Why 'evidence of effort' matters

We all tend to think of ‘regulated industries’ as those where safety or financial stability is critical – for example airlines and banks. The reality is that all businesses are exposed to regulation, ‘red tape’, bureaucracy, call it what you will. For example, farming, food production, hospitality, education, care and transport, the major pillars of our local economy, are all pretty heavily regulated.

Inevitably in our role as legal and regulatory advisers, we come in contact with a wide range of regulators and situations where they are making inspections and potentially taking enforcement action. The common theme is that it is much easier to keep the dialogue positive if there is some ‘evidence of effort’ to comply. Regulators bridle particularly if they think business owners and managers simply ignore their regulatory responsibilities and therefore pose a significant and ongoing risk to their customers, employees, neighbours and the public at large.

If you can produce evidence that you are taking the regulatory obligations in your business sector seriously, then you stand a greater chance of enforcement agencies adopting a more lenient view. This is because your attitude suggests to them that, with support and encouragement, you are likely to pose progressively less risk to your customers, employees, neighbours and the public at large. This can even be the case where you may not yet have all the desired processes in place – so it really is worth ensuring you gather ‘evidence of effort’ in parallel to building up the correct processes in your business. In practical terms, for example, this means documenting board discussions about plans to put new processes/checks in place as well as documenting those processes/checks once they are up and running.

Obviously to the hard pressed director or senior manager, regulatory compliance can seem like yet another task taking attention away from the business itself. However, it is important to understand that not all compliance activity need be exhaustive and highly detailed. We have come across recent examples of GDPR implementation in organisations which, on the advice of external consultants, has clearly been over-engineered; a sense of proportion is key.