What good compliance looks like in 2026: seven things I believe

Most compliance work still follows a model built for a slower world: a consultant arrives, a report is produced, an auditor visits once a year, and everyone hopes nothing changes in between. Everything changes in between.

I think compliance should be a working part of how a company runs, measured every day, owned by named people and proven by evidence that came from the systems themselves. That belief shapes every engagement I take on at VASUIST and every decision we made building Steppe. Here is what it means in practice.

It comes from the work. I've built ISO 27001 and SOC 2 programs inside fintech and healthcare companies, worked through RBI, IRDAI and SEBI requirements, and spent the last year on DPDP readiness for companies that had never heard the phrase "data fiduciary".

A compliance program has to outlive the consultant

The most expensive compliance document you can buy is the one nobody opens after the engagement ends. What you should pay for is a program: owners, a calendar of recurring work, one home for evidence, and a way to see status without calling anyone back. I've written about why the report model fails in Your compliance report is not a compliance program.

Evidence or it didn't happen

A status on a dashboard is only as honest as the evidence underneath it. That evidence should come from the source system, with a date and a scope, collected as the work happens. The Delve allegations showed what happens when that rule is skipped, and screenshots taken the week before an audit are a smaller version of the same habit. More in the Delve piece and Stop taking screenshots for your auditor.

Your documents should describe the company that exists

Policies written for an audit and never touched again describe a company that has since changed. A policy you don't follow is a written confession, and auditors read confessions closely. Documents should be short, tied to the controls they describe, and reviewed when the system changes. See Your policy says one thing, your company does another.

Build each control once

ISO 27001, SOC 2, DPDP and GDPR ask many of the same questions in different words. Running them as separate projects is the most expensive mistake in compliance, and the industry has rarely had a reason to tell you so. One control, one set of evidence, many frameworks. See Map once, comply many and SOC 2 vs ISO 27001 vs DPDP.

Compliance is measured every day, not once a year

Your cloud environment changes daily. Your audit looks at a handful of days. The months after an audit are where most programs decay, and under SOC 2 Type II those months are exactly what the next report measures. See Continuous compliance monitoring and Why compliance programs fail after the audit.

The law comes first, and Indian regulators are not an afterthought

Market frameworks are choices. The DPDP Act, CERT-In's directions and the rules from RBI, SEBI and IRDAI are not. Most global compliance tools were built around US frameworks and treat Indian regulators as a custom add on. Companies operating in India deserve better than that. See the DPDP timeline, regulatory change management and SEBI CSCRF.

Software remembers, people decide

Compliance platforms, Vanta, Drata, Sprinto and Steppe among them, are very good at reminding, collecting and tracking. None of them can decide your scope, your risk appetite or how a new circular applies to your business. AI can draft a security questionnaire in minutes, and a named person still has to know every answer is true. See Software or consultant and AI and security questionnaires.

Why this matters to you

Picture the compliance folder at your company. If the last edit is from the week your audit ended, you already know which model you're running.

There is a whole industry built on the annual panic before an audit, and it has never been in a hurry to make the panic unnecessary.

Steppe exists because I wanted the programs I build to keep running after I leave, with the consultant and the software working as one. You don't need our tool to act on any of the seven beliefs above. You do need to stop treating compliance as an event.

Compliance done properly is invisible on most days and boring on audit day, and that is exactly how it should feel.