*Published First in CEP Magazine: Salata, Kerri & Carbonelli, Loretta, “User-Centered Compliance: How Service Design Can Get You a Seat at the Table.” Compliance & Ethics Professional (CEP) Magazine, May 2025 (Online at Society of Corporate Compliance & Ethics (SCCE) Publications: https://www.corporatecompliance.org/publications-hub?authkey=5435e99311cb7aec46102ab78e2ec54a5ed5303734f0fee3593e0bfbabf6e040).
Punchable Compliance Officer Colouring Page
TEXT ONLY VERSION:
User-centered compliance: How service design can get you a seat at the table
By Loretta Carbonelli and Kerri Salata
- Loretta Carbonelli (lorettacarbonelli@ventumfinancial.com) is a Chief Compliance Officer for Ventum Financial in Toronto, Ontario, Canada.
- Kerri Salata (kerri@kerriasalata.com) is Founder and CEO of Comply With Me in Toronto, Ontario, Canada.
Over the past few years, as compliance professionals we’ve seen a dramatic evolution in the securities industry in Canada. The practice of compliance has moved from a rule-based system to one that’s more principle-based, which means we need to consider the spirit of the rules and the outcome of the advice we provide to our clients.
Compliance professionals are no longer required to spit out, “thou shall not do this” rules. Rather, our programs need to shift to helping the client-facing teams understand the bright lines (do not do) versus the gray areas (could do). In other words, transform from a department of “do what we say” to one that is a helpful service delivery model.
Combined, we have nearly 45 years of experience acting in various compliance and risk-related roles from chief compliance officer to head of governance and registration. We’ve both worked in banks and for securities firms, building and improving compliance programs, reporting to boards, working with regulators, and remediating issues—all the while trying to manage a business that may question our guidance and purpose. Though we come at it from different perspectives, based on our many (many) years of experience, we both share the same philosophy about the role of a compliance department: The compliance department is a service provider, and its role is to deliver a strong, reliable, and repeatable compliance program while allowing the business(es) to operate effectively.
Compliance professionals need to rethink how we interact with the business by changing how we view ourselves. While your face may be prominently featured on the company’s website, it does not mean that you should consider yourself more important than those you’ve been hired to help. Approaching compliance with a hierarchical attitude makes the business see you as “punchable” (in a figurative sense) and not necessarily a team player. You become the barrier (refer to our punchable compliance officer as an example of what you should aim not to be).
Instead, by thinking strategically about how to provide advice and guidance to the business without feeling compelled to regurgitate the rules and wag a finger, by focusing on building relationships and bridges, by prioritizing clarity and the users of compliance’s program, and by using some key strategies in design thinking, we can go much further as professionals. What happens if we become a service delivery provider? What happens if we consider that we’re here to help business deliver the very best they can to the customer?
Our message is simple, turn delivering your compliance program into a service and start seeing yourself as the service provider, and, my friends, you’ll get a seat directly at that business table.
The problem: You’re not wanted
Before we get to potential solutions, let’s discuss the problem. It’s a sad truth, but the biggest issue is that while the businesses ultimately need you to guide them and ensure the regulators do not shut down their operations, they don’t always want you at the table.
At the SCCE Compliance & Ethics Institute in Grapevine, Texas, at 8:00 a.m. on the last day, we spoke to a packed room of people (bless them all!) interested in talking about how to deliver better service to their businesses. One compliance professional shared that his worst experience was sitting in a meeting room and being told, “Just because you have a seat at this table, doesn’t mean you’re wanted.” All attendees responded with “boos,” shock, and even some laughter. Ouch! But do you blame the business?
For too long, the compliance group has been hated, feared, yet needed by the business to ensure they are meeting their regulatory requirements. Sure, the compliance group helps them successfully launch products and perform their roles in accordance with the laws and requirements, but it does not mean they are always wanted at the table.
The lines of business too often attempt to achieve, to innovate, to do their job of selling only to be told, “Nope, you can’t do that!” Compliance is the crusher of dreams. So, it only makes sense that the compliance group is brought in at the last minute, when the project is nearly complete, the budget dollars spent, and all the executives have been pre-primed for a launch date. The compliance group then waltzes in, professes that there is some “law” that needs to be met or governance process to establish, and that either slows everything down or leaves everyone scrambling to meet a specific deadline.
Wouldn’t it be great if the compliance group was the first call instead of the last?
You can do it! You can rethink the way you deliver compliance services to the line of business by thinking of yourself as a service provider.
Use design thinking
To deliver great services to the business, compliance professionals can use design thinking. Design thinking is a methodology that started around the 1950s but became more popularized by IDEO, a company focused on “human-centered design.” This methodology can be used in a variety of practical ways from designing the next technological innovation to delivering effective services. Ultimately, people are the recipients of the service, and so focusing on the recipient of the service can help improve efficiency and allow the compliance group to deliver more useful services.
