Compliance and Risk Capability Program from the Front Line to the Board
An annual four-pillar theme (compliance literacy, risk ownership, internal audit & assurance, regulatory horizon scanning) aligned with ISO 37301:2021, ISO 37001:2016 SMAP, ISO 31000:2018, COSO ERM 2017, UU PDP 27/2022, UU 8/2010 APU-PPT, POJK 17/2023, and BCBS 239. Built for CEOs, Chief Compliance Officers, Chief Risk Officers, and Commissioners moving compliance from reactive obligation to organizational capability.
- 4.9/5 · 287 reviews
- 300+ clients nationwide
- 2,000+ trainers
- 1 to hundreds of participants
- Standard · Premium · Private 1-on-1
- Program scale
- Org-wide (CEO + CCO + CRO + Commissioners)Program scale
- Typical duration
- 12 months (renewable)Typical duration
- Program pillars
- 4: Literacy · Risk Ownership · Audit · Horizon ScanningProgram pillars
- Budget level
- Standard to PremiumBudget level
2,000+ trainers and experts
Our group's teaching network, matched to what your team needs.
See class documentationYou see your trainer first
The trainer's profile, track record and field come with the proposal, before you decide.
4.9 out of 5
287 participant reviews.
300+ clients nationwide and 180,000+ private training sessions completed. Among them: MPR RI, Akademi Militer Magelang, DPRD Provinsi Jawa Timur.
One person to hundreds
Private coaching for one participant, a class for one team, or several cohorts at once.
Three budget levels
- Standard: core class, material fitted to the participants’ work
- Premium: senior trainer, deeper material design
- Private 1-on-1: one participant, one trainer, schedule set by the participant
Neksus's compliance & risk program is an annual four-pillar theme: compliance literacy (UU PDP 27/2022 + APU-PPT UU 8/2010 + sectoral POJK), risk ownership (ISO 31000:2018 + COSO ERM 2017 + three lines of defense), internal audit & assurance (ISO 19011:2018 + ISO 37301:2021 compliance management + ISO 37001:2016 SMAP anti-bribery), and regulatory horizon scanning (KPK UKAP + sectoral regulator monitoring). Rollout from a 30-day pilot to a 90-day wave to org-wide over 12 months. Across enterprises and SOEs, program size tracks how many regulators oversee your sector, how many internal auditors are prepared, and which ISO 37001 or ISO 37301 certification target is being pursued.
Why compliance & risk must be designed as an organizational capability instead of an annual pre-audit checkbox
The Indonesian and global regulatory landscape has entered its most intense phase in two decades. On the national side: UU 27/2022 on Personal Data Protection became fully effective in October 2024 with material sanctions; UU 8/2010 on Money Laundering Prevention with KPK's UKAP as an anti-corruption standard; POJK 17/2023 for banks raising the bar on risk culture maturity; PP 39/2024 reshaping SOE procurement. On the global side: ISO 37301:2021 (Compliance Management Systems) replaces ISO 19600:2014 as the current global standard; ISO 37001:2016 SMAP (Anti-Bribery Management Systems) has been adopted by many large SOEs; ISO 31000:2018 (Risk Management Guidelines) and COSO ERM 2017 (Enterprise Risk Management — Integrating with Strategy and Performance) anchor the risk backbone; BCBS 239 (Basel Committee Principles for Effective Risk Data Aggregation and Risk Reporting) is mandatory for systemic banks. The common corporate response — a generic annual compliance e-learning, ad-hoc Compliance Unit briefings, and reactive internal audits — fails to build capability because of three structural gaps: (a) compliance literacy stuck in the language of regulation instead of the language of employee workflow; (b) risk ownership trapped in the Risk Officer office, never cascaded to BUs; (c) audit assurance focused on reactive compliance findings, with no view of control effectiveness. The annual four-pillar theme closes these gaps with a capability discipline aligned with global standards + Indonesian regulation. ISO 19011:2018 is the reference for audit competency.
