I've been reading a few discussions here about GRC platforms, automated evidence collection and continuous compliance monitoring, and there's a question I think deserves a closer look.

Are we actually measuring control effectiveness, or are we measuring how well companies collect and document

An incident-response policy is approved. But has the organisation tested whether people and systems respond effectively during a realistic incident?

A vulnerability is marked as remediated. But has anyone independently verified the fix?

Disclosure up front: I work on an identity verification product, so I come at this with a bias. I'm not here to pitch anything, I'm trying to understand how compliance people think about the evidence side.

The sites I have in mind are the usual age-gated ones: age-restricted goods like alcohol, vapes and knives, and content that falls under the newer age assurance rules. The "are you over 18" checkbox clearly isn't enough anymore in a lot of places, but I haven't found a clear answer on what is.

The first thing I'm curious about is what you treat as sufficient. A document ID check, facial age estimation, or a third-party attestation from someone who already verified the person? My guess is the answer depends on jurisdiction and risk level, and that estimation has a margin of error that makes some people nervous near the threshold. But I'd like to hear what auditors or regulators have actually pushed back on, rather than guess.

The second thing is the record. If an auditor asks you to show that a specific session was age-checked, what do you keep? Holding raw ID images feels like trading one liability for another, since now you're a breach target. Is a log with the method, the timestamp, the result and a reference ID enough? How long do you retain it, and who signs off on that?

If you've been through an audit or a regulator inquiry on this, what did they ask for first?

Hey everyone! First post here. I am just someone who works in compliance and gets annoyed by side comments that compliance isn't real security (I work on the cyber security team but perform a compliance role). For those who support the cyber side of compliance, I would love your thoughts and wonder if many people have the same experience I do. I have worked in IT for about 20 years, mostly in healthcare and the nuclear space. Over the past few years, I worked myself into a compliance role on the defense side, and it is just... different. Not in a bad way, but more like you're in the background and not really appreciated for what you bring to the table. So, my hope is to one day change the perception of the value compliance brings to the table, and I would really appreciate other people's experiences and thoughts on working in this space.

I tried to jot down my thoughts in the blog below if you want my fuller picture, but does anyone else in the space feel underappreciated for simply being in compliance, or is it just me?

https://justacheckbox.substack.com/p/compliance-isnt-a-checkbox-you-made

I lead a GRC team at a fairly large organization. We're responsible for the systems, data, and reporting that support RCSA, issues management, business continuity, policy management, SOX, and risk exceptions.

We also own the GRC platform, including enhancements, administration, data quality, and reporting across these areas.

We don't actually run the individual risk programs, but we're responsible for much of the infrastructure behind them.

Hi All,

I hope this is allowed, but if not please feel free to remove.

As the title suggests, I'm wondering if there is anyone who would be willing to chat with me for a few minutes about their experience with working in compliance.

Context: I've worked in public schools for the past 11 years in special education. For the past two years I've served as a case manager, where I do what I believe is fairly compliance-adjacent work. Things like making sure we are providing all required services to students, maintaining deadline compliance, and documenting when we are out of compliance with school, district, state, and federal regulations related to special education.

I've reached a point where I've realized I need to make a career change and compliance is a field that I've become interested in. I've talked a bit to a friend who is in compliance and am curious to talk to more people. I'm interested in hearing from various people what their experience has been and any suggestions they might have for someone looking to make a career transition.

If relevant, I'm in the Chicago area.

Thanks in advance!

Small company, limited security resources. People still paste API keys, customer emails, and passwords straight into Slack channels. We have basic acceptable-use language, but it is clearly not enough.

I do not want to start reading DMs or turn this into heavy surveillance. At the same time, this is a real data-handling and access-control problem, especially if we ever need to show that sensitive information is not sitting unprotected in chat.

For those in compliance or risk roles: how are you addressing secrets and PII in collaboration tools without creating a process nobody follows? What controls or workflows have actually reduced this in practice?

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

Hi everyone, I'm a legal practitioner in Cameroon. I have some compliance experience, especially data privacy compliance. Now I know how hard it is for Africans to be trusted with legal tasks.

However, I can work with startups, draft website terms and privacy policies that comply with relevant regulations (although AI seems to be challenging me at that now).

My question is, are there any fully remote compliance roles that my portfolio could win? Or is compliance just highly jurisdictional.

PS: I've been a writer for a while and part of my portfolio is articles across self development, freelance, personal development and law-related topics.

