Compare policy with a real decision
A compliance policy matters only if staff can follow it. Choose an actual approval, supplier onboarding or gift request in the Kuwait operation and trace who decided, which checks were made and what evidence remains. If the written policy names a committee that never meets, fix the process or the document. Follow the selected file from intake through counterparty screening, approvals, payment and archiving. Compare names and signing limits in the policy with actual system rights, and record any off-system approval with its date and reason.
Give exceptions an accountable route
Record policy versions, training, approvals and any exception. Who can approve an exception, who spots a conflict and when is an issue escalated? Restrict access to sensitive reports but do not erase original messages or ask employees to agree on a single account of events. An exception log should name the decision-maker, reason, expiry and follow-up test. Separate routine approvals from whistleblowing or misconduct intake, and avoid assigning a complaint to the person whose decision is questioned.
Test an incident carefully
A report is an allegation, not a finding. Preserve original records, assign an independent reviewer and consider employment and confidentiality implications before interviewing people or communicating externally. Current Kuwait requirements should be reviewed with qualified advisers against the actual subject and facts. Record when the issue was raised, who holds the source material, and who may see it. Agree the investigation scope and conflict check before interviews. Verify applicable obligations for the sector, parties and nature of the allegation instead of treating every incident as identical.
Improve the control with evidence
After review, distinguish what happened from why a control failed. Set a named owner, deadline and test for changes. A dashboard showing every worker clicked “trained” does not prove the checks work. Repeat a sample transaction to verify the new procedure, keeping the old evidence intact. Rerun the exact approval route that failed, from request to payment, and keep a log of what passed, what failed and what remains open. An independent reviewer should be able to reproduce the retest without rewriting the initial evidence.
Working review file
- Collect the active policy version and one dated transaction or exception.
- Reconcile stated controls with actual approvals and system rights.
- Separate complaint intake, fact review and final decisions.
- Record remediation, owner, deadline and a repeatable retest.
For related work, see our compliance and regulatory practice and white-collar compliance practice.