- 2024-2026 regulatory landscape is the most intense in two decades: UU PDP + APU-PPT + POJK + procurement PP
- Current global standards: ISO 37301:2021 (compliance), ISO 37001:2016 (SMAP), ISO 31000:2018, COSO ERM 2017, BCBS 239
- Three structural gaps: literacy stuck in regulation language, risk ownership trapped in Risk Officer, reactive audit
- Annual four-pillar theme aligned with global standards + Indonesian regulation
- ISO 19011:2018 as the backbone for audit competency
Enterprises often deploy a 2-hour generic compliance e-learning per employee per year to pass audit. The result: 95% completion, field behavior returns to baseline in 60 days, and the same compliance findings repeat from audit to audit. Live compliance needs literacy calibrated to employee workflow (with no reliance on regulation language), reinforcement in work routine, and accountability mapped to the BU risk owner.
Rooted compliance & risk capability needs four sponsors: the CEO (tone from the top), the Chief Compliance Officer (program ownership), the Chief Risk Officer (risk methodology), and the Commissioners' Audit Committee (independent oversight). Without the Audit Committee, the program loses the independence required for external credibility.
The IIA (Institute of Internal Auditors) Three Lines Model 2020 places: line 1 (BUs as risk owners), line 2 (Compliance + Risk Function as oversight), line 3 (Internal Audit as independent assurance). Most enterprises carry this structure in the org chart while line 1 does not actually own risk; in Pillar 2 of this program, risk ownership is shifted from the Risk Officer to the BU Head with integrated risk KPIs.
ISO 37301:2021 (Compliance Management Systems — Requirements with guidance for use, replacing ISO 19600:2014) gives a global language consistent with ISO 9001 (quality), ISO 27001 (information security), and ISO 45001 (OHS). External audits are standardized, integration with existing management systems is natural, and board reporting is calibrated. Adopting the ISO 37301 structure is a strong year-one choice.
Four-pillar architecture — Literacy · Risk Ownership · Audit · Horizon Scanning
Each pillar addresses a different compliance capability determinant with global frameworks and Indonesian regulation. The annual program weaves all four into a documented organizational discipline.
Compliance literacy calibrated to employee workflow per BU. UU PDP 27/2022 modules with real use cases (HR data, customer data, vendor data). UU 8/2010 APU-PPT modules for financial and relevant non-financial industries. Sectoral POJK / Permen modules. Anti-bribery module aligned with ISO 37001:2016 SMAP.
- 100% of employees complete 4-8 hours of role-calibrated literacy
- Acceptable Use Policy + AI Policy + Data Protection Policy ratified + signed by 100% of employees
- Compliance helpline + whistleblowing channel running with metric tracking
Risk ownership shifted from the Risk Officer to the BU Head using the ISO 31000:2018 framework + COSO ERM 2017 (Strategy + Operations + Reporting + Compliance objectives). Live risk register per BU with inherent vs residual risk classification. Risk appetite statement ratified by the board.
- Live risk register in every BU with inherent + residual + control + owner
- Risk appetite statement ratified by the board, cascaded to BUs with tolerance limits
- BU Heads complete 16 hours of risk ownership + annual risk culture maturity scoring
Internal auditors trained in ISO 19011:2018 with competency aligned to audit type (compliance, financial, operational, IT). Audits aligned with ISO 37301:2021 for the compliance management system + ISO 37001:2016 for SMAP. Risk-based audit plan (with no reliance on calendar-based scheduling) prioritized by risk score.
- 100% of internal auditors complete lead auditor training built on ISO 19011:2018
- Annual risk-based audit plan with at least 70% of audits focused on high-risk areas
- Audit findings actioned within SLA + tracked on the executive dashboard
Multi-source regulatory monitoring team (OJK, BI, KPK, Kemenkominfo, KPPU, Kemenkes, Kemenperin per industry). Quarterly regulatory horizon scan to the board + impact assessment per new regulation. Integration with the AI Council where a separate AI Governance pillar exists.