Delivering a compliance program is not like designing the next iPhone 3000. (For clarity, this product does not exist, so you do not have to start lining up yet.) Instead, with service design, “people are the heart of services.” Great services have some common characteristics: they are efficient, consistent, valuable, and lead to returning customers. Similarly, compliance programs should be reliable, repeatable, and understandable by the business. The compliance group is there to help the business “shine” and deliver consistently to their clients. Also, the best services just “happen” in the background, chugging along while the user—the business—is completely unaware (sneaky, eh!). Instead of thinking about service design as serving a cup of coffee, you are serving compliance with a side of clarity!
The design thinking methodology steps can vary but generally include: empathy, defining, ideating, prototyping, and testing and iteration (see Figure 1). The methodology is more effectively used when following all of the steps, but we will focus on only three of those steps to get you thinking differently about delivering compliance as a service to your business.
Figure 1: Design thinking methodology
Image designed by Amy Lloyd.
Step 1: Empathize
This is not a “There, there,” pat-on-the-back definition of empathy. This stage is about actually listening to the users.
The tricky part is to figure out who the users are of compliance’s services. When delivering a compliance program, that could include multiple groups and individuals: the business that uses and relies on the compliance program, the corporation’s client who purchases the products (or the service), stakeholders, third parties, or the board of directors. Any of these groups or individuals can be a user.
Once you identify the user(s), it is important to figure out how they think, operate, what they need, and what makes them tick.
Step 2: Identify the problem
What is it that the business needs? What is the issue you are trying to solve?
One SCCE attendee shared with us that she did not know about an issue that cropped up for nearly nine months after the issue started to percolate in the business. During that discussion, we encouraged the attendee not to look directly at the big issue but instead to look at the root cause. What led to the problem? Is it possible that there were a few potential causes: the failure of a clearly written and articulated policy, the failure in educating the business about the regulations, etc. Also, in this scenario, it is important to consider why the employee never felt comfortable speaking up earlier. The speak-up culture of the company may require some reconsideration.
Ultimately, by identifying the root cause of the issue(s) and by not by focusing on the problem itself, it will help you to articulate potential solutions.
Step 3: Ideate
This is the design thinking step where most compliance professionals shine since they are used to solving problems.
Ideating is the process of coming up with ideas that help to solve the user’s problems. Those ideas can require big budgets and better infrastructure, or they can cost little to no money at all to implement. Sometimes just simply redrafting an important form into a fillable PDF that simplifies the process and reduces the amount of back-and-forth between compliance and the business will create massive efficiency and, ultimately, a better user-experience.
When ideating, think of it like brainstorming. When you have multiple people at the table, a solution to the problem might already exist, and the compliance group might not even know about it. For example, you might have a readily available solution, like a technology or system that allows compliance requirements to be baked into the tools used by the client-facing team. Maybe the compliance group can leverage that technology to allow for a better customer experience, remove delays in both time and costs, provide transparency on the status of a request, and allow the sales team to perform at their best. If technology can help client accounts and transactions be approved efficiently and rapidly, the tension between the compliance group and the business can be alleviated, leaving more time for compliance professionals to provide effective guidance to the business and the field to look like superstars to their customers. Who doesn’t want to open an account and transact on it quickly with the compliance requirements happening in the background and no one noticing?
These are just a few ways that compliance can use ideating to come up with simple, cost-effective solutions.
Better service = better user experience
Once you begin thinking about compliance as a service, you will start to look for efficiencies throughout the compliance program and in your delivery of that program. The most effective compliance programs operate in the background and the business does not even know it, but to get there, compliance professionals have to first admit (deep breath) that they do not have all the answers. Sometimes, they need to ask the user what they want.
By shedding that superiority complex, seeing yourself and your group as part of a team who is there to deliver a really fantastic service, and then delivering that solid service to the business, the compliance team can create efficiencies, build rapport, and gain trust. This means that when things do go horribly wrong, as they inevitably will at some point, the compliance group becomes the first one the business reaches out to.
You’re no longer the last one at the table or the one who isn’t wanted there. You’re the one they pull out the seat for who gets the first choice of the best cookies.
Takeaways
• Aim not to be a barrier. Be the bridge.
• Rethink how you’re delivering compliance to the business. You’re a service provider.
• Use the design thinking methodology as a guide to providing better services to the business.
• Focus on understanding the needs of the end-user, or “empathizing.”
• Model your compliance program as a service. The best services are reliable, repeatable, understandable, and lead to returning “customers.”
[1] Punchable CCO coloring page, Comply With Me, https://compliancecosmos.org/punchable-cco-coloring-page?authkey=d1d8fecb5b986fad2ed24de871945e1ba60584fcea354862546976530b7c6a03.
[2] IDEO Design Thinking, “History,” https://designthinking.ideo.com/history.
[3] Andy Polaine, Lavrans Lovlie, and Ben Reason, “Service Design – From Insight to Implementation” (2013: Rosenfeld Media, LLC, N.Y.) at 36.
*This blog is not legal advice. Kerri A. Salata is also the CEO of Comply with Me – complywithme.ca