An organization’s compliance obligations come from what it does, where it operates, whom it employs or serves, the information it uses, and the commitments it accepts. A policy manual does not establish that those obligations have been identified or met.
The useful starting point is a concrete change: a new state, a different workforce arrangement, a new use of data, a fundraising campaign, or a complaint suggesting an existing process has failed. This guide explains the decisions those changes can create.
Identify the source of the obligation
A legal requirement, a contract promise, an accreditation condition, and an internal policy can all constrain the same activity. Their consequences and available responses differ.
- Law: a statute or regulation may require permission, prohibit conduct, or impose reporting duties. A manager’s exception cannot waive it.
- Contract: a customer, funder, or supplier agreement may impose obligations beyond the legal minimum. Changing them may require the counterparty’s agreement.
- Accreditation or program rules: eligibility or recognition may depend on continuing compliance with specified standards. Losing that status can threaten the program even without a government penalty.
- Internal policy: an organization can change its own rules through the proper authority, but that change does not erase external duties or representations already made.
For example, a provider’s internal approval of a new subcontractor does not satisfy a customer contract requiring the customer’s prior consent. The useful question is which obligation remains unmet and what options can resolve it.
A new activity or location can require a new permission
Entity formation, authority to do business in another state, charitable registration, and occupational or activity licensing address different questions. Completing one does not complete the others.
An Illinois fundraising campaign can trigger charitable-registration analysis even when the organization already holds federal tax-exempt status. A brand-license program can require franchise analysis when its operating controls, assistance, and payments change. A corporation’s continuing local operations in another state can raise qualification requirements.
When Growth Changes Your Licensing and Registration Obligations examines those examples and links to the relevant primary sources. The analysis belongs before the organization commits to a launch date it may be unable to meet.
A workforce arrangement can change through practice
A consultant engaged for an independent project may gradually become an embedded manager, working indefinitely under the organization’s direction. Continuing to pay invoices through the consultant’s LLC does not settle worker classification.
Different tax, wage, benefit, and state-law tests can apply. The consequences can include withholding, wage and overtime exposure, and benefit disputes. Independent Contractor Classification Risk compares two working relationships and explains why the contract label is insufficient.
A new data use can exceed the original permission
A program may collect information for registration, export it to a service vendor, and later enable an AI feature using the same records. The organization has not necessarily approved or disclosed that later use merely because the vendor was previously approved.
The review needs to connect the information, purpose, contractual permissions, applicable privacy requirements, and actual product configuration. A no-training promise addresses one issue; it does not by itself establish permitted retention, human access, or deletion.
The Technology, AI, and Data Risk Guide and Data Privacy article develop those decisions.
Funding and advocacy can change the exempt-organization analysis
A public charity, social welfare organization, and trade association operate under different exemption rules. A familiar label such as education does not establish that a program advances the organization’s exempt purpose. Donor restrictions and grant conditions can further limit the use of funds.
A candidate appearance can also raise a different issue from lobbying about legislation. Section 501(c)(3)’s campaign-intervention prohibition cannot be addressed by treating all public-policy activity as one category.
See Choosing the Right Exempt Structure and Political Activity Rules. An affiliate arrangement needs real separation of resources and responsibilities, not simply a second entity name.
A policy must survive the commercial decision it governs
Suppose operations must approve customer security commitments, but sales can sign a deal before operations responds. The policy exists, and the tracker may accurately show unanswered requests. The business still has no effective decision before the promise becomes binding.
The solution may involve approval capacity, a limit on signing authority, or a defined route for resolving disagreement. Another policy statement does not cure a process that routinely permits commitments before review.
An internal exception can authorize departure from an internal preference. It cannot waive a statute, change a customer’s contract, or remove an accreditation condition. Leadership needs to know which kind of exception it is being asked to approve.
A complaint can reveal both a problem and a reporting failure
A report involving senior leadership may require a different route from an ordinary operating complaint. The person receiving it needs to consider independence, immediate exposure, preservation of relevant information, and who is authorized to oversee the response.
An investigation does not necessarily suspend external notice deadlines under law, insurance, grant terms, or customer agreements. Different audiences may also have different rights to information. An Internal Complaint Reaches Leadership addresses these decisions.
Closing a finding requires evidence of the change
A revised policy can be one part of remediation. It does not show that the vendor now provides needed records, that a required filing has been accepted, or that sales can no longer bypass approval.
Leadership needs the unresolved obligation, the decision or resource required, and evidence of what changed. The board’s reporting role is addressed in Board Oversight and Information. The DOJ’s Evaluation of Corporate Compliance Programs also examines operation in practice, within its specific federal criminal-enforcement context.
Org Law’s Compliance Program Governance work connects these obligations to actual organizational decisions. The scope should follow the organization’s activities and material problems rather than add a uniform compliance bureaucracy.
