For years, compliance has been built around regulations, policies, procedures, and audits. Organizations would identify the obligations that applied to them, prepare the necessary documentation, and periodically review their compliance.
That model is still necessary. But that’s no longer enough.
Companies are facing a growing number of requirements in areas such as cybersecurity, privacy, ethics, artificial intelligence, sustainability, and third-party management. At the same time, customers, auditors, and other stakeholders no longer simply ask whether an organization is compliant—they demand evidence to prove it.
The challenge is no longer simply to define how an organization should operate. It is to ensure that compliance becomes an integral part of its day-to-day operations.
That transition from the document to implementation is what we mean by Operational Compliance.
What Is Operational Compliance?
We can define Operational Compliance as the ongoing management of an organization’s compliance, translating standards and policies into processes, responsible parties, controls, and evidence that enable compliance and demonstrate that compliance is being met.
In simple terms, it means being able to answer four questions at any time:
What do we need to do? Who should do it? When should it be done? Can we prove that it has been done?
This does not mean replacing legal expertise or traditional compliance models. It means adding an operational layer that translates them into the organization’s actual operations.
A policy may stipulate that critical suppliers must be evaluated periodically. Operational Compliance ensures that we know which suppliers are critical, who is responsible for evaluating them, when such evaluations should take place, which controls must be reviewed, what evidence must be requested, and what happens if the outcome is unsatisfactory.
In short:
Moving from having documented compliance to having effective compliance.
Compliance is changing
Two developments explain why this shift in approach has become necessary.
From a Legal Obligation to a Business Obligation
Traditionally, the main driver of compliance has been regulation: a new legal requirement would lead organizations to implement certain procedures or controls.
That factor remains crucial, but another one that is just as important has emerged: customers.
Large organizations are increasingly extending their requirements for cybersecurity, privacy, ethics, sustainability, business continuity, and artificial intelligence governance to their supply chains. As a result, many small and medium-sized businesses must implement certain measures—not because a standard applies directly to them, but because their customers need to verify that they provide sufficient assurances.
Security questionnaires, supplier evaluations, codes of ethics, privacy policies, certifications, access controls, incident management, and information on the use of artificial intelligence are now a standard part of many B2B relationships.
Compliance is no longer just a legal obligation; it is also becoming a prerequisite for doing business.
For many companies, being able to demonstrate compliance is becoming a competitive advantage and, in some cases, a prerequisite for gaining access to certain clients.
From Documentation to Evidence
The second transformation is just as important.
Having a security policy does not prove that access rights are being reviewed. Having a vendor approval procedure does not prove that critical vendors have been evaluated. Having a training plan does not prove that employees have completed the training. And having an incident management procedure does not prove how the organization responded to the most recent incident.
True compliance leaves a trail: approvals, evaluations, records, controls implemented, documents, signatures, reviews, communications, and actions.
That is why it is increasingly important for organizations to move beyond simply saying , “We have a procedure for doing this , ” to being able to demonstrate , “We do this, and here is the evidence.”
Compliance is shifting from documentation to evidence: it is no longer enough to define what needs to be done; you must be able to demonstrate that it is actually being done.
The Problem with Managing Compliance in Silos
As obligations increase, another problem arises: fragmentation.
ISO 27001 on the one hand. NIS2 on the other. ENS, GDPR, AI Act, criminal compliance, ESG requirements, customer demands…
If every new regulation leads to a new Excel spreadsheet, a new document repository, a new questionnaire, new controls, and, at times, a new tool, complexity grows unchecked.
But the reality of the organization is not divided by regulations.
A supplier is the same supplier, whether viewed from the perspective of data protection, cybersecurity, or artificial intelligence. An incident can simultaneously affect multiple obligations. A policy can address several requirements at once. And a single control can mitigate different risks and serve as evidence under different frameworks.
The problem, therefore, is not just managing an ever-increasing number of regulations; it is managing the relationships between them effectively.
From Documented Compliance to Operational Compliance
Operational Compliance is not intended to replace the traditional compliance model. It complements it by integrating obligations, policies, and controls into the organization’s day-to-day operations.
| Documentary Approach | Operational Approach |
|---|---|
| Regulations | Processes |
| Documents | Evidence |
| Policies | Policy application |
| Defined Controls | Inspections Conducted |
| Periodic Reviews | Ongoing monitoring |
| Scattered information | Related Information |
| Manual Tasks | Automation |
| “We Deliver” | “We can prove it” |
Both approaches are interdependent.
Regulations establish obligations and compliance objectives; specialized knowledge allows us to interpret them and apply them to the specific context of each organization.
Operational Compliance manages how to make all of this happen on a day-to-day basis.
The Components of Operational Compliance
To make this possible, we need to stop focusing solely on regulations and start thinking about the actual elements that make up an organization:
People · Suppliers · Assets · Applications · Risks · Policies · Controls · Incidents · Assessments · Evidence
They are all interconnected.
Let’s consider a critical technology provider that stores company information, processes personal data, and uses artificial intelligence to deliver its services.
