BSBCOM603 - Plan and Establish Compliance Management Systems

BSBCOM603
name:jason ceballos correa
code:TS734
1.Research internal and external compliance requirements which will includ
Internal Compliance
The objectives of internal compliance are to:
1. Provide assurance that all key internal policies, codes, standards and controls are being
complied.
2. Provide a framework to assist in achieving compliance.
External Compliance
The objectives of external compliance are to:
1. provide assurance that the organisation is complying with all material external requirements.
2. provide a framework to assist in achieving that compliance.
External compliance may be achieved using a range of approaches. At the more basic level,
periodic manual sign off by management of compliance with external requirements is used. More
comprehensive approaches involve regular compliance attestations by a wide group of
management and staff together with inclusion of non-compliance risk into the ongoing risk and
control self assessment process.
Research plan
Charity-Care is based in Brisbane and is a public company that is limited by guarantee under the
Corporations Act 2001. It is registered as a charity under the Collections Act 1966. The
organization has grown quickly to its current size from its single center opening just two years
ago. Then, this report is conducting research into and proposing an appropriate compliance
management system for the company.
The followings outline the tasks need to be undertaken:
• Research internal and external compliance requirements
• Information security and risk management
• Analyze qualitative and quantitative information to evaluate compliance management
options

• Prepare a report for senior management identifying an appropriate compliance system for
the organization.
Research methods:
Literally, compliance might be defined as certification or confirmation that the doer of an action or
the manufacturer or suppliers of a production, meets the requirements of accepted practices,
legislation, prescribed rules and regulations, specified standards, or the terms of a contracts.
Compliance cannot be viewed as a separate department or activity, but should be aligned with all
of the strategies, objectives and activities of an organization. Good compliance is necessary and
must be reflected in every aspect of the organization’s culture.
Following are some proposed research methods:
• Assess the Board, Management and Staff of understanding the relevance and application
of obligations and responsibilities, in terms of awareness, communication and training
program,
• Assess risk assessments and risk treatment plans,
• Identifying and mitigating areas of risk exposure that could arise from non-compliance,
such as the gap analysis,
• Assess organizational compliance framework performance,
• Review reports related of compliance systems, legislative changes and compliance
breaches,
• Review results of training programs have developed.
survey tools to capture organisational data
• Compliance programs must be relevant and proportionate to the importance of their
desired outcomes.
• Programs to verify compliance must, therefore, be efficient and proportionate to
members’ costs and burden, without compromising desired outcomes.
• Costs of ensuring compliance must be proportionate to the benefits of compliance.
• Review reports related of compliance systems, legislative changes and compliance
breaches.
• Review results of training programs have developed.
overall budget for the compliance management system
the overall account and budget manager will be responsible for compliance management to all
activities in the organization and risk mitigation. he will provide regulations measures and ensure
transparency in accounting practices in the organization. the overall customer services manager
will be responsible for ensuring external compliance with consumer protection by ensuring that
all the activities carried out by the organization meet the interet of their consumers.

the computer care manager will be responsible for ensuring risk management compliance for all
the operational activities for the organization division offering computer care services while the
community care manager will oversee the risk compliance manager for overall functions of the
community care services. however, there is a need to have a global manager who will guide the
risk compliance activities for the organization and act as a link between all the departments and
their businesses. in this case, the charity care CEO will be responsible for these functions.
organisational requirements and criteria for the compliance management system
A management information system (MIS) focuses on the management of information technology
to provide efficiency and effectiveness or strategy decision making. The concept may include
systems termed transaction processing system, decision support system, expert system, or
executive information system. The term is often used in the academic study of businesses and
has connections with other areas, such as information systems, information technology,
informatics, e-commerce and computer science; as a result, the term is used interchangeably
with some of these areas.
Management information systems (plural) as an academic discipline studies people, technology,
organizations, and the relationships among them. This definition relates specifically to "MIS" as a
course of study in business schools. Many business schools (or colleges of business
administration within universities) have an MIS department, alongside departments of
accounting, finance, management, marketing, and may award degrees (at undergraduate,
master, and doctoral levels) in Management Information Systems.
An effective compliance management system is commonly comprised of three interdependent
elements:
• Board and management oversight
• Compliance program
• Compliance audit
• When all elements are strong and working together, an institution will be successful at
managing its compliance responsibilities and risks now and in the future.
internal compliance requirements as described by organisational policy and procedure
documents
The CEO went on to say that many policies are documented; however, there still remains some
training and motivational issues in relation to implementing them appropriately. Some of the
policies include:
Policies Purposes Requirements
Work health and safety policy Providing a safe and healthy
work environment for its
employees, contractors and
visitors.
Charity- Care’s first priority
must always be the well-being
of its employees. No task is so
important that a person’s
safety is put at risk.
incident date
name of person submitted
report
time of incident/hazard
location of incident/hazard
incident/hazard type

