Compliance rules differ by country
the structure holding them doesn't have to

Every country you roll into brings rules you didn't have yesterday. Retention periods, approval evidence, what a signature counts as, who's allowed to see a personnel record, how long a document has to survive after a contract ends. The rules genuinely differ. What doesn't have to differ is the structure you hold them in, and conflating those two is what turns a rollout into one project per country.

Four regimes, one control set

The clearest version of this I've run wasn't a rollout at all. As CTO I owned the customer-facing security posture across enterprise sales cycles, covering SOC 1, SOC 2, ISO 27001 and FedRAMP LI-SaaS. Four regimes, four vocabularies, four sets of auditors who each believe their framework is the real one.

They are not four programmes. Underneath, they ask for the same things in a different order: access is granted deliberately and removed promptly, changes are reviewed before they reach production, incidents are detected and recorded, vendors are assessed, evidence exists and can be produced on demand. Build that once, as one control set with one evidence trail, and each regime becomes a mapping exercise on top of it. Build it four times and you have four things to keep current, which means at least two of them are stale right now.

What the shape means on a rollout

Same move, different subject. The shape is the structure: the fields that exist, which are mandatory, what type they are, how they relate to each other, and where the evidence attaches. The content is the local answer: the retention period, the threshold, the approver role, the wording.

So you build one document-retention structure with a duration field, not a German retention module and a Brazilian one. One approval structure with a configurable threshold and a configurable role, not an approval workflow per country. The country supplies the number. It doesn't supply the schema.

The 16-language test

The platform I built this way ran in 16 languages on one multi-tenant codebase. Sixteen languages is a surprisingly good forcing function for structural discipline, because a per-country structure has to be translated as a per-country structure. Every new field is 16 strings. Every new screen is 16 screens to review. The cost of structural sprawl shows up as a translation bill before it shows up anywhere else, which is useful, because it arrives early enough to argue about.

If you're rolling out in fewer languages you lose that early signal. The sprawl still happens. You just find it later, in the reporting layer, when two countries' versions of the same concept refuse to sum.

Where the content genuinely differs, and that's fine

Some things really are local and forcing them into a shared shape is its own mistake. Tax treatment. Works council consultation. Statutory notice periods. Data residency, which isn't a field at all but a deployment decision. The test is whether the difference is in the value or in the concept. A different retention duration is a value. A country where the concept of the record doesn't exist is not something a configurable field will rescue.

When you hit a genuine concept difference, say so explicitly and handle it as an extension rather than bending the shared structure until it fits both. A structure bent to fit two concepts usually fits neither, and the next country inherits the bend.

How you know the shape is right

Add a country on paper. Take the next market on the roadmap, sit down with whoever knows its rules, and try to express them entirely as values in the existing structure. If you can, the shape holds. If you can't, you've found the missing dimension early, which is the cheapest time to add it, and you've found it with one hypothetical country rather than one live one.

I'd run that exercise before region two, not after region four. It takes an afternoon and it's the difference between a platform that absorbs a new market and a platform that needs a project for one.

Sources: The four audit regimes (SOC 1, SOC 2, ISO 27001, FedRAMP LI-SaaS) and the 16-language multi-tenant platform are both from Bill Thornton's own role history, recorded in docs/bill-thornton-resume-2026.pdf in this repo. No customer is named here, and none will be.