That information should not be recorded multiple times simply because it pertains to different obligations. The information about that supplier should be sufficient to determine what risks exist, what controls are necessary, what documentation must be requested, what questionnaires must be completed, how often the supplier must be reassessed, and which compliance frameworks may be affected.
Information should exist only once and be reused wherever needed.
Operational Compliance needs to connect:
Risks → Controls → Policies → People → Third Parties → Assets → Incidents → Assessments → Evidence
The value isn’t just in managing each of those elements separately. It lies in managing the relationships between them.
A Living Model of Compliance
When these elements are connected, compliance ceases to be a snapshot taken at the time of an audit and can become a living system.
If a supplier changes, a new risk arises, documentation expires, a new employee is hired, a control fails, or an incident occurs, the system should be able to determine which aspects of compliance may be affected and what actions are necessary.
This allows us to move from a model based primarily on periodic reviews to one in which certain changes in the organization can automatically trigger reviews, tasks, or controls.
Compliance thus ceases to be something that is reviewed only occasionally and instead becomes progressively integrated into the company’s day-to-day operations.
A single source of information for multiple frameworks
This approach helps solve another major problem in today’s compliance landscape: duplication. Consider a multi-factor authentication (MFA) control. An organization should not need one MFA control for ISO 27001, another for NIS2, and yet another for ENS.
It has multi-factor authentication.
That control can then be linked to various risks, assets, and regulatory requirements. The same applies to a policy, a supplier assessment, training, or documentation.
That is why one of the central concepts of Operational Compliance is:
Controls belong to the organization; the various compliance frameworks reuse them.
This is how we move toward a much more efficient model:
One action → one piece of evidence → multiple compliance requirements.
A single source of information capable of addressing different frameworks, clients, audits, or evaluation processes.
Automate without creating more red tape
Implementing compliance shouldn’t mean burdening the organization with administrative tasks. It should be exactly the opposite.
When processes and information are structured, much of the work can be automated.
If a supplier’s certificate expires, the system can automatically request its renewal. If a new person joins the organization, the appropriate policies, training, and acknowledgments can be assigned. If a supplier begins using artificial intelligence, new questions, checks, or assessments can be activated.
If an incident occurs, the corresponding procedure—including its tasks, responsible parties, and deadlines—can be initiated automatically. And if a check stops running, an action can be triggered and escalated when necessary.
The goal is not to automate for the sake of automation, but to enable people to devote their time to decisions where they truly add value.
Systems should work for people, not the other way around.
What role does artificial intelligence play?
Artificial intelligence opens up enormous possibilities in compliance, but there is a preliminary step that is often overlooked:
First, you have to organize the information; then you can apply intelligence to it.
If information is scattered across documents, emails, spreadsheets, and standalone applications, the possibilities for automation and analysis are limited.
On the other hand, when the relationships between suppliers, risks, controls, policies, incidents, and evidence are understood, AI can become a true assistant to compliance professionals: helping to review documentation, detect missing information, locate evidence, prepare assessments, identify potential risks, or propose actions.
The goal is not for AI to make the decision, but for the professional to reach a decision with the groundwork already laid, while always ensuring the confidentiality of information, data protection, security, and appropriate human oversight.
Operational Compliance for Small and Medium-Sized Businesses
Large corporations have been addressing these needs for years using GRC platforms, specialized departments, and complex projects.
But compliance is spreading far beyond large organizations.
A company with 100 or 200 employees may now have to complete security questionnaires from its customers, evaluate critical suppliers, manage policies, train its employees, document incidents, analyze risks, and provide evidence of its controls.
The answer cannot be to impose the same structure and complexity that a multinational corporation uses.
Small and medium-sized businesses need the same level of rigor, not the same level of complexity.
And that’s where technology plays a decisive role: simplifying processes, reusing information, automating tasks, and making a compliance management approach accessible that, until now, was reserved primarily for organizations with far greater resources.
Ithikios’ vision: making compliance a reality
At ithikios, we are evolving from a solution that began as a whistleblower channel into an Operational Compliance platform.
Whistleblowing channels, policy management, third parties, risks, controls, incidents, assessments, the Trust Center, and automation are all part of this process.
But our goal is not to bring together many compliance tools on a single platform.
The goal is to get all of them to share information and work together.
A risk should be linked to the controls that mitigate it. Those controls should generate evidence. A change in a supplier should trigger an assessment. An incident should affect risks and controls. The same evidence should be applicable to different frameworks.
And may all that information make it possible to know, at any given moment, not only what the organization should be doing, but what it is actually doing.
Because the future of compliance does not lie in accumulating more documents, more tools, and more red tape.
It involves integrating compliance into the company’s day-to-day operations.
From Compliance to Trust
The ultimate goal of operational compliance is not just to comply. It is to build trust.
Confidence for management, which is aware of the actual status of compliance. Confidence for the compliance officer, who has traceability and evidence. Confidence for customers and partners, who can verify certain assurances. And confidence for the organization itself, which knows that its policies and controls are not merely on paper.
Operational Compliance means making compliance work in day-to-day operations: turning obligations into actions, actions into evidence, and evidence into trust.
ithikios · Operational Compliance
We make compliance operational: easy to manage, integrated into day-to-day operations, and supported by verifiable evidence.
