272
Having spent most of my career working in the highly regulated financial services industry, complying with banking or securities requirements is an industry unto itself. Organizations have hundreds and maybe thousands of people dedicated to overseeing risks, generating reports and building systems for generating more reports for one purpose: complying with the strict requirements of various financial regulators. But is that actually risk management?
I submit if you are only doing what a regulator is telling you to do then you’re not practicing risk management. You’re practicing compliance.
Do you remember when you were a kid and your parents made you take a bath every night or brush your teeth? This was compliance. Bathing and brushing were activities you didn’t want to do but you had to do. (Be honest: would you have showered or brushed if your parents hadn’t made you?) As an adult, you probably shower every morning and brush twice a day because proper hygiene is a habit (and you probably like smelling clean and not having stinky breath).
ACMPR is like your parents: Most of the prescribed controls and pro-cedures it demands are performed for compliance reasons. (Be honest: would you build a safe or maintain pharmaceutical level quality if the Minister of Justice or Health Canada didn’t make you?)