Compliance as a programme
A security or compliance mandate that touches many systems, led as a strategic effort with ownership, sequencing by risk, explicit capacity, honest roadmap impact and reporting. The alternative is spreading it across every team as a small tax.
Evidence grade: practice A widely adopted practitioner model with clear provenance.
Use it when
Any mandate that requires changing systems across the organisation.
Where it stops working
It costs visible capacity, and that is deliberate. The alternative is a mandate squeezed into slack until the deadline is missed.
Where the standard uses it
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Used alongside it
- Privacy by design practice
- Risk-based triage practice
- Security of AI-generated code research
- Threat modelling practice
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Compliance as a programme. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.compliance-as-a-programme). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/compliance-as-a-programme