description of incident or
hazard
persons involved
witnesses
injuries sustained
description of injuries
actions taken to minimise
hazard or reduce risk post
incident.
Equal employment
opportunity policy
Equal employment
opportunity means that merit
and equity will form the basis
of all employment, training,
and promotion decisions that
affect employees at the
workplace.
Charity-Care accepts that as an
employer it has a
responsibility to eliminate and
ensure the continued absence
from within its structure any
source of direct or indirect
discrimination on the basis of
any factors not related to work
performance including race,
colour, national or ethnic
origin, nationality, sex, marital
status, pregnancy, age, status
as a parent or carer, political
conviction, social origin or
impairment.
Expenses policy The purpose of this policy is to
ensure you are properly
reimbursed for out of pocket
expenses related to direct
expenses for work-related
activities, and that Charity-
Care is able to claim on taxable
expenses.
Meals and entertainment.
Reimbursement of small
expenses/temporary cash
advance.
Financial handling policy To spell out procedures that
must be followed in the
signing of cheques on behalf
of Charity-Care.
All cheques must contain two
eligible signatures
Eligible signatories are board
members or staff members
who have been previously
nominated and endorsed by
the board
Any two of the above have the
authority to sign cheques.
Signatories cannot sign a
cheque made payable to
themselves.

external compliance requirements as described by state/territory regulatory bodies and
statutory requirements, and the Australian standards for compliance, records management
and risk management
External compliance requirements
According to the privacy policy, Charity-Care is committed to protecting the privacy and
confidentiality of our clients and supporters. The Charity-Care supports and is bound by the
Privacy Amendment (Private Sector) Act 2000 and the National Privacy Principles. A copy of the
National Privacy Principles can be found at
<http://www.privacy.gov.au/publications/npps01.html>.
Protecting the privacy and confidentiality of the people we help is essential in preserving dignity
and providing respectful assistance. Personal client information is collected and used by Charity-
Care, only with client consent, in order to provide the best possible assistance and:
• to assess if clients meet eligibility criteria for specific assistance
• for internal reporting purposes
• to continuously develop and improve our assistance programs
• to assess the effectiveness of our assistance programs
• to assess the nature of need in the community
• to plan our future programs.
Consent is always sought in using personal and sensitive information for research purposes. This
information, however, is always de-identified prior to analysis and individual clients cannot be
identified from any research analysis or report.
The Charity-Care also actively seeks to ensure that all personal information we collect is
protected from misuse, unauthorised access, modification or disclosure. We have internal data
protection and electronic data transmission procedures and all donations and communications
made on-line via our web-site are secure.
Risks
Compliance risk is defined as the risk of legal sanctions, material financial loss, or loss to
reputation the Bank may suffer as a result of its failure to comply with laws, its own regulations,
code of conduct, and standards of best/good practice.
Compliance risk is sometimes also referred to as integrity risk, because a Bank’s reputation is
closely connected with its adherence to principles of integrity and fair dealing. In this case, there
is financial issues that caused by misconducts. Compliance risk management is part of the
collective governance, risk management and compliance (GRC) discipline. The three fields
frequently overlap in the areas of incident management, internal auditing, operational risk
assessment, and compliance with regulations such as the Sarbanes-Oxley Act. Penalties for
compliance violations include payments for damages, fines and voided contracts, which can lead
to the organization's loss of reputation and business opportunities, as well as the devaluation of
its franchises.
industry-specific compliance requirements
Compliance is an important element of corporate governance in Australia. Legislators are

