Compliance in 2026: four clocks, four starting guns

What auditors actually ask for

A stubborn gulf separates what people expect an inspection to probe from what it probes, and closing it saves a great deal of wasted preparation.

An assessor is establishing whether a safeguard exists, behaves as advertised, and can be shown to have behaved so throughout the period. That third limb yields most findings. A safeguard that works flawlessly yet leaves no trace fails, while a mediocre one with a spotless dossier passes — which sounds like an accusation and merely describes what an inspection can achieve from outside.

Evidence is therefore a design requirement, not an afterthought. A review held in a meeting and minuted nowhere did not happen. Arrange that the ordinary running of a control emits its own trace — a ticket, a signed log, an automated export — because anything reconstructed later costs several times more and convinces less.

The second thing an assessor is doing is following scope. Almost every disappointing certificate is a scope problem, not a rigour problem: the statement covers one product line, one data centre, one legal entity, and the customer reading the logo assumes it covers the organisation. Read the scope of anybody else's certificate before trusting it, and expect yours to be read the same way.

The same control, in five formats

Ask where a compliance budget vanishes and the reply is seldom safeguards. It vanishes into re-describing safeguards that already exist, for audiences who refuse to accept one another's descriptions.

A mid-sized supplier into regulated sectors holds a general information security certification, a payment card assessment, a service organisation report, whatever its own regulator demands, and a queue of customer questionnaires. Underneath sit one set of access reviews, backups, patching and joiner-leaver handling. The controls overlap heavily; the evidence formats overlap not at all.

So the access recertification gets produced five times a year in five shapes, every round lands as a disruption, and eventually somebody hires a squad whose sole occupation is transliteration. None of that makes anybody safer by a single increment, and it is a large fraction of what the word now denotes in practice.

The structural remedy is one internal safeguard catalogue that every framework maps onto, with proof produced once in a neutral shape. It is a hefty undertaking, wholly unglamorous, and the sole remedy that shrinks the bill instead of shuffling it. Organisations that have done it describe the year's second inspection as an export, not an expedition, which is the whole return.

Personal liability arrived quietly

The most consequential change of the current cycle is not a control or a deadline. It is a switch of recipient.

The critical-services directive obliges management bodies to approve the risk measures, to oversee their implementation, and to undergo training themselves — and makes them accountable for failures. Earlier statutes addressed the corporate body, which meant the penalty was a number in an account and the conversation stayed inside the security function. Naming individuals alters who turns up to the meeting.

The practical effect for anybody running a security programme is that the perennial struggle for attention has been upended. For two decades the snag was that whoever held the purse was never obliged to grasp the exposure. They now are, by name, and a request for a decision has become a request they cannot decline to consider.

The corresponding trap is accountability without competence, which produces theatre: directors signing approvals for measures they cannot evaluate, and a paper trail that satisfies an audit while changing nothing. What works instead is directors asking questions they can follow up — what would we owe, to whom, within what hours, and who decides.

The four documents to write before anything happens

All four are cheap beforehand and effectively impossible to draft against a live countdown, which is the entire argument for writing them now.

A classification procedure. One page. Which criteria, applied by whom, with the decision and its timestamp recorded. It answers the question that decides everything else.

A roster of everyone you would have to alert. Every authority, with the current portal, the current contact and the current format. These change, and discovering that at hour three is a bad time.

Skeleton disclosures with the gaps showing. Written calmly, they take an hour. Written during an incident by somebody who has never filed one, they take the hours you did not have.

A named decision-maker and a named deputy. With authority to classify at three in the morning without convening anybody. The commonest cause of a missed due date is not ignorance of it; it is that nobody in the room believed themselves entitled to decide.

What does a company of ninety people actually have to do?

The current wave of regulation catches employers who have never had a compliance function, and most of the published guidance is written for organisations that have three.

The reach is the part people miss. Cut-offs pegged to headcount and turnover sweep in mid-sized manufacturers, regional utilities, waste operators, food distributors and managed service providers, many of whom first discover they qualify when a customer posts a questionnaire. No register exists to consult and no letter arrives; coverage is something you conclude about yourself and must afterwards justify.

What follows is proportionate in the texts and intimidating in the trade press. Duties are framed as risk-appropriate measures, which for ninety people means the ordinary list — backups that have been restored from, an inventory, patching with an owner, access removed when staff leave, an incident procedure somebody has read — plus the reporting duties above and a board that can show it approved the arrangements.

Two failure modes are common: buying a certificate as a substitute for doing the work, and being so daunted by guidance drafted for multinationals that nothing happens at all. The proportionate reading is duller and correct. Write the four documents, do the ordinary list properly, and be able to describe both. That is a few weeks of effort, not a programme — worth saying plainly, because almost nobody selling into this space has an incentive to.

Where to start on a Monday

Three exercises, none of which needs a consultant, and each of which typically unearths something awkward inside an hour.

Set down which statutes bite on you and what each counts from. Not the deadlines — the starting events. Most teams keep the hours somewhere and have never noted the origins alongside, which is where the time actually goes.

Take an actual episode from last year and re-run the clocks against it. When would each one have started, given what was known when? The distance between that answer and what was actually lodged is your exposure, generally wider than the security desk expects and narrower than counsel dreads.

Ask who is allowed to classify at three in the morning. Should the reply run past a sentence, or invoke a committee, you have your finding.

After those three the harder work is prioritisable: consolidating evidence so one control satisfies several assessments, separating external communications from regulatory ones, and booking the board session about their own accountability. Do the first three and you know what you would owe, and to whom, before you need to.