FortiClient VPN and Compliance Enforcement

Assuming you're talking about 6.2.x versions, you need FortiClient EMS Server to set profiles to be enforced for when the FortiClient user is on-net or off-net (https://docs.fortinet.com/document/forticlient/6.2.3/ems-administration-guide/519742/adding-an-endpoint-policy).  When on-net, your local FortiGate should be enforcing the profiles.

I'm just getting started testing using FortiClient Cloud (https://docs.fortinet.com/document/forticlient/6.2.2/cloud-deployment/681910/introduction) which is a Fortinet hosted EMS to do this for our locations, so I'm not very familiar with it yet.