Where compliance applies
Every regulated industry has three things: a written process, a rulebook, and a need for evidence that controls work. The text of the rules changes by industry. The review method does not. Below are the typical rules and the main compliance activities in a range of industries.
Typical rules and where compliance support adds most value
Banking and fintech are a natural starting point. The same approach – approved rulebook, cited review, named approver, trained staff, timely incident reporting – applies in the industries below.
Banking and fintech
Typical rules: consumer credit law, anti-money-laundering and sanctions law, GDPR, EBA guidelines on loan origination and monitoring
Where support adds most value: checking loan and credit processes before they go live
Insurance
Typical rules: Solvency II, IDD, DORA, AML
Where support adds most value: Regulatory change, policy adaptation, reporting
Investment / asset management, crypto
Typical rules: MiFID II, MiCA, AIFMD, market abuse rules
Where support adds most value: Regulatory change, control monitoring, reporting
Pharma & biotech
Typical rules: GMP/GDP, GxP, pharmacovigilance, EU CTR
Where support adds most value: SOP adaptation, GxP training records, deviations & CAPA, control testing
Medical devices
Typical rules: EU MDR/IVDR, ISO 13485, FDA 21 CFR
Where support adds most value: Regulatory change, vigilance reporting, control testing, reporting
Food & beverage
Typical rules: HACCP, FSSC 22000/BRC/IFS, EU food law, labeling & allergens
Where support adds most value: Hygiene training, recalls & non-conformities, audit checks
Healthcare providers
Typical rules: GDPR/HIPAA, patient safety, clinical governance
Where support adds most value: Training, Q&A, data breaches, reporting
Energy & utilities
Typical rules: NIS2, environmental permits, safety regulations
Where support adds most value: Regulatory change, incidents, control monitoring, reporting
Telecom & digital / SaaS
Typical rules: GDPR, NIS2, ePrivacy, DSA, EU AI Act, SOC 2, ISO 27001
Where support adds most value: Regulatory change, policy adaptation, Q&A, incidents
Manufacturing & chemicals
Typical rules: REACH/CLP, ISO 14001/45001, Seveso, product safety
Where support adds most value: Regulatory change, safety training, incidents, control testing
Transport & logistics
Typical rules: ADR, tachograph/driving hours, customs, sanctions
Where support adds most value: Regulatory change, training, incidents
Aviation & maritime
Typical rules: EASA, IMO, safety management systems
Where support adds most value: Certification training, occurrence reporting, reporting
Construction & real estate
Typical rules: Health & safety, building codes, AML (real estate)
Where support adds most value: Training, incidents, control checks
Legal, accounting & professional services
Typical rules: AML/CFT, ethics, data protection
Where support adds most value: Regulatory change, training, Q&A
Public sector & defence contractors
Typical rules: Procurement rules, security clearances, export controls
Where support adds most value: Regulatory change, policy adaptation, reporting
Education & HR / staffing
Typical rules: Child safeguarding, GDPR, labor law
Where support adds most value: Training, Q&A, incidents
Gaming & gambling
Typical rules: Licensing, AML, responsible gambling
Where support adds most value: Regulatory change, control monitoring, reporting
Rules listed are typical examples, including some non-EU frameworks relevant to international business; the rules that apply depend on each organisation.
What a compliance review checks in each industry
Illustrative examples of a process review. Findings are examples only; every real finding is validated by a compliance officer.
Check loan and credit processes before they go live
Process reviewed: Consumer loan approval, from application to disbursement
What the review checks: Creditworthiness and affordability · customer due diligence before any credit decision · pre-contractual information and withdrawal · approval limits and separation of duties · records and complaints
Example finding (illustrative): The process allows funds to be released before customer due diligence is complete. Rated Critical. Proposed fix: wording that moves verification to the start of the process.
Review product approval and distribution arrangements
Process reviewed: New insurance product approval process
What the review checks: Target market before launch · product testing · ongoing monitoring · distribution and conflicts of interest · management body responsibility
Example finding (illustrative): The approval process does not require a defined target market before launch. Rated Major. Proposed fix: a step that records the target market and the approver.
Test product governance and suitability procedures
Process reviewed: Investment product approval and client suitability process
What the review checks: Target market and negative target market · distribution strategy · suitability versus appropriateness · clear, fair and not misleading information · product review
Example finding (illustrative): Suitability steps are not linked to the product’s target market. Rated Major. Proposed fix: a step that compares the client profile with the target market before a recommendation.
Review change control, deviation and CAPA procedures
Process reviewed: GMP change control linked to deviations and CAPA
What the review checks: Impact on the validated state · risk assessment before approval · computerised system changes · deviation → root cause → CAPA · audit trail
Example finding (illustrative): Changes are approved without a documented impact assessment on the validated state. Rated Major. Proposed fix: a mandatory assessment step with a named QA approver.
Check quality system and post-market procedures
Process reviewed: Quality system change management and post-market procedure
What the review checks: Quality system change controls · notification of changes to the notified body · post-market surveillance · serious incident reporting · supplier changes
Example finding (illustrative): No step defines when a change must be notified to the notified body. Rated Major. Proposed fix: a classification step before implementation.
Review management of change and safety management
Process reviewed: Management of change in a maintenance organisation
What the review checks: Management system and safety policy · compliance monitoring · occurrence reporting · approval of changes · competence and responsibilities
Example finding (illustrative): The compliance monitoring procedure has no named owner and no schedule. Rated Major. Proposed fix: an owner, an annual plan and a follow-up step.
Review cybersecurity risk management under NIS2
Process reviewed: Cybersecurity incident response and risk management procedure
What the review checks: Risk analysis and security policies · incident handling and reporting · supply chain security · management body approval · training and awareness
Example finding (illustrative): The incident procedure has no step for reporting to the authority within a set time. Rated Major. Proposed fix: a reporting step with an owner and a deadline.
Talk to us about your compliance needs
Get in touch for a conversation about document approval, incident management or employee training in your organisation. Tell us your sector (bank or financial institution, public sector body or SME) and the rules you work with.
Contact
E-mail: tadej.drmaz@comp-consulting.eu
Please do not send customer data or confidential documents by e-mail.