I have been writing compliance guides for a few weeks now, and this week one of them quietly rearranged how I think about the whole subject.
I sat down to write about tax clearance certificates. I knew the shape of the piece before I started: here is the document, here is how you get it, here is how long it lasts, here is what to do when it expires. That is the shape of every compliance guide I have written.
Then I read what SARS actually says, and the document is gone. It has been gone since 2015. What replaced it is not a certificate at all. You request a PIN, you hand the PIN to whoever needs proof, and they look you up. What they see is your status at the moment they look.
I want to be honest about my first reaction, which was that this is a minor administrative detail. A digital thing replaced a paper thing. Everything has been going that way for a decade. I nearly wrote it as one line and moved on.
The thing I nearly missed
What changed my mind was thinking about who holds the PIN.
With a certificate, I hold the evidence. It is mine, it is dated, and its authority runs out on a day I can see. The whole mental model is a renewal cycle. Get it, use it, watch the date, get it again.
With a live check, the other party holds the ability to ask, and there is no date to watch. A customer I onboarded in February can check me in November, and the answer they get in November is November's answer. Nothing in that arrangement is scheduled. Nothing announces itself.
So the model is not renewal. The model is that I am continuously answerable, to people I have already convinced, at moments I do not choose.
That is a genuinely different thing, and I had it filed wrong.
Why this bothered me more than it should
Because I know what I would have done under the old model. I have done it. You get the document, you feel the relief of having it, you file it, and the feeling of being compliant attaches to the object rather than to the state of your affairs.
That feeling is the problem. It is possible to be extremely diligent about obtaining evidence and simultaneously careless about the thing the evidence is about. The document is a proxy, and proxies are much easier to manage than the real thing, which is exactly why we reach for them.
Under a live check there is no proxy to hide behind. There is no artifact to feel good about. There is only whether the underlying facts are in order right now, which is harder and much less satisfying, because being in order produces no object and no moment of completion.
I think this is why so many businesses are non-compliant while owing nothing. The unfiled nil return does not feel like a failure. There is no letter, no bill, no missing certificate on the wall. It is an absence, and absences are invisible until somebody queries them.
The wider version
I wrote a few days ago about the dependency chain running through South African compliance, and how the joins between obligations are documented nowhere because each source is written from inside one regulator's boundary. That was about structure. This is about time, and it is the piece I had missing.
Those dependencies are not evaluated once. They are re-evaluated on demand, by whoever is deciding about you, using data you do not control the timing of. The chain is not a diagram. It is a query that runs whenever somebody has a reason to run it.
Which means the useful question about any obligation is not "do I have the document". It is "what does this look like if somebody checks it today, without telling me".
I do not love the answer for every one of my own obligations. That is a reasonable thing for a founder to admit publicly, and it is more useful than the version where I only publish the parts where I come out well.
What I am changing
Two things, both boring, which is usually the sign that they are the right ones.
First, I am treating filing dates as customer-facing dates. Not accounting dates, not internal admin. If a corporate customer can check my status at any moment, then a missed filing is a sales problem with a delay on it, and it belongs in the same category as a missed reply.
Second, I am checking my own records the way an outsider would, using the same public tools they would use, instead of trusting my own sense of whether things are fine. My sense of whether things are fine has been wrong before. I wrote about a version of that when I published every post twice and did not notice for weeks.
I said something in the compliance chain piece that I think I only half understood at the time: enforcement by penalty is rare, enforcement by lost eligibility is constant. This week I found the mechanism underneath it. Eligibility is lost by a query returning a different answer than it did last time, silently, to somebody who does not tell you they asked.
There is no notification for that. There is only whether you would pass.
More build notes in the Journal.