“We’ll Deal With It Later”: The Expensive Compliance Strategy

Written by James Sanders

Oops Files, Part 5

Many businesses treat compliance as something to address at startup, when a license is due for renewal, or after receiving an uncomfortable letter from a government agency. That approach can work—until it does not.

The problem is that legal and regulatory obligations rarely stay fixed. A business may add employees, open a new location, begin selling into another state, collect more customer information, change its ownership, buy equipment, expand a product line, or take on a new regulated customer. Each change can create new obligations involving taxes, licenses, employment practices, insurance, privacy, recordkeeping, permits, reporting, safety, or industry-specific rules.

The risk is not always a dramatic enforcement action. More often, the cost shows up in quieter but painful ways: a missed filing that delays a transaction; an expired license that interrupts operations; a tax registration issue discovered during due diligence; a contract lost because the company cannot satisfy a customer’s compliance questionnaire; or a preventable claim made worse by incomplete records and inconsistent practices.

A sound compliance program does not need to be bureaucratic. For most small and mid-size businesses, it begins with a practical system that answers three questions:

• What obligations apply to us? Identify the company’s recurring requirements—annual entity filings, tax registrations, payroll and employment obligations, professional or operational licenses, insurance requirements, customer- or vendor-driven obligations, and any rules specific to the company’s industry or location.
• Who owns each obligation? Every recurring deadline should have a responsible person, with a backup. “We thought someone else handled that” is not a compliance system.
• How do we prove it was done? Maintain a simple calendar and organized records: filings, licenses, policies, training records, required notices, tax documents, insurance certificates, and key correspondence. Good documentation is often as important as good intent.

Management should also build compliance review into ordinary business decisions. Before entering a new market, hiring a new category of worker, launching a new product, collecting new types of data, signing a major customer agreement, or changing the ownership structure, pause long enough to ask: What new rules, registrations, permits, disclosures, or contractual commitments come with this decision?

The goal is not to eliminate every risk. It is to avoid being surprised by the predictable ones. A short annual compliance checkup—combined with a habit of reviewing regulatory implications before material changes—can prevent a costly issue from becoming a full-blown business interruption.