- Quarterly regulatory horizon report to the Commissioners' Audit Committee + Board
- Impact assessment delivered within 30 days for every relevant new regulation
- Compliance roadmap updated quarterly based on the horizon scan
Annual budget envelope by sectoral regulatory complexity
The regulatory load of each sector sets the level most often used in that row. The final program follows the number of internal auditors, the external audit plan, and the budget you set. GRC software (MetricStream, ServiceNow GRC) is an optional extra beyond the program.
| Scope | Participants | Budget Level | Notes |
|---|---|---|---|
| Mid-size non-financial enterprise (300-800 employees) | Four pillars focused on UU PDP + ISO 37001 SMAP + relevant sectoral | Standard | First year focused on literacy + risk ownership + foundational audit. |
| Large non-financial enterprise (800-2500 employees) | Four full pillars + training for 10-20 internal auditors + risk culture survey | Standard or Premium | Standard 12-month four-pillar rollout with ISO 37301 or ISO 37001 external audit preparation. |
| Bank / Insurance / Financial institution | Four pillars + specialized POJK 17/2023 + BCBS 239 + deep APU-PPT modules | Premium, sectoral POJK modules | POJK 17/2023 carries high risk-culture maturity expectations. BCBS 239 for systemic banks. APU-PPT intensity high across all lines of business. |
| SOE with high GRC expectations | Four pillars + ISO 37001 SMAP audit prep + UKAP KPK + RKAP integration | Premium, toward ISO 37001 | Procurement via SPSE LKPP. Envelope follows PMK 39/2024 and SBM K/L. ISO 37001 SMAP certification often part of Ministry of SOE targets. |
| Multinational subsidiary | Localized global compliance program + bilingual + global GRC alignment | Standard or Premium, group-aligned | Final contract approved by regional HQ. Bilingual ID/EN reporting. Aligned with FCPA / UK Bribery Act for the global group. |
Rollout phases — 30-day pilot → 90-day wave → 12-month org-wide
Phased rollout calibrates literacy to local workflow and prepares documentation for external audits.
Validate the four pillars with one pilot BU of 30-80 employees + compliance documentation preparation.
- Pilot BU risk register with 15-30 identified risks (inherent + residual)
- 8-hour literacy delivered to the entire pilot BU with workflow integration
- Pilot internal auditors (3-5 people) complete ISO 19011:2018 foundation
- Pilot retrospective with module + risk register template calibration
Scale to 3 priority BUs with all four pillars + foundational compliance system documentation.
- Live risk register in 3 priority BUs + risk appetite statement draft
- 100% literacy in 3 priority BUs + Acceptable Use Policy + Data Protection Policy ratified
- First-wave internal auditors (60% of target) complete ISO 19011:2018
- Compliance Management System (CMS) aligned with ISO 37301:2021 draft v1.0
Roll out to the rest of the organization + optional external audit certification + active horizon scanning.
- 100% of employees complete literacy + 100% of BUs with live risk register
- 100% of internal auditors trained to ISO 19011:2018
- ISO 37301 CMS / ISO 37001 SMAP readiness for external audit if selected
- Quarterly regulatory horizon report begins publishing
Formalize compliance & risk as a permanent organizational discipline.
- Capstone report to the Commissioners' Audit Committee: risk register update, compliance posture, finding trend
- Quarterly GRC Council established as a permanent forum
- External ISO 37301 or ISO 37001 audit completed if selected
- Year-two design with advanced focus (risk quantification, GRC tooling)
Organization-level success metrics — beyond e-learning completion rate
Pick 5-7 metrics from this list before the program starts. Risk culture maturity and audit finding trend are the primary metrics.
Four-pillar annual theme vs Generic compliance e-learning vs Compliance Unit briefing only
Three approaches often taken by enterprises for compliance & risk — with very different capability impact profiles.
| Criterion | Generic compliance e-learning | Four-pillar annual theme ★ | Compliance Unit briefing only |
|---|---|---|---|
| How the budget is built | Content licence per employee | Standard or Premium by sector | Internal Compliance team time |
| Workflow-first literacy | Regulation language | Calibrated per role + workflow | Partial |
| Risk ownership at BU level | None | Yes — live risk register per BU | No |
| Risk-based audit + ISO 19011 | Calendar-based audit | Risk-based + auditors trained to ISO 19011 | Ad-hoc audit |
| Regulatory horizon scanning | Reactive | Quarterly scan + impact assessment | Reactive |
| Aligned with ISO 37301 / SMAP / COSO | Not aligned to a standard | Aligned + audit prep | Partial |
Neksus engagement flow for a year-long compliance & risk theme
- 1
Kickoff & GRC maturity diagnostic (4 weeks)
Weeks 1-4Two-day workshop with CEO + CCO + CRO + Commissioners' Audit Committee + 15 BU Head interviews + baseline risk culture survey + historical audit finding analysis. Output: program charter + maturity assessment + rollout design.