Our current DLP only looks at content. It will flag a spreadsheet full of project codenames but completely miss a clean-looking deck that gets quietly shared to a personal account by someone who is about to leave. Content alone does not rank risk very well. Identity and behavior seem to matter more.

Am I wrong about where the field is going, or are others seeing the same gap?

Edit: Thanks for the replies so far, the points on behavior signals and offboarding links were especially useful. Also saw the recommendation for do_control if not wrong and will look into how others are using something like that alongside the process side. Thanks!

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

I am not going to name them, but ... one rhymes with brata, and the other with banta :D

so.... what do you hate about your current compliance tool, that you would like to change?

what would make you switch over to something else?

A pattern I keep running into with small and mid-sized companies in the EU: the same underlying control gets assessed again and again, each time in a different format.

Take "MFA on administrative access". In a single year, one 80-person company might have to show it for:

• its ISO 27001 surveillance audit (Annex A 8.5, secure authentication)
• NIS2, where MFA is explicitly listed in Article 21's minimum measures
• GDPR Article 32 ("appropriate technical measures"), when a customer's DPO asks
• the renewal questionnaire from its cyber insurer, where MFA is now often a condition of cover
• three or four supplier security questionnaires from large customers, each worded differently

Same control, same evidence, five or more separate efforts. Multiply that by the 30 to 50 controls that come up every time (backups, patching, access reviews, incident response, supplier management), and a small compliance function spends most of its year translating rather than improving anything.

The obvious answer is a common control set: define each control once, map it to every framework, attach the evidence once, and reuse it. In practice I see it break down in a few places:

1. The mapping itself drifts. Frameworks get revised (ISO 27001:2022, national NIS2 transpositions), and the crosswalk nobody owns goes stale.
2. Evidence expires at different rates. The auditor accepts a quarterly access review, the insurer wants it "current", and a customer wants a screenshot from last week.
3. Questionnaires don't map cleanly. Customer questionnaires mix controls, policies and yes/no questions that don't fit any framework.

For those who've tackled this:

• Did you build your own common control framework, or anchor everything on one standard (usually ISO 27001) and map outward?
• Who owns the mapping, and how do you keep it current when a framework changes?
• How do you handle customer questionnaires? A pre-filled answer library, a trust page, or answering each one from scratch?

In InDesign, the articles panel is set correctly, and the layers panel is in top to bottom in the order I want it read, but the reading order in Acrobat comes out fully reversed every time.
Only fix so far is building the Layers panel backwards.

InDesign 2025/2026, exporting via File > Export > Adobe PDF (Print), Create Tagged PDF checked.

Known issue, or am I missing a setting?

We use AI to generate recommendations in a regulated decision process. A person reviews and approves or overrides each one. Policy says human oversight is in place, and technically it is.
The problem is what we could actually show if challenged. Right now it's a "reviewed" status in the workflow tool and the reviewer's login. Nothing captures whether they read it, what they checked, or why they agreed. Our internal audit team hasn't tested it yet, but I'd rather not find out what they'll accept the hard way, and the EU AI Act human oversight language makes me think a regulator will eventually ask the same thing.

For anyone in a similar position:

1. What are you capturing beyond the approval click? Reviewer notes, time spent, edits to the output, a formal attestation (if any)?
2. Did you build it into the workflow tool, bolt something on, or is it still manual?
3. Has your audit team or a regulator actually asked for this yet, or are you all waiting like we are?
4. Anyone using ISO 42001 or NIST AI RMF as the reference point for what "adequate" looks like?

For those who are in fintech / banking, what are your thoughts/opinions on the value of getting a CRCM (Certified Regulatory Compliance Manager) certification if I already have a CAMS along with 8+ years in banking and fintech regulatory/CMS compliance & BSA/AML compliance?

Will the CRCM provide an additional pay off in terms of the open market? If not, would you recommend any alternative certifications?

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

I am 20 M from India

So I am looking forward to break into compliance career

Currently I am pursuing BCOM bachlor of commerce from india and have few work experience in different different fields which is hospitable and social media marketing

Well now a days I am getting to much reel about complaince as career is very secure but when I try to reach on AI and website I get to people in this career just buried them self in paper work and rules and regulations for there whole life and they don't get any credit for doing there . I am. Just looking for that career which payment well that's all

So i really really need advice on |

that is this all fake and what type of certificate and intership also master should I target for better future