251-217-9733
Regulatory Compliance & Risk Management
Find the gaps while they are still gaps, rather than after someone else finds them.
What Compliance Work Involves
Regulatory compliance is the work of identifying every rule a business is actually subject to, confirming it is meeting them, and building the processes that keep it meeting them as both the business and the rules change.
For most companies the obligations arrive from four directions at once, and they are usually tracked in none of them. Federal, state, and local regulation. Industry licensure and certification. Contractual obligations you agreed to and may have forgotten. And your own internal policies, which become enforceable expectations the moment you write them down.
Risk management is the other half: understanding what could go wrong, deciding what is worth preventing, and positioning the business to absorb the rest. Not every risk should be eliminated (some are simply the cost of operating). Knowing which is which is the actual service.
What We Handle
Compliance audits
A structured review of what you are subject to and where you are exposed, across regulatory, licensing, contractual, and internal obligations.
Legal gap identification
The things that should exist and do not (agreements never signed, policies never written, filings never made).
Licensing and certification
Confirming licenses are current, in the right entity, and in every jurisdiction you actually operate in.
Policies and procedures
Written to satisfy the obligation and to be followed. A policy nobody follows is worse than no policy.
Internal investigations
Run properly and early, so the findings hold up if a regulator or a plaintiff later tests them.
Regulatory response
Inquiries, audits, notices, and the correspondence that decides whether a question becomes an action.
Leadership training
Teaching the people making decisions to recognize risk before it reaches a lawyer.
Ongoing monitoring
Change management, so a rule that shifts does not quietly make you non-compliant.
Sound familiar?
What a Compliance Audit Actually Looks At
What applies to you
We start by establishing the actual obligation set (regulatory, statutory, licensing, contractual, and internal). Most businesses have never had this written down in one place, which is why gaps persist.
Whether you are meeting it
Filings, licenses, records, agreements, policies, and training. Not whether a policy exists, but whether the practice matches the policy.
What it would cost if you are not
Not every gap is worth closing immediately. We prioritize by consequence, so you are spending on the exposure that would actually hurt.
What keeps it current
A compliance position is a snapshot. The process for catching a rule change, a new state, or a new product line is what makes it durable.
Who Does This Work
Jordan W Gerheim
Regulatory, statutory, and internal compliance across licensure, employment, technology, privacy, and payment processing, as outside chief legal counsel to companies in multiple regulated industries.
Terri Sharpley Reynolds
Governance, fiscal accountability, and compliance for nonprofits, public agencies, and grant-funded organizations, including training local officials on both.
William R. Lancaster
Employment compliance and workplace investigations, informed by four decades defending the claims that follow when they are done badly.
Four Places Your Obligations Come From
Most businesses track the first and are exposed on the other three.
Regulation
Federal, state, and local rules for your industry. The one everybody thinks of, and usually the best tracked.
Licensing and certification
Professional and business licenses, in the right entity and every state you operate in. Missed most often after growth into a new jurisdiction.
Contract
Obligations you agreed to (insurance minimums, audit rights, data handling, notice requirements). Nobody re-reads a signed contract until there is a dispute.
Your own policies
The handbook, the code of conduct, the SOP. The moment you write a standard down, you can be held to it, and the most common failure is a policy the company stopped following.
How This Work Is Billed
Want a number for your situation?
Related Services
Frequently Asked Questions
We have never had a compliance problem. Do we need this?
Possibly not yet, and we will tell you if that is the answer. But "no problem so far" is a description of luck as much as of compliance, and it is worth knowing which one you have been relying on. The businesses that get hurt are rarely the ones ignoring a rule deliberately. They are the ones who did not know a rule applied.
A regulator has sent us a letter. What do we do first?
Do not answer it yet. The first response frames everything that follows, and a helpful, fast, unadvised reply frequently concedes more than a considered one. Note the deadline, preserve the relevant records, and get counsel involved before anything goes back.
How is an internal investigation different from just asking around?
Structure, independence, and documentation. An investigation run by the person the complaint concerns, or conducted informally, is often worse than none, because the fact that you looked into it and cleared everyone becomes evidence against you if the investigation was inadequate. Done properly, it is one of the strongest defenses available.
Does this cover employment and HR compliance too?
Yes, and Employment & Workforce Management covers it in more depth. Employment obligations are usually the largest single compliance exposure a small or mid-sized business carries, simply because every business has employees and not every business is regulated.
How often should this be reviewed?
Annually at minimum, and immediately on a material change (a new state, a new product line, an acquisition, or a significant regulatory shift). Cornerstone Counsel clients get a structured review quarterly, which is generally the right rhythm for a business that is actively growing.
Related Insights
Find the Gaps Before Someone Else Does
Book a Risk-Free Strategy Session and we will tell you honestly whether a full audit is worth it for a business your size, or whether three specific fixes would do.