- 2
30-day single-BU pilot
Month 2Four-pillar rollout to one pilot BU. Risk register built, 8-hour literacy, pilot internal auditors ISO 19011:2018 foundation. The Neksus team and pilot-BU GRC Champions work side by side.
- 3
Pilot retro & calibration (2 weeks)
Early Month 3Retrospective workshop. Modules adjusted to feedback. Risk register template and ISO 37301 CMS framework refined. Wave 1 (3 priority BUs) plan agreed.
- 4
Wave 1 — 3 priority BUs (90 days)
Months 3-5Live risk register in 3 BUs, 100% literacy, first-wave internal auditors ISO 19011:2018, CMS draft v1.0, risk appetite statement draft. Weekly calibration with the steering committee.
- 5
Wave 2-3 — all BUs + audit prep (180 days)
Months 6-11Rollout to the rest of the organization. Every auditor has finished ISO 19011 training. ISO 37301 CMS or ISO 37001 SMAP audit readiness if selected. Quarterly regulatory horizon scan published.
- 6
Capstone & year-two design
Month 12Capstone report to the Commissioners' Audit Committee with risk culture maturity, compliance posture, finding trend, regulatory readiness. Year-two design workshop with focus on risk quantification + GRC tooling.
Program governance — who, what role, what cadence
Clear governance prevents compliance from collapsing back into an isolated unit and preserves assurance independence.
Highest oversight of compliance & risk capability. Review annual capstone report, ratify audit charter, approve risk appetite statement. Accountable to shareholders + regulators.
Executive sponsorship. Ratify compliance policy, allocate budget, prioritize waves, escalate cross-BU conflicts. Accountable to the Commissioners' Audit Committee.
Review risk register updates, compliance findings, regulatory horizon scan, and thematic policies. Cross-functional decision making for borderline cases.
Operational execution. Training scheduling, auditor training completion records, monthly GRC dashboard, coordination with the certification body your organization chooses.
Risk owners in the BU, risk register update coordinators, peer trainers for literacy. 24-hour train-the-trainer + formal 10% work-time allocation.
Risk-based audit aligned with ISO 19011:2018. Direct access to the Commissioners' Audit Committee for independence. Reporting bypasses the Board on sensitive topics.
Co-design the program, facilitate literacy + risk + audit training through trainers experienced in running ISO 19011 audits, escalate methodology.
Who joins from your organization — a multi-cohort design
The program moves governance tier, BU Heads, support functions, and all-employee cohorts in parallel with distinct curricula.
Annual briefing on compliance posture, risk culture maturity, and regulatory horizon. 8 hours per year + capstone presentation.
Steering committee + risk ownership. ISO 37301 + COSO ERM + risk appetite statement module. 16 hours per year.
BU risk ownership with ISO 31000 framework. Risk register building + reporting cadence. 24 hours.
Deep module on ISO 37301:2021 CMS, ISO 37001:2016 SMAP, sectoral POJK, and oversight skills. 40 hours.
Lead auditor training built on ISO 19011:2018 + ISO 37301 compliance audit + risk-based audit methodology. 80 hours + real capstone audit.
24-hour train-the-trainer for peer literacy + risk register maintenance. Formal 10% work-time allocation.
4-8 hour module calibrated per role: UU PDP, APU-PPT (where relevant), anti-bribery, AI ethics, whistleblowing.
Neksus topic constellation that composes this theme
Each topic is a structured module. The compliance & risk theme weaves several topics into integrated pillars.
Employee Cybersecurity Awareness
Core module for Pillar 1 covering information security + UU PDP literacy. ISO 27001 alignment.
Organizational Change Management
Shifting risk ownership from the Risk Officer to BU Heads is a structural culture change. Change management module for Pillar 2.
Leadership for First-Line Managers
Line managers as compliance champions on the floor. Tone from the middle. Supporting module for Pillars 1 + 2.
