroom. Treating the UK SRS as a simple reporting checkbox will expose your company to financial penalties and an erosion of investor confidence. Conversely, leaders who integrate nonfinancial data into their core business strategy will turn transparency into a distinct competitive advantage. The clock is ticking on mandatory disclosures. Are your systems ready for financial-grade scrutiny? 💡 If you are unsure how to get there, you are not alone. Follow SWEEP’s LinkedIn page to join a global community of leaders. We share weekly, expert insights to help you navigate complex global regulations, build audit-ready systems, and turn your sustainability data into your strongest business asset. 👉 Follow us here: https://lnkd.in/eg-vuEaM

"𝗧𝗵𝗲 𝗺𝗼𝘀𝘁 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀 𝗺𝘆𝘁𝗵 𝗶𝗻 𝗠𝗲𝗱𝗧𝗲𝗰𝗵? 𝗧𝗵𝗮𝘁 𝗺𝗼𝗿𝗲 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗲𝗾𝘂𝗮𝗹𝘀 𝗯𝗲𝘁𝘁𝗲𝗿 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲" I've watched countless startups burn through resources trying to create the "perfect" quality management system, while established companies maintain mountains of SOPs nobody follows 𝗛𝗲𝗿𝗲'𝘀 𝘁𝗵𝗲 𝘂𝗻𝗽𝗼𝗽𝘂𝗹𝗮𝗿 𝘁𝗿𝘂𝘁𝗵: Your 500-page QMS is probably hurting your business more than helping it Last week, I met with a CEO who proudly showed me their "comprehensive" regulatory strategy. It was 87 pages of boilerplate text that said absolutely nothing about their actual product risks or clinical use case 𝗧𝗵𝗶𝘀 𝗶𝘀 𝘄𝗵𝗮𝘁 𝗜 𝘁𝗼𝗹𝗱 𝗵𝗶𝗺 (𝗮𝗻𝗱 𝘄𝗵𝗮𝘁 𝗺𝗼𝘀𝘁 𝗰𝗼𝗻𝘀𝘂𝗹𝘁𝗮𝗻𝘁𝘀 𝘄𝗼𝗻'𝘁): Your regulators don't want your paperwork. They want evidence you understand your product's risks and have mitigated them effectively 𝗧𝗵𝗲 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 𝗶𝘀𝗻'𝘁 𝗮 𝗹𝗮𝗰𝗸 𝗼𝗳 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻. 𝗜𝘁'𝘀 𝗹𝗮𝗰𝗸 𝗼𝗳 𝗳𝗼𝗰𝘂𝘀 𝗜'𝘃𝗲 𝗿𝗲𝘃𝗶𝗲𝘄𝗲𝗱 𝗵𝘂𝗻𝗱𝗿𝗲𝗱𝘀 𝗼𝗳 𝟱𝟭𝟬(𝗸)𝘀 𝗮𝗻𝗱 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗳𝗶𝗹𝗲𝘀 𝘄𝗵𝗲𝗿𝗲 𝗰𝗼𝗺𝗽𝗮𝗻𝗶𝗲𝘀: • Created endless procedures nobody follows • Documented everything except what matters • Confused quantity with quality • Built systems that slow innovation rather than support it 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗺𝗮𝘀𝘁𝗲𝗿𝘀 𝗱𝗼 𝘁𝗵𝗲 𝗼𝗽𝗽𝗼𝘀𝗶𝘁𝗲: • Create lean, purposeful documentation • Focus intensely on actual product risks • Build quality systems that enable speed, not prevent it • Understand that compliance is about outcomes, not paperwork I've seen 15-person startups get FDA clearance in record time with tight, focused submissions while billion-dollar companies get stuck in endless cycles of regulatory questions (ask me how I know.....) The difference? Understanding that regulatory excellence isn't about checking boxes it's about truly understanding your product, its risks, and communicating that effectively This approach isn't just better for compliance. It's better for business When your quality and regulatory strategy aligns with your business goals rather than competing with them, you move faster, spend less and ultimately deliver better products to patients What's holding your MedTech company back? Is it really regulatory hurdles or is it your approach to them? Let me know in the comments, I'm curious how many of you have experienced the "more documentation = better compliance" trap