In large companies, compliance is usually controlled by a specific compliance manager. This manager will dedicate his or her time to areas such as the management of health and safety, auditing the ISO business management standards, making sure fire safety in the building is adequate, looking after environmental management, protecting company data, carrying out training for staff on these topics and investigating accidents. In relation to health and safety, legally all companies need access to a competent health and safety advisor be it internally or externally. In large organisations such as the NHS this can be a huge undertaking due to the number of staff members, sites and different areas of work so it warrants a dedicated team and person they can draw on for this advice, and support.
This is all well and good but in small to medium enterprises it is not always possible to have a dedicated manager or team to carry out these tasks due to the costs involved and due to the size of the company. This is where it can become a headache, because most of the time it becomes a bolt-on to someone else’s job. With the right training and support this is a viable option but if the person who has taken this role on is not experienced, qualified and above all motivated in these areas then it can become a risk to the business. In the past I have seen tasks given to the marketing manager, a member of the admin team and on one occasion even the site handyman was involved in managing it. These staff members didn’t really understand the complexities of the tasks in hand and felt a lot of pressure taking on these roles. The reason why is due to the number of legal regulations that companies must comply with such as the Health and Safety at Work Act of 1974, The Regulatory Reform (Fire Safety) Order 2005 and the latest General Data Protection Regulations 2018 to mention but a few. Even the way you report accidents to the HSE has a specific method and if you fall foul of these then you could open yourself up to fines and or legal action.
Another problem is that the compliance manager must not only look after their company’s compliance they must also make sure to a certain extent that their suppliers/partners have procedures in place in relation to health and safety duty’s, and this is also the same in relation to data protection.
OutsourcingA viable alternative to in-house compliance is to outsource this to a specialised consultant. This can give businesses access to the experienced and qualified compliance specialists, which they may not otherwise have available, it can be more cost effective, save time, make the business more efficient and take the strain off other members of staff. The consultant route can help reduce stress for managers and business owners alike, giving them piece of mind and knowing that they will be there for advice and support in the worst-case scenario of something going wrong.
In the past I have helped a lot of pubs and breweries with compliance. Off the back of this, I was invited to talk once at a health and safety event for breweries and to my surprise I was heckled. A disgruntled gentleman shouted out “Health and safety is a load of nonsense, you can get all the forms free to do it yourself anyway, so why should we outsource?”. I paused for a minute, a little shocked, and then answered with the following.
“I understand where you’re coming from and you’re right, you can get free forms and templates to do it yourself. But think of it like this. You are a brew master and you make beer, right? I could say to you why should I buy beer from you at £5 a pint, when I can go online and buy a beer making kit for £40 and make myself 200 pints? The reason why is because I don’t have any experience in doing it, I don’t have the time and realistically it’s going to taste awful. The only difference between these two situations is the fact that if my beer making process goes wrong and I drink it then I might be ill, but if your compliance goes wrong you could kill someone and/or go to jail.” With that the man went quiet. Safe to say I think I made my point.
Compliance is a very serious aspect of business today so don’t take any risks, make sure the staff who are working on it are happy to take it on, understand what is required, have the time to dedicate to it, are fully trained and competent and have access to refresher training throughout the year. If this can’t be done, then I would advise looking at the outsourcing option and trust it to a competent professional.