Executive Communication & Presentation
CCO + CRO + Head of Internal Audit need presentation capability for risk culture maturity + finding trend to the Commissioners' Audit Committee.
Common failure modes — and effective mitigations
Risk register filled out by the Risk Officer alone; BU Heads formally sign with no understanding or ownership.
How we reduce it: Risk register score becomes part of the BU Head KPI with 10-15% weight. Quarterly steering committee reviews per-BU risk culture. CEO openly recognizes BUs with the highest risk maturity.
Audit findings softened before reporting to the Audit Committee, or sensitive audit areas skipped.
How we reduce it: Internal Audit Charter with a reporting line direct to the Commissioners' Audit Committee (with no routing via CEO/CFO). Charter reviewed annually by the Audit Committee + independent external review every 3 years.
The team prepares audit documentation in a crash; post-certification the system is not actually run; formal certificate with no effectiveness.
How we reduce it: Year one focuses on the foundation (literacy + risk ownership + audit competency). External audit preparation is recommended for year two after the foundation has taken root. A year-one internal pilot audit measures readiness.
Employees 'pass' UU PDP e-learning and still forward client emails to a personal Gmail account because the literacy is not calibrated to their work context.
How we reduce it: Literacy modules designed per role with real workflow use cases from the BU. Co-creation with BU Champions. Assessment scenario-based, with no reliance on regulation multiple choice.
The channel exists with zero reports; employees are unsure of anonymity protection or retaliation risk.
How we reduce it: Channel hosted by an independent third party (with no routing via internal HR/IT), CEO + Audit Committee communicates regularly on protection, and metrics are tracked publicly (anonymous aggregate). Investigation protocol documented.
Quarterly horizon scan skipped when operational pressure rises; impact assessment of new regulation never produced; the enterprise is surprised at enforcement time.
How we reduce it: Horizon scan becomes part of the CCO KPI + a dedicated regulatory analyst. Quarterly cadence locked into the board calendar. Subscribe to a regulatory monitoring service (Compliance.ai or equivalent) as input.
Procurement information
- Contract formatStructured annual theme (renewable). Multi-year engagement with an SOW agreed per year.
- LocationOnsite at the client office, regional onsite, or hybrid (onsite kickoff + bi-weekly online sessions + onsite audit training per region).
- Delivery languageBahasa Indonesia (default) or bilingual ID/EN for multinational enterprises with global reporting.
- Materials & participant certificatesStructured modules, ISO 37301/37001/31000 + COSO ERM workbook, risk register + CMS template, 12-month alumni resource hub access, and a Neksus training completion certificate.
- Optional external audit preparationISO 37301:2021 CMS or ISO 37001:2016 SMAP audit preparation, with 6-12 months of readiness support before the external audit. The audit and certificate come from the certification body you choose; Risk Practitioner exams (FRM, PRMIA) are taken directly with their issuers.
- Tax & e-procurement documentationPPN tax invoice, official receipt, BAST. SOE/government e-procurement (SPSE LKPP) supported. SBM K/L envelope for ministries and agencies.
- Payment termsA deposit on contract, a milestone payment per wave (3x), the balance after year-one capstone. The size of each payment is agreed in the contract under the client's procurement rules.
- Optional add-onsPersonal coaching for CCO/CRO (separate package), Commissioners' Audit Committee briefing series (90 minutes quarterly), GRC tooling implementation support (MetricStream, ServiceNow GRC), and external audit preparation.
Frequently Asked Questions
Discuss your organization's compliance & risk capability theme design
Share your industry sector, organization size, regulator expectations, and the GRC challenge you face. The Neksus team studies your context and returns an annual theme design.
- Four integrated pillars (literacy · risk ownership · audit · horizon scanning) aligned with ISO 37301 + ISO 37001 + ISO 31000 + COSO ERM + UU PDP + APU-PPT + POJK
- 30-day pilot → 90-day wave → 12-month org-wide
- Internal auditors trained as lead auditors to ISO 19011:2018
- Live risk register per BU with risk appetite statement ratified by the board
- Capstone report to the Commissioners' Audit Committee with risk culture maturity + finding trend + regulatory readiness