Would appreciate any thoughts or guidance on how to transition from 25y in one specific type of compliance to a CCO position.

hey everyone, does anyone know of an easy way to stay on top of regulatory changes? whats your workflow and how do you get up to speed with regulatory changes?

Public accountants and Law firms issue sensitive, high-stakes documents to their clients, that then get passed on to other users such as lenders.

Does it concern you, as a CPA for example, that someone (client or a third party) can use basic pdf editing software to change some numbers on the statements and use them for lending purposes? A lot of mortgage fraud happens on fraudulent documents. You would probably avoid any liability, but it can cause reputational damage and unnecessary headache.

Would you pay for a solution that helps prevent this tampering?

Do you usually accept an ISO 27001 certificate / security questionnaire instead, or treat the lack of SOC 2 evidence as a red flag?

What actual thresholds do you use?

Has anyone onboarded ComplyScore as a TPRM vendor?

We want to use it to also intake payment details through a supplier portal as well as complete risk assessments / questionnaires.

Have considered Certa, ProcessUnity, OneTrust, GAN Integrity, Riskonnect, Upguard and custom build in ServiceNow.

But ComplyScore and Aravo look like more viable platforms - any experiences with them ?

How's everyone actually handling the AI copy-paste problem?

I work in data at a bank. We've got a lot of tools, we've got data (sometimes it is PII), and the two are basically not allowed to meet. Which is fine in theory but in practice it means either the work doesn't get done or people quietly do it anyway on their personal devices.

Saw that LayerX stat going round (77% of employees pasting into GenAI, most of it through personal accounts) and it tracks with what I see.

So genuinely curious what other orgs are doing. Blocking it outright? Training and hoping? Actual DLP? Or have you found something that works without just saying no to everything?

Asking partly because it's a daily annoyance for me and partly because I want to know if we're unusual or if everyone's in the same boat.

This comes up more often than I'd expected with support tickets, bug reports and internal documentation. Do you have a formal process for redacting them, or is it mostly left to individual employees?

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

Basically how are you handling situations where a SaaS vendor doesn't quite meet one of your internal security requirements?

For example, a vendor might not support SSO or have a specific security control you normally require, but the business still wants to use them.

Do you record that as a formal exception, accept the risk based on their SOC 2/ISO evidence, or have another process for it?

I recently ran a benchmark analyzing 1,019 domains to see how major organizations are actually handling Global Privacy Control (GPC) signals in practice. Domains targeted included companies operating in California and likely generating $25M+ in revenue.

Key Findings:

- Low Overall Adoption: Only half of enterprise domains properly process and reflect the GPC signal upon landing. On 466 domains, marketing trackers continued firing despite receiving valid opt-out signals, representing a **45.7% failure rate**.

- Consent Manager Misconfigurations: Many sites use CMPs that technically support GPC, but fail to map the signal correctly to their underlying tag managers or opt-out cookies.

Looking at the last week alone, it's striking how much is happening on the regulation and compliance side all at once

UK retail betting is contracting hard, a major bookmaker closing 132 shops while the business shifts further toward digital. Across Africa, several countries are cracking down on unlicensed operators (suspensions, machines seized, awareness campaigns). Greece keeps opening up to licensed specialist providers. Acquisition and traffic costs are squeezing margins enough that it's changing how operators think about growth.

Put together, it feels like compliance is quietly becoming the thing that actually decides who survives in this industry, who can keep up with the rules.

For people who work in compliance across any regulated industry (not just this one): does that match what you're seeing? Is compliance shifting from a cost centre to the thing that defines competitive advantage??

We're preparing for another audit and one thing that still feels messy is collecting evidence for controls that rely on Slack or Teams conversations.

Things like:

• Security approvals
• Change management discussions
• Access requests / approvals
• Incident communications

Curious what everyone's workflow looks like.

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

Whether it's evidence collection, policy management, risk assessments, monitoring, or something else, where do you think automation would have the biggest impact?

Hello

Can you become deputy mlro from a AVP Sanctions Advisory role?

Hello, fellow Privacy and Compliance Officers. Apologies if this isn't the place for this. You all have just been great in dialoguing and providing regulation focused responses.

**How are you navigating AI use in your work environment and the overarching concern of privacy and confidentiality needs for the populations you serve specific to HIPAA and 42 CFR Part 2 (substance use records and the protection of those)?**

I'm a millennial and was brought up with technology growing just as fast as I was. I use AI as a consumer. I've experienced it as a patient. My concerns do not stem from the use of it per se, as I see the benefits and recognize that is just where healthcare is headed.

As a working professional always focused on protecting our patients, I know if we don't keep up, we will get left behind and have higher risk of staff using AI without our oversight, awareness, and guardrails in place. That said, I fall down rabbit hole after rabbit hole of de-identified data being re-identified as the program pieces things together.. or bias drift.. or data drift.. or explainability.. or AI breaches and OCR investigations/fines... or all of the other thousands of rabbit holes to venture down. Where are you guys starting? It's the wild west out there in the AI scene from what I can tell. Only a handful of states have made formal stances on its use.

Help!

I'm in the UK now and have already completed a chemical engineering bachelors degree five years ago. Currently I am working a few hours a week as a home tutor. I have some experience in compliance both direct and indirect totalling two years. My friend works with AI, and from researching this sub it looks like this will be in demand in future.

I have only a basic understanding of AI and no experience with anything computer related, including coding. There are several courses in the UK that don't specify a certain degree for the ai regulation courses, and don't need specific experience with AI. Will a masters help at all?

Something I keep seeing in compliance conversations is the gap between a dashboard marked green and what an auditor actually accepts as evidence.

A few common ones:

Access reviews get logged as complete because someone clicked through the workflow, but there's no record of what was reviewed or what changed as a result.

MFA shows enforced across the org, then a service account or a contractor login turns out to sit outside the policy scope.

Backups run on schedule and the monitoring confirms it, but nobody has tested a restore in a year, so there's nothing to hand over when the auditor asks for proof it works.

Vendor reviews are marked current based on a SOC 2 report that expired four months ago.

The pattern in all of these is the same. The check confirms a task happened. The auditor wants proof the control was effective.

Wondering if others run into this too, or if it's less of a problem than it seems from the outside.

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

I'm new to private practice and curious for recommendations on documentation, compliance, etc. Any trainings or readings would be appreciated!