Every organization of size has an ethics and compliance program: a code of conduct, a hotline, annual training, a chief compliance officer, a committee that meets. The question regulators, prosecutors and boards ask is a different one: does it work? The Department of Justice puts it as three questions when it decides how to treat a company whose employees broke the law: is the program well designed, is it applied earnestly and in good faith (adequately resourced and empowered to function effectively), and does it work in practice. A program that exists but does not work earns no credit, and a board that relied on its existence has learned nothing. Internal audit is the function positioned to answer the effectiveness question independently of the people who run the program, and the audit of the ethics and compliance program is one of the few engagements whose result can change what a prosecutor or regulator decides.
This guide gives the program-effectiveness audit: why effectiveness is the standard, the frame enforcement authorities use, the program’s components and the tests for each, the metrics that show effectiveness, a worked engagement at Tamarack Stores, the failures that recur, and how to report without usurping the chief compliance officer. It pairs with the corporate culture audit (the behavioral side of the same question), the compliance risk assessment guide (the program’s first component in depth) and the conduct risk guide.
In this guide
- Why effectiveness, not existence, is the standard
- The frame enforcement authorities use
- The program’s components and what to test
- Risk assessment and program design
- Governance, independence and resources
- The code and the policies
- Training reach and comprehension
- Speak-up channels and the hotline benchmarks
- Investigation quality
- Discipline consistency and incentives
- Third parties
- Monitoring, data and continuous improvement
- The metrics that show effectiveness
- A worked engagement: Tamarack Stores’ FY26 ethics and compliance program audit
- Failures that recur
- Reporting without usurping the chief compliance officer
- Questions about auditing the ethics and compliance program
- Related guides
Why effectiveness, not existence, is the standard
Compliance programs matter legally because they change outcomes after something goes wrong. Under the US Sentencing Guidelines an effective program mitigates an organization’s culpability score; under the Department of Justice’s policies a well-designed, well-resourced program that works in practice weighs toward declination or reduced penalties and affects whether a monitor is imposed; under the UK Bribery Act an organization’s defense to failing to prevent bribery is that it had adequate procedures, and under the failure-to-prevent-fraud offence in force since September 2025 the defense is reasonable procedures; under the HHS Office of Inspector General’s guidance an effective program is what distinguishes a billing error from a false claim. In each case the authority asks for evidence that the program operated, not a binder: who was trained and did they understand, who reported and what happened, what the risk assessment found and what changed because of it, whether misconduct was disciplined consistently at every level including the top, whether the compliance function could reach the board and had the resources to do its job, and whether the company tested its own program and fixed what it found. That last point is where internal audit enters: the DOJ’s guidance asks explicitly whether the program is periodically reviewed and tested, including by internal audit, and an audit that measures effectiveness is itself part of the evidence that the program works. The compliance risk guide and the internal audit versus compliance guide draw the boundary: compliance runs the program; internal audit tests it.
The frame enforcement authorities use
| Source | What it asks of a program | Use in the audit |
|---|---|---|
| US Sentencing Guidelines, Chapter 8 (effective compliance and ethics program, section 8B2.1) | Seven elements: standards and procedures; oversight by the governing authority with specific high-level responsibility and adequate resources and authority; care in delegating authority (no bad actors in key roles); communication and training; monitoring, auditing and a reporting system without fear of retaliation; consistent incentives and discipline; response to misconduct and program modification; plus periodic risk assessment | The structural checklist every US program should map to |
| Department of Justice, Evaluation of Corporate Compliance Programs (latest update September 2024) | Three questions (well designed; applied earnestly and in good faith; works in practice) with detailed sub-questions; the 2024 update added management of risks from new technology including AI, whistleblower protection and anti-retaliation, and whether compliance has access to data and resources comparable to the business | The most detailed public criteria; the audit’s test questions can follow its structure |
| Department of Justice Criminal Division policies (corporate enforcement policy, the whistleblower awards pilot launched August 2024, the 2025 enforcement memo) | Credit for self-disclosure, cooperation and remediation; the program’s quality as a factor in resolution and monitorship decisions | Why