Insights

Making a case for moving the compliance function upstream—with a martial arts analogy

If you lead Compliance in a large enterprise, you know the feeling of being pulled in late. Producing work in defensive mode often limits what the function can shape. The good news is that there is a more effective posture for the role—one that positions compliance upstream, closer to where intent forms and opportunities are still malleable.

The 2 o’clock stance

In martial arts, a fighter doesn’t stand squarely in front of an opponent. They angle their body. In the ‘two o’clock’ stance, they stand slightly forward and slightly inside. It allows them better balance and a wider field of vision. Modern compliance works in a similar way. It shouldn’t stand behind the business or across from it; the ideal place for it is half a step ahead of risk and half a step inside strategy.

Compliance at a crossroads

The reality is very different. In a world where regulation is multiplying and supply chains are increasingly fragile, compliance in most organisations still stands at ‘six o’clock’. The function watches, records, reports. It is accurate but often late, and therefore wise only in hindsight.Late-stage compliance erodes value: it delays launches, narrows options, exposes margins, and increases audit drag.

What compliance is not

Upstream compliance requires letting go of the familiar but limiting model that exhibits the following features:

• Reactive reporting after deals are signed, products built, or suppliers chosen.
• Defensive six o’clock moves that focus on recording and documenting after the fact.
• A checklist handed to the business at the last minute.
• A function whose value is measured only in penalties avoided, audits managed or policies owned.

Changing the course: Upstream compliance

In the two o’clock stance, compliance doesn’t just ask “How do we avoid penalties?” Instead, it asks—earlier and more clearly—“Where does regulation create or kill access?” Trade frameworks, data regimes, ESG expectations, and sector codes are not end-stage constraints but the terms of entry.

When compliance stands upstream, these terms are incorporated while products are being designed, deals explored, or suppliers shortlisted. The posture moves the function from late veto to early design input.

This shift shows up across the four Vs.

Visibility

Instead of a dry set of obligations, leaders see a living map that connects regulatory regimes to customer segments, revenue lines, and geographic ambition. They gain clarity on which moves are frictionless and which require adjustments in price, structure, or timeline.

Vigilance

Real-time signals on sanctions, data flows, third-party posture, and sector guidance flow directly into deal desks, product councils, and sourcing gates. There are fewer blind spots at the moment commitments are made.

Visualisation

The clouds around risk lift for the business. Heat maps, counterparty graphs, and scenario layers help teams resequence launches, reshape deals, and justify decisions to boards and regulators with less friction and clearer logic.

Vision

The function moves away from counting activities and toward demonstrating value: fewer stalled launches, improved partner eligibility, reduced audit drag, and margins preserved through early intervention.

How upstream compliance becomes a system

The organisations that move fastest are rarely those that say “no” the least. They are the ones that say “yes, if…” early enough to shape the opportunity.

Upstream compliance enters portfolio reviews, M&A screening, system architecture choices, supplier onboarding, new launches, and key account pursuits. Specialists are embedded, tooling is connected to decision points, and dashboards are built to be genuinely useful. The internal tone shifts from “we require” to “we propose.”

As the upstream stance takes hold, the organisation stops relying on heroic, interventionist saves. Working patterns settle into a predictable, business-aligned rhythm; knowledge moves from individuals into systems; and lightweight standards replace ad-hoc corrections. The real measure of maturity is not how many policies the function owns but how many commercial moves happen faster because compliance is in the 2’o clock posture.

Compliance as a gamechanger for CXOs and Board

An upstream compliance function influences metrics that matter to Finance: the time it takes to enter a market, conversion of high-assurance customers, the cost of control compared with the cost of disorder, and margins protected through early intervention. Finance sees a clearer link between compliance posture and EBITDA and cycle times.

When Compliance can speak in terms of working capital, pricing leverage, and predictable audits, the Board stops viewing it as overhead and begins to see credible upside.

Sales answers risk questionnaires with reliable data rather than improvisation. Product teams treat regulatory intelligence as part of discovery rather than a last-minute scramble. Sourcing uses third-party diligence as selection intelligence rather than a barrier. Risk leaders narrate strategy with fewer caveats and more confidence.

Overall, upstream compliance protects pricing, accelerates entry, unlocks strategic accounts, and avoids costly redesign.

What CXOs can ask themselves

A forward posture demands proximity and informed opinion. Compliance leaders must take a share of strategic narrative instead of limiting themselves to control narrative. CXOs must invite constraint into the moment of creation rather than the moment of clean-up.

CXOs can themselves three questions this quarter:

• In how many strategic conversations did compliance participate before the business model solidified?
• Where did the function change the shape of a deal or product, rather than simply complete documentation?
• Can you identify at least one instance where the posture created access—through faster clearance, new customer eligibility, or a cleaner audit story that improved pricing?

If the answers feel thin, the solution is not more policy. It is a change in stance. Place compliance upstream and at two o’clock, with a conscious and collaborative intent, and help it go from reactive to proactive.