People@

Establishing a dedicated compliance team is essential for any organization committed to meeting compliance standards. Compliance goes beyond merely implementing requirements; it involves fostering a culture where human resources play a critical role in the overall framework. 

The compliance team is responsible for overseeing all compliance activities and maintaining accountability. This includes identifying and managing risks, developing and updating policies and procedures, monitoring adherence, and providing guidance on regulatory matters.

Additionally, every staff member must be held accountable for following established policies and procedures, thereby upholding compliance standards throughout the organization. 

Documenting compliance roles and maintaining a clear overview of all team members is crucial. This practice improves security and privacy by clearly defining responsibilities and ensuring that processes are followed accurately.    

Most compliance frameworks, whether based on ISO 27001, SOC 2, or others require you to maintain control over your team’s size, job titles, and leadership structure. This is where the ‘People@ Section’ becomes handy. It helps you manage all this information, ensuring you can oversee your employees and contractors, track contract expiry dates, and monitor other relevant details.By following our guidelines, you can build a robust ‘People@ Section’ that functions as both a basic HR tool and an effective compliance management framework.  

Completing the ‘People@ Section’ is a vital initial step when using Compleye Online, as it integrates with multiple sections across the platform. To fully utilize all features, you should input each team member’s name, status (active or inactive), and job title. This includes not only employees but also individuals contracted with your company, such as shareholders with management contracts or freelancers who primarily work for you. However, if an individual provides services to your company through their own business entity, they should be categorized as a supplier rather than a team member. 

To make the most of the ‘People@ Section’, it’s important to fill out the core fields accurately and understand their purpose, as outlined below: 

• Name: Enter the team member’s first name and surname. 

• Status: The default status is ‘Active.’ Change this to ‘Not Active’ when a team member leaves. Only active members are shown in the overview. 

• Job Title: Enter the team member’s job title. 

Assigning Compliance Roles and Responsibilities  

Assign specific compliance roles to assign and document the roles. Our recommendations: 

• Start Small: Assign at least 2 team members to be responsible for your ISMS. 

• Balance Expertise: Make sure your Compliance Team includes individuals with both technology and business knowledge. 

• Mandatory Roles: Assign the minimum required roles—Security Officer (SO), Data Protection Officer (DPO) or Privacy Officer (PO), and Compliance Officer (CO). Please note that depending on your company’s size, these roles can be combined. For example, the Compliance Officer and Data Protection Officer positions can be filled by the same person. 

• Leadership Requirement: It is advisable to include at least one C-level management on the compliance team. This executive should be responsible for reviewing and approving policies, procedures, and risk assessment results. 

• Roles and Responsibilities Documentation: It is crucial to document all roles and responsibilities. Begin with the compliance roles; in addition to defining these roles, you must also assign the relevant competencies. Please refer to the Roles and Responsibilities Template available in the Compleye Online Templates Section. These roles should be evaluated at least annually to assess whether the responsibilities, roles, and competencies areg met effectively. It is recommended to establish an Operational Planning and Controls (OPC) to ensure that this evaluation is performed regularly. For the exact procedure and required evidence, please refer to the standard OPC Overview Template, which can be accessed in the Compleye Online Templates, where the specific OPC can be found. 

• Future Flexibility: As your Compliance Team matures, you can assign additional team members to specialized roles or activities.  

People@ Subsections 

1. General (Organizational Information) 

• Gender: Select male or female. 

• Profile: Choose whether the person is an employee or works under an individual contract. If they’re contracted as a supplier, select ‘Other.’ 

• Team: Assign team membership based on your organizational structure. This helps in filtering the overview by specific teams. 

• Mentor/Team Lead: Assign a mentor or team lead. This is important for auditors, so ensure a name is provided. 

• Office Key/Card/Code: Record who has access to the office space. If you use co-working spaces or outsourced security, verify whether this is covered by your contract. 

• ISMS Team Member: Check this box if the team member is part of the ISMS team or your Compliance Team depending on the compliance framework. 

• ISMS Role: Specify their Compliance responsibilities or describe their function (e.g., SO, PO, CO). 

• Enable Reminder Notifications: For regular platform users with access to ‘Operational Planning and Control,’ ‘Improvements,’ and ‘Calls-to-Action.’ Reminder emails can be sent if they are assigned as an owner with a deadline. 

• Upload Documents: Add any additional documents you want to use for HR purposes. Set proper access permissions for confidential information. 
  
  
• +Add New Fields: You can add custom fields (e.g., Criminal Record Check)

2. Contact (Personal Information) 

Consolidate all team members’ contact details in one place. Note that the email address field here is reserved for notification mails. For personal email addresses, use the +Add New Field function. 

3. Contract (Contract Details) 

Keep track of contract expiry dates for each team member. This is particularly useful if you’re scaling up or managing contracts of individual contractors.