initiating the inclusion of comprehensive compliance obligations in laws. Courts have indicated
that the cost of the absence of a compliance program can and should be significant. 3 Therefore,
it is recognised that a compliance program provides an opportunity to not only improve an
organisation’s performance, but also reduce the cost of failing to meet legal and other
obligations.
In terms of accounts receivable policy, its purpose is to define the accounting policies and
procedures in respect of the recording, collection and reporting of moneys owed to Charity-Care.
The intent of all interactions between Charity-Care staff and customers or clients of Charity-Care
is that all inquires are to be handled in a tactful and diplomatic manner.
Under a company structure, charitable or not-for-profit organisations will generally be registered
as public companies that are limited by guarantee. Limited by guarantee means the liability of
the company's members is limited to the amount the members undertake to contribute to the
property of the company if it is wound up.
Registration of a company creates a legal entity separate from its members. The company can
hold property and can sue and be sued.
Companies are registered under the Corporations Act 2001, which is Commonwealth legislation
administered by ASIC. A company's registration is recognised Australia wide.
areas of the organisation most affected by the compliance requirements
From the document of charity-care case study, the areas that affected by compliance system can
be listed below:
• risk management policy
• Sexual harassment policy
• Credit card policy
• Expense reimbursement
• Financial handling policy
• Expenses policy
• Equal employment opportunity policy
• Work health and safety policy
• Audit report
There are many policies are documented, but there still remains some training and motivational
issues in relation to implementing them appropriately. The compliance system that established
will help these policies to improve. In the audit report, there are many issues that should be
included in the audit report, in facts, those issues have not been addressed in the audit report.
In a word, the issue are presented in the following areas:
• Warehouse
• Retail store
• Counselling centres

• Head office
These areas have been found many misconducts, some operations those areas have done are
not following the organisation principles.
organisational compliance data, including, for example, financial fraud, accident figures,
training numbers, customer complaints, etc.
complaints management system
Using the Australian Standard for complaint handling as a reference, participants are given
guidance about what good complaint policies and systems should look like. We examine cultural
and organisational issues relating to complaints, and provide an opportunity to learn how to use
complaints to improve service delivery. Participants are given the chance to apply what they
have learned by reviewing their own agency’s complaint handling systems.
It is designed for staff responsible for developing, managing or implementing complaint handling
policies and systems, including quality assurance, corporate governance managers.
Complaint management workshops specifically tailored for staff working in the community and
disability services sector are also available:
• Implementing a quality complaint management system - community services
• Implementing a quality complaint management system - disability sector
financial fraud
A poor compliance may also invite financial problems for the company. The investors and fund
providers may lose confidence in the organisation and in the worst case, they may also stop
funding the Charity Care.
risks involved for non-compliance with requirements
in terms of not-for profit policy, at a very least Charity-Care must:
• Have at least three directors and one secretary.
• Have at least one member.
• Have a registered office address and principal place of business located in Australia.
• Have its registered office open and accessible to the public.
• Be internally managed by a constitution or replaceable rules.
• Maintain a register of its members.
• Keep a record of all directors' and members' meeting minutes and resolutions.
• Appoint a registered company auditor within one month of its registration.
• Keep proper financial records.
• Prepare, have audited and lodge financial statements and reports at the end of every

financial year.
• Send to its members a copy of its financial statements and reports, unless the member
has a standing arrangement with the company not to receive them.
• Hold an annual general meeting once every calendar year within five months of the end
of its financial year.
penalties for breaching compliance requirements
A breach occurs when the law is not upheld; when:
• an action is taken that places a person at risk of injury, illness or death
• steps are not taken to avoid a risky situation from occurring
• there is a failure to comply with regulatory requirements.
There are three categories of offences for failing to comply with a health and safety duty under
the WHS Act or an electrical safety duty under the ES Act, depending on the degree of
seriousness or liability involved.
Category 1: the highest penalty under either the WHS Act or the ES Act is for a category 1
offence, These are the most serious breaches where a duty holder who recklessly endangers a
person to risk of death or serious injury. Offences involving reckless conduct, will be prosecuted
in the District Court.
Corporation: up to $3 million
Individual as a person conducting a business or undertaking (PCBU) or an officer: up to $600
000 / 5 years jail
Individual e.g. worker: up to $300 000/ 5 years jail.
Category 2: failure to comply with a health and safety duty or electrical safety duty that exposes
a person to risk of death, serious injury or illness. Offences will be prosecuted in the Magistrates
Court.
Corporation: up to $1.5 million
Individual as a PCBU or an officer: up to $300 000
Individual e.g. worker: up to $150 000.
Category 3: failure to comply with a health and safety duty or electrical safety duty. Offences will
be prosecuted in the Magistrates Court.
Corporation: up to $500 000
Individual as a PCBU or an officer: up to $100 000
Individual e.g. worker: up to $50 000.
• Risk minimisation
• Proof of regular meetings: minutes, agendas, notes, presentation slides, etc.