| |
By Bill Murphy · Powered by Colony Spark |
THE OPERATIONS
BRIEF |
|
ISSUE #21 · AUGUST 7, 2026 |
|
| |
|
| |
|
Hi ${first_name},
Compliance used to arrive as a date on the legal calendar. It now arrives as a claim on the week: evidence requests, vendor reviews, access checks, training renewals, and approvals that land on people whose calendars are already full.
This issue is about making that load visible. The fine is the part everyone can see. The interrupted capacity is the part that never shows up in one place, which is exactly why it never gets scheduled.
Bill
|
| |
Compliance Work Is Becoming a Capacity Plan.
Compliance is moving out of the legal calendar and into the operating plan.
The requirements are not arriving as one clean project with a start date and a budget line. They are arriving as dozens of recurring tasks: evidence requests, vendor reviews, access recertifications, training renewals, approvals. Each one lands on someone who already owns production, quality, purchasing, finance, or IT.
Five signals make the same argument from different directions.
|
Five signals from 2026
· The IIA Third-Party Topical Requirement takes effect September 15, 2026, and is mandatory for any internal audit engagement touching third-party risk. It sits inside a fast rollout: Cybersecurity effective February 5, 2026, Organizational Behavior effective December 15, 2026 (The IIA, Vendor Centric).
· Manufacturers pay an average $29,100 per employee per year on federal compliance. Small manufacturers under 50 employees pay $50,100 (NAM).
· 68.4% of total manufacturing compliance cost is labor, which is the whole point: compliance is a people-capacity line (NBER).
· 11% to 40% of third parties rate high-risk, yet most programs still assemble the supporting evidence reactively across email, shared drives, and disconnected systems (Gartner via Atlas Systems).
· Organizations that stay audit-ready year round report roughly 40% lower audit prep effort. That gap is the capacity story (Atlas Systems).
|
The NAM figure establishes the scale. The NBER figure identifies the mechanism. Compliance cost is largely employee time, which means it is capacity, and capacity is already committed to something else. A plant that budgets for compliance as an occasional event is budgeting for the wrong thing.
The interruption mechanism is always the same. A request arrives. The owner is unclear. Evidence has to be located. Quality, purchasing, IT, finance, and operations each surrender fragments of a day. The total never appears in one place, so leadership sees the missed work but not the load that caused it.
The operators handling this well are not the ones with the thickest binder. They do not wait for the auditor to create the work queue. They keep evidence where the work happens, name an owner and a backup, set a review cadence, estimate the hours, and reserve capacity before the due date.
|
Where does compliance demand appear in your weekly capacity plan today?
|
|
|
| |
It is not a footnote. It is scheduled work.
Miguel Ramirez, VP of Operations at Fresca Foods, on what food-safety compliance costs in people and time
Miguel Ramirez runs operations at Fresca Foods, a food manufacturer in Louisville, Colorado. Speaking with Food Safety Magazine in June about building and maintaining a food-safety culture, he described compliance as work that has to be operationalized across levels and shared between quality and production, not parked with the QA team or saved for audit week.
|
Doing it properly can mean adding people and accepting a different cost structure. The training and coaching are not a one-time spend either.
|
The operational detail is the interesting part. Moving monitoring checks from QA alone to QA plus production took time to implement, but it put ownership on the floor, where the work actually happens.
That is the capacity story in operator language. The audit is the visible event. The real workload is the recurring monitoring, training, verification, and cross-functional follow-up required to keep the evidence true. Ramirez is not arguing for less rigor. He is saying the rigor needs labor, time, and operating ownership.
|
The takeaway
If a recurring check needs production, quality, IT, or purchasing time, it is not an administrative footnote. It is scheduled work. Put it in the same conversation as labor coverage, maintenance, changeovers, cycle counts, and customer commitments.
|
|
|
| |
The Compliance Capacity Calendar.
Every obligation mapped to the people, hours, and interruption it will claim.
One weekly view of compliance demand, sitting inside the operating plan instead of beside it.
The pattern across mid-market operators is consistent. The compliance calendar lists deadlines. The operating calendar lists labor, production, inventory, customer work, maintenance, and close activities. The two calendars meet only when a request becomes urgent.
The Compliance Capacity Calendar is a recurring planning layer that maps every obligation to the people, systems, hours, and interruption exposure required to complete it. It does not replace the ERP, QMS, LMS, identity platform, vendor portal, or document repository. It links to those systems and makes their combined demand visible in one weekly view.
What goes into it
One row for every recurring or event-driven obligation. Each row needs:
|
· Obligation. Evidence request, supplier review, access recertification, training renewal, policy approval, customer audit pack, certification check, insurance document, remediation item, or regulatory filing.
· Requirement source. Regulation, customer contract, certification standard, insurer, internal policy, lender, prime contractor, or audit request.
· Primary owner and backup. One accountable person plus the person who covers an absence.
· Contributing functions. Quality, operations, purchasing, IT, finance, HR, engineering, warehouse, or outside partner.
· Source system. The exact ERP record, QMS folder, LMS course, IAM report, HRIS record, vendor portal, ticket queue, or controlled drive location that produces the evidence.
· Evidence output. The report, approval record, certificate, access list, training completion file, supplier document, control test, or signed review the obligation must produce.
· Frequency and trigger. Weekly, monthly, quarterly, annual, contract renewal, new vendor, employee role change, system change, customer request, or incident.
· Evidence freshness rule. How current the artifact must be when reviewed.
· Planned hours. Preparation, execution, review, correction, approval, and follow-up time by function.
