1. Spot the Problem

What everyone sees.

Companies create things that can affect people without always understanding the information and risk sitting underneath them.

A new product, software system, payment process or customer experience can touch personal data, money, intellectual property and even automated decisions. Yet the customer never thinks about whether any of this is safe.

They shouldn't have to.

2. Find the Root

What's actually happening.

The problem isn't that companies don't have rules. It's that there are too many of them.

Compliance exists, in theory, to make sure companies don't misuse or mishandle what people give them. But the reality is an ocean of overlapping laws, standards and frameworks.

GDPR. PSD2. PCI-DSS. DORA. NIS2. And dozens more.

Then add the company's industry, size, complexity, maturity and activities. The result?

Companies don't have one compliance problem. They have a "what actually applies to us?" problem.

3. Make It Click

Here's what to do instead.

Stop trying to understand compliance from the rules outward. Start with the business and work backwards.

Instead of asking:

"What regulations exist?"

Ask:

"What do we actually do, what information do we touch, and what rules does that trigger?"

Map the business first. Then map the obligations to it. Then separate what's required, recommended and irrelevant. Compliance becomes much less about reading hundreds of pages and much more about understanding what actually matters to you.

That's the difference between compliance as paperwork and compliance as a useful business tool.

Root Test

If you removed every regulation that doesn’t actually apply to your business, how much of your compliance workload would disappear?

Try This Week

Pick one regulation, standard or framework your company currently follows. Ask: “What specifically makes this applicable to us?”

If nobody can give you a clear answer, you may have found your first compliance problem.

Root Reading

Chesterton’s Fence — Farnam Street

Ever looked at a rule and thought “Why the hell do we even do this?”
There’s a mental model for that: Chesterton’s Fence. Before you remove a fence, understand why someone built it. The same applies to business rules. Before you blindly follow one, understand why it exists, what risk it’s addressing, and whether that reason still applies to you.

It’s a great reminder that “we’ve always done it this way” isn’t a reason to keep something — but neither is “I don’t see the point” a reason to remove it.

If this changed how you think, share it with one person who'd appreciate it too. 🙂

The root is always the problem.
The solution is a simple click.
- Dre

What problem should I tackle next? I read to all feedback so reply to this email and I'll help out!

600 1st Ave, Ste 330 PMB 92768, Seattle, WA 98104-2246
Unsubscribe · Preferences

Root Click

The Rules You Never Question