Preventing Compliance Issues: 4 Real-World Risk Management Strategies

Lessons from HR and legal leaders

Compliance risks can quietly erode a company’s stability, unless they are identified and addressed early. In this expert roundup, seasoned human resources (HR) and legal professionals share specific compliance challenges they have encountered and the strategies they used to overcome them. From navigating labor laws to managing remote work risks, these real-world examples offer practical insights and actionable advice for staying ahead of potential issues in today’s evolving regulatory landscape.
 

 

• Identify Family and Medical Leave Act (FMLA) Documentation Gaps
• Secure Remote Work Environments
• Enhance Third-Party Vendor Management
• Revamp the Harassment Reporting System

Identify FMLA Documentation Gaps

We discovered a glaring hole in our FMLA documentation process—managers were inconsistently tracking intermittent leave, creating potential liability nightmares. Our fix involved implementing a centralized digital tracking system that automatically flags when employees approach their leave limits, plus mandatory quarterly training for supervisors on proper documentation protocols.

The solution slashed our compliance risks dramatically, but the real game-changer was designating a single HR specialist as our "FMLA quarterback" who reviews all cases weekly. My advice? Do not assume your managers understand compliance requirements—most do not—and create foolproof systems that work even when people do not follow instructions perfectly. In for a penny, in for a pound: either commit to comprehensive compliance systems or prepare for the inevitable legal headaches down the road.
 

Jason Tenenbaum, Attorney - NY State, The Law Office of Jason Tenenbaum, P.C.

------------------------------------------------------------------------------- 

Secure Remote Work Environments

Back in 2020, when our business went fully remote like many others, we quickly identified the risks involved with employees accessing servers on their own broadband and even using personal devices.

As a business that has to ensure all data is stored securely, we paused any access immediately until we were sure that everyone had the correct firewall and precautions in place to fully protect and encrypt the server. All employees had to (and still do regularly) go through cybersecurity training, and it is compulsory that they use VPNs when accessing the network. This will hide their actual IP address and increase privacy. 

We also insist on two-factor verification being set up so that untrusted people cannot access the server.

I would always recommend businesses take advice from IT experts if employing remote staff to ensure their devices are set up correctly. It is also important that there are regular checks to ensure processes have not slipped and there is no possibility of data getting into the wrong hands.
 

Tracey Beveridge, HR Director, Personnel Checks

-------------------------------------------------------------------------------  

Enhance Third-Party Vendor Management

One specific compliance risk we encountered was related to third-party vendor management in the context of data privacy. We discovered that some of our vendors lacked robust data protection measures, posing a significant risk of non-compliance with regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

How my company addressed the risk:
 

1. We conducted comprehensive evaluations of our third-party vendors to identify any gaps in their data handling and security practices.
2. We updated contracts to include strict data protection requirements, ensuring vendors were contractually obligated to adhere to our standards and relevant regulations.
3. We implemented a system for continuous monitoring and regular audits of vendor compliance, enabling us to detect and address any issues proactively.
4. Last but not least, we also enhanced our internal training programs, ensuring our team was well-versed in data privacy best practices and could effectively manage vendor-related risks.

This multi-pronged approach mitigated the risk by ensuring that every vendor handling our data met strict compliance standards, reducing our exposure to potential data breaches or regulatory fines. It also created a transparent, auditable framework that enhanced overall data security within the company.

I would also like to suggest a few tips for others facing the same situation:
 

1. Do not wait for a breach or audit to identify vendor risks. Regular assessments and audits can catch issues early.
2. Make sure that contractual agreements with vendors clearly define their responsibilities regarding data protection.
3. Focus on your team and give them the knowledge and tools to manage compliance effectively.
4. In addition to that, use compliance management software to streamline monitoring and maintain up-to-date oversight of vendor practices.

 

Lyle Solomon, Principal Attorney, Oak View Law Group

-------------------------------------------------------------------------------  

Revamp the Harassment Reporting System

A few months ago, at my company, we discovered that our harassment reporting system was not functioning effectively. Our entire team did not feel comfortable reporting issues. When some did report problems, the reports were not being tracked properly.

Why was this a problem?
According to rules and regulations, companies must provide a safe way for employees to document harassment. If we do not handle reports appropriately, people could be harmed. Moreover, our company might face lawsuits or fines.

How did we fix it?
We:

1. Created a new reporting method with various ways to report, such as online, phone, and in-person
2. Ensured reports could be anonymous if needed
3. Trained all leaders on how to handle reports correctly
4. Set up a tracking system to ensure nothing was forgotten
5. Started checking regularly that the system was working properly

My advice for others?

Examine your reporting technique from your workers' perspective. Is it easy to use? Do they trust it? Obtain feedback from your employees and make changes based on what they say. Then, train everyone thoroughly on how to use this system and check frequently that the system works.

A good reporting system protects both your people and your company!
 

Muqaddas Virk, Recruitment Specialist, Xero

Brett Farmiloe is CEO & Founder of Featured.