· Interruption cost. Unplanned hours multiplied by loaded labor cost, plus documented overtime, expedite cost, delayed release, missed production, or late-shipment exposure.
· Capacity window. The week and time block in which the work will be completed.
· Status. Scheduled, at risk, blocked, complete, or overdue.
|
The planning math
|
Simple enough to maintain
Planned hours. Preparation plus execution plus review plus correction plus follow-up.
Unplanned hours. Actual hours completed outside the reserved capacity window.
Interruption cost. Unplanned hours times loaded hourly cost, plus documented overtime, expedite, delay, or lost-production cost.
Forecast accuracy. Planned hours compared with actual hours. Use the variance to improve the next cycle.
|
The point is not to manufacture a perfect cost figure. The point is to stop treating the load as free.
What the weekly output looks like
|
Every Monday, one six-week view
1. Capacity demand by function. Total compliance hours required from quality, operations, IT, purchasing, finance, and HR this week.
2. Collision alerts. Obligations competing with production runs, inventory counts, month-end close, maintenance, customer shipments, vacations, or training windows.
3. Evidence risk. Missing, stale, inaccessible, or unapproved artifacts due in the next two, four, and six weeks.
4. Owner actions. The three to five decisions or escalations that cannot wait.
5. Actual versus planned. Hours used last week, interruptions created, overdue work, and the estimate that needs to change next cycle.
|
Illustrative weekly rows
These are planning examples, not industry benchmarks.
|
Supplier insurance and cybersecurity review
Purchasing manager · Vendor portal and ERP vendor record · Rolling annual renewal
2.5 planned hours · Reserved Thursday, 2:00 PM
Exposure: extra chasing time and approval delay if documents expire.
|
|
Quarterly access recertification
IT manager plus department managers · IAM and HRIS · Quarterly and on role change
6 planned hours · Reserved Tuesday morning
Exposure: manager pull-away time and elevated access remaining open.
|
|
Food-safety training evidence refresh
QA manager plus operations supervisors · LMS and QMS · Monthly and before audit
4 planned hours · Reserved split across Tuesday shifts
Exposure: supervisor time removed from shift coverage.
|
|
Customer audit evidence pack
Quality lead plus finance and IT contributors · QMS, ERP, controlled drive · Monthly refresh and on customer request
8 planned hours · Reserved Wednesday, 9:00 AM
Exposure: multi-function search time if the request arrives ad hoc.
|
|
Vendor corrective-action review
Quality manager · QMS and supplier record · Monthly until closure
3 planned hours · Reserved Friday, 10:00 AM
Exposure: repeat defect, delayed approval, and added follow-up.
|
Decisions this eliminates
|
· Who owns this request?
· Which system holds the current evidence?
· Is the artifact still valid?
· Which functions will lose time this week?
· Does the work collide with production or close activities?
· Should the obligation be moved, staffed differently, or escalated?
· Which outside partner needs to act before the internal owner can finish?
· Is the recurring estimate wrong because the same interruption happens every cycle?
|
Operating rhythm
|
· Friday. Owners confirm next week’s hours, blockers, and evidence status. System data updates automatically where possible.
· Monday. Leadership runs a 20-minute capacity review. Resolve collisions, approve moved work, assign backup coverage.
· Midweek. Escalate only items that become blocked, exceed planned hours, or create a new operating risk.
· Month-end. Compare planned hours with actuals. Update the estimate, retire obsolete obligations, add new recurring work.
· Quarter-end. Review total compliance capacity by function. Decide whether to rebalance work, automate evidence creation, change the control, or add partner support.
|
Build guardrails
|
· Link to evidence. Do not duplicate controlled documents in the calendar.
· Keep human approval on interpretations, attestations, and control conclusions.
· Restrict rows and evidence links by role. Compliance visibility should not create a new access problem.
· Require a backup owner for every material obligation.
· Record actual hours. A capacity plan that never learns from actuals becomes another stale checklist.
· Separate the obligation from the task. One requirement may generate several tasks across functions.
· Track recurring interruptions as defects in the operating design, not as proof that the team needs to work faster.
|
What the operator gets every week
|
· A visible compliance load before it becomes urgent.
· A realistic view of which functions are overcommitted.
· A ranked list of stale evidence and blocked owners.
· Reserved time for work that was previously invisible.
· Better estimates based on actual hours.
· A record of where interruption cost keeps repeating.
· Fewer leadership decisions made from inboxes and memory.
|
Two paths to build it
|
Path 1: Internal build
Start with Microsoft Lists, Airtable, Smartsheet, or a shared spreadsheet. Import the next 90 days of obligations. Add the required fields above. Link every row to its source system. Ask each owner to estimate hours for one cycle, then replace estimates with actuals. Publish a six-week view and review it for 20 minutes every Monday. Automate reminders only after ownership, evidence location, and escalation rules are stable.
|
|
Path 2: ERP or existing partner
Ask the existing ERP, QMS, IT, or compliance partner to add the planning layer without creating a second system of record. The deliverable should include source-system links, owner and backup fields, recurring triggers, evidence-freshness rules, planned versus actual hours, role-based access, and a six-week capacity dashboard. Require the partner to show how vendor renewals, access changes, training completion, corrective actions, and audit requests enter the calendar automatically. The partner should leave the operating team with a weekly review rhythm, not another dashboard nobody owns.
|
|
Put compliance on the capacity calendar before the next request puts it there for you.
|
|
|
| |
|
THE OPERATIONS BRIEF
By Bill Murphy · Powered by Colony Spark
|
|
Already reserving capacity for compliance work, or watching it interrupt the week one request at a time? Hit reply, I read every one. Bill
|
|
| |
|