June 19, 2026
Assumed compliance is one of the most common risks I encounter when working with businesses.
Somewhere along the line, a policy was approved. A process was documented. A training session was held. An email was sent. Everyone nodded. Everyone agreed. And then the business moved on.
Months later, or sometimes years later, people still believe the process is being followed because nobody has seen any evidence that it isn’t. The assumption becomes the control.
As compliance professionals, we see this all the time. A manager tells you a process is happening because it has always happened. A business owner tells you a control is operating because it was implemented years ago. Staff tell you they know the procedure because they attended the training.
Then you start testing. You review files. You sit with teams. You observe the process in practice. And suddenly the reality looks very different from the assumption.
The gap is rarely created by bad intentions. Most people are trying to do the right thing. The problem is that businesses evolve. People leave. New shortcuts appear. Workloads increase. A temporary workaround becomes a permanent process. Small adjustments are made to solve immediate problems and, over time, the business quietly drifts away from what was originally designed. And that drift is often almost invisible from the inside.
This is one of the reasons I believe compliance professionals need to spend less time simply distributing policies and more time helping the business understand how those policies should translate into day-to-day behaviour. Because compliance is not proven by the existence of a document. It is proven by what happens on an ordinary Tuesday afternoon when nobody is preparing for an audit, a monitoring review or a regulator visit.
The businesses that are preparing well for COFI are starting to understand this distinction. They are moving away from asking, “Do we have a process?” and towards asking, “How do we know the process is actually being followed?” That is a far more useful question.
What’s one area in your business where compliance may be assumed rather than actively verified?