What is a Compliance Program?
A compliance program is the set of standards, procedures, oversight, training, monitoring, reporting channels, incentives and discipline an organization uses to prevent and detect violations of law and promote ethical conduct.
- A compliance program is the whole organized effort to prevent and detect misconduct and make ethical conduct part of the culture, not a single policy or department.
- The US Sentencing Guidelines set the reference definition and seven minimum elements, from standards and oversight to monitoring, incentives and response.
- The DOJ asks three questions: is the program well designed, is it applied earnestly and in good faith, and does it work in practice.
- An effective program changes outcomes: it reduces sentencing culpability, shapes charging decisions and meets the board's oversight duty.
- Review it periodically: annual risk assessment, policy and training reviews, plus a reassessment after any significant incident, acquisition or regulatory change.
What is a Compliance Program?
A compliance program is the set of standards, procedures, governance, training, monitoring, reporting channels, incentives and discipline that an organization uses to prevent and detect violations of law and promote a culture of ethical conduct.
Chapter 8 of the US Sentencing Guidelines, section 8B2.1, sets the reference definition: to have an effective compliance and ethics program an organization must exercise due diligence to prevent and detect criminal conduct and otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law, and it lists the minimum requirements. The Department of Justice's Evaluation of Corporate Compliance Programs tells prosecutors to ask three questions: is the program well designed, is it applied earnestly and in good faith (adequately resourced and empowered to function effectively), and does it work in practice. Similar expectations appear in the UK Bribery Act guidance and in sector regulation.
Why it matters
- It changes legal outcomes. An effective program reduces sentencing culpability scores and shapes charging decisions and resolutions.
- It is a board obligation. Directors are expected to ensure a reasonable reporting system exists and to act on red flags.
- It is how culture is operationalized. Standards, training, speak-up channels and consistent discipline are what turn stated values into behavior.
The seven elements in the Sentencing Guidelines
- Standards and procedures to prevent and detect criminal conduct.
- Oversight by the governing authority, responsibility of high-level personnel, and day-to-day operational responsibility assigned to specific individuals with adequate resources, authority and direct access to the board.
- Reasonable efforts to exclude from substantial authority anyone who has engaged in illegal or unethical conduct.
- Communication and training on standards and procedures for all levels, including the board.
- Monitoring and auditing to detect criminal conduct, periodic evaluation of the program, and a confidential system for reporting without fear of retaliation.
- Consistent promotion and enforcement through incentives and discipline.
- Reasonable steps to respond to detected conduct and to prevent recurrence, including modifying the program, plus periodic risk assessment.
What DOJ's three questions test
Design covers risk assessment, policies and procedures, training and communication, confidential reporting and investigations, third-party management and mergers and acquisitions due diligence. Earnest application covers commitment by senior and middle management, autonomy and resources of the compliance function, and incentives and disciplinary measures. Working in practice covers continuous improvement, periodic testing and review, investigation of misconduct, and analysis and remediation of root causes. The 2024 update added questions on data access, emerging technology including AI, and whistleblower protection.
Program, CMS and compliance management
In DOJ and Sentencing Guidelines usage the compliance program is the whole effort. In US banking usage it is the policies, training, monitoring and corrective action component inside a compliance management system that also includes board oversight and complaint handling.
Related terms
In SmartSuite
SmartSuite Compliance Management holds the program elements as connected records: the risk assessment, the code and policies with attestations, obligations and controls, monitoring tests and evidence, and investigations and remediation actions, with the reporting that evidences each Sentencing Guidelines element.
Frequently asked questions
What makes a compliance program effective?
Under the Sentencing Guidelines, due diligence to prevent and detect misconduct plus a culture that encourages ethical conduct, evidenced by the seven elements. DOJ adds three practical tests: sound design based on a risk assessment, real resourcing and authority for the compliance function, and evidence that the program detects, investigates and remediates problems in practice.
Is a compliance program required by law?
Not in general, but its absence is costly. The Sentencing Guidelines reward an effective program with reduced penalties, prosecutors weigh it in charging and resolution decisions, and sector laws and regulators (anti-corruption, healthcare, financial services, export controls) require programs in substance. Boards also face oversight duties that an absent program breaches.
How often should a compliance program be reviewed?
The Sentencing Guidelines require periodic evaluation of effectiveness and periodic risk assessment, and DOJ asks whether the program evolves. Annual review of the risk assessment, policies and training, with continuous monitoring and testing, is the common practice, plus a reassessment after any significant incident, acquisition, new market or regulatory change.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.