A compliance program built from scratch rests on four parts: a written risk assessment, a short set of policies mapped to the rules that actually apply, recurring training tied to real job duties, and an audit trail that proves the first three happened. The order matters more than the volume. Firms that start by buying templates rarely finish; firms that start by listing their obligations usually do.
The qualification for a small business is scope. Most small firms face a handful of binding obligations, not a rulebook the size of a bank's, and the program should be sized to the rules that name the business — not to a large firm's structure borrowed wholesale. This explainer walks the sequence in the order a regulator or examiner will ask about it: what risks exist, what the firm wrote down, who it trained, and what evidence survives.
For context on how supervised firms split these duties across roles, see Compliance Staffing Models: Sizing and Structuring a Team for Supervised-Firm Requirements; most of that structure compresses into a single accountable owner at small scale. This connects to our earlier piece, Compliance Staffing Models: Sizing and Structuring a Team for Supervised-Firm Requirements.
What comes first: the risk assessment or the policies?
The risk assessment comes first, and writing policies before it is the most common early mistake. A risk assessment is a written list of the firm's activities, the legal or regulatory rule attached to each, and a judgement about where failure is most likely. It does not need software. A spreadsheet with four columns — activity, rule, likelihood, owner — is enough at small scale.
The assessment sets the scope for everything after it. A firm that handles consumer payment data, for instance, will find data-protection and record-handling rules on its list; a firm that extends credit will find disclosure and notice obligations. Policies written without the assessment tend to cover whatever the template vendor included, which is rarely what the firm actually does.
Revisit the assessment at least annually and whenever the business changes — a new product line, a new state of operation, a new vendor. Firms that document their compliance risk assessment in a form an examiner can follow have a worked example of the discipline involved; the same documentation habit applies at any size.
How should a small firm write its policies?
Write one policy per identified risk area, not one binder. Each policy should answer four questions in plain language: what rule or risk this covers, who must do what, when, and who checks. Two to four pages each is normal. A policy nobody can find or read is worse than no policy, because it creates a paper record of an obligation the firm never operationalized.
Three policies exist at nearly every small business regardless of sector: a code of conduct covering conflicts of interest and gifts, a records policy stating what is kept and for how long, and an incident or escalation policy stating who gets told when something goes wrong. Sector-specific obligations — privacy, anti-money-laundering, employment law — layer on top of those three, and they come from the risk assessment, not from a checklist.
Each policy needs a named owner, a version number, and an approval date. When a rule changes, the owner updates the policy and the version bumps. That single habit — versioned, dated, owned — is what separates a living document from a filing-cabinet ornament.
What does training that actually works look like?
Effective training is short, role-specific, and scenario-based. A generic annual slideshow teaches employees that compliance training is ignorable; a fifteen-minute session built around a scenario from the firm's own work — a suspicious payment request, a customer data mishap, a gift from a vendor — teaches the escalation path. The general design principle is the same one explored in scenario-based compliance training for analyst teams: put the person in the decision, not in the definitions.
Structure it in three passes. First, onboarding training for every new hire covering the code of conduct and escalation duties. Second, annual refreshers keyed to the risk assessment's highest-likelihood items. Third, targeted refreshers when an incident or a rule change makes a topic live again. Keep a sign-in or completion record for every session; that record is part of the audit trail.
What should the audit trail capture?
The audit trail is the evidence layer: dated records showing the program operated, not just existed. At minimum it should capture policy versions and approvals, training completion records, incident logs with resolution notes, and records of any periodic review the firm performs. Design choices here matter more than tooling, and the practical questions examiners ask about audit trails — what exists, who created it, when, whether it is tamper-evident — apply to a shared folder as much as to a database. For related coverage, see Designing Audit Trails for Regulatory Inspection: What Examiners Actually Look For.
Retention discipline belongs in this layer too. Every record the trail produces needs a retention rule, or the firm accumulates either too little evidence or an unbounded pile of it. Record retention schedules and the periods firms apply are covered separately, and setting them is a policy decision made once and then applied automatically.
One practical test: pick any policy at random and ask whether the firm could, within an hour, produce dated evidence that it was trained on, reviewed, and followed in the last cycle. If the answer is no for most policies, the program is a document set, not a program.
What this means in practice
For a small business starting from zero, the sequence compresses into five steps:
- List the firm's activities and the rule attached to each, in writing, with an owner per line.
- Draft one short policy per risk area, each with an owner, version, and date.
- Train by role and scenario, and log every session.
- Keep dated evidence of operation — approvals, completions, incident logs — in a structure that can be produced on request.
- Review the risk assessment annually and after every material business change.
The through-line is accountability. Every artifact has a named owner and a date, and every obligation the firm writes down has a matching record of execution. That pairing — obligation plus evidence — is what a regulator, a customer's due-diligence team, or an insurer's underwriter will look for first. The law described here varies by jurisdiction and sector, and the binding rules for any specific firm come from its own risk assessment, not from a general sequence.
