Compliance Manager

Writing a rule and making sure the rule holds are two different jobs, though a small company has no reason to tell them apart. Whoever wrote the security policy was the only person who knew it, and a glance across the room was enough to see whether anyone was ignoring it.

Past roughly forty people that arrangement quietly stops working. The policy document exists and nobody opens it, a departed employee's account is still live, and no one can list everyone with access to the table holding customer data. Each person is doing their own job properly. Reviewing the whole picture now and then simply isn't anyone's job.

The gap usually becomes visible from outside. An enterprise buyer sends a security questionnaire before signing, one line asks whether offboarding revokes accounts and whether those revocations are logged, and answering it turns up a documented procedure with no record of having run in six months. The compliance manager role exists to do that check early and repeatedly, rather than the week a contract is on the line.

Most of the day goes to pulling a set of items on a schedule, checking them, handing the gaps to whoever owns the system, and asking again until they close. Far more time goes into verifying what has already been decided than into deciding anything new.

Four kinds of recurring work make up the cycle.

1. Access review — once a quarter, export the access list for every significant system. If thirty accounts can reach the customer database and four of them belong to people who moved to other teams, four need revoking. Pulling the list is the quick part; removing the four and recording that it happened takes longer.
2. Evidence — the checks themselves have to leave a trail. What was reviewed, on what date, what was out of line, who fixed it and when. Security compliance is the practice of having an external auditor assess a company's security program against a published standard and issue a certificate, and auditors ask less whether a rule exists than whether there is a year of records showing it ran.
3. Pre-release review — before a new tool goes in or a feature ships, check which rules apply. If a team wants to add an external analytics tool, the first question is whether any field leaving the system contains an email address.
4. Training and attestation — run policy training company-wide twice a year and record who completed it. It looks like a formality until an incident happens, at which point it is the evidence of what the company had in place.

The role usually carries no power to fix anything directly. Deleting an account belongs to the team that owns the system. What the compliance manager holds is the list, the deadline, and a path to escalate. Whether the role works at all comes down to that last part: if items past their deadline actually reach an executive meeting, the list shrinks. If they don't, the same items get rewritten every quarter.

This is not a job that reaches conclusions alone. It collects answers from the person accountable for each area, which is why a large slice of the week is short check-ins with other teams.

With in-house counsel, the meeting point is interpretation. Whether a new law applies to this company, and how far it reaches, is a legal judgment and belongs to counsel. Turning that judgment into items that can be checked in the field belongs to compliance.

With the data protection officer (DPO), the overlap is personal data. The DPO decides what gets collected and how long it may be kept; compliance verifies that data past its retention window was in fact deleted. In a small company one person holds both roles.

With the chief information security officer (CISO), the meeting point is findings. The security organization decides how a gap from an access review gets fixed technically, and compliance confirms it closed within the agreed window. Beyond those three, engineering shows up at pre-release review, people operations at joiner and leaver processing, and sales whenever a customer questionnaire needs answering.

"This quarter's access review turned up four accounts that should have been revoked. Can we have them by Friday?"

Handing over findings as a list with a deadline attached.

"That feature needs compliance review before it ships, so this sprint is going to be tight."

Flagging that policy review is a step in the release path, not an afterthought.

"The audit needs evidence for this control, so I'm collecting the last twelve months of records."

What gets audited is the record of the rule running, not the rule itself.

At Pagedeck, the item that stalled the first enterprise questionnaire was offboarding. The procedure was written down, but nobody owned confirming it ran, and an account belonging to someone who had left three months earlier was still active. After Grace decided to staff the role, the first thing it produced was a quarterly access review fixed in the calendar with its results written down. The next customer questionnaire came back with three dated review records attached to that same line, and that question stopped costing the deal time.

The common misreading is that this is the role that writes the rules. The title points that way. In practice the work sits closer to measuring the distance between rules that already exist and what happens in the building. Laws, executives, and the owner of each area set the rules; compliance checks whether they hold. Blur that line and the reviewer ends up grading rules they wrote themselves, which turns review into a formality.

The other one is treating the role as a brake. A review before release genuinely adds a day or two, and that delay is easy to see. The time on the other side is longer and invisible. A feature that ships with personal data in it takes weeks to unwind, and an enterprise contract can sit past the end of a quarter over a single questionnaire line. Review delays a release; what it prevents is a lost contract, a regulatory filing, and rework. Teams that feel the brake most are usually the ones meeting the reviewer at the end, when a design choice made a month earlier is the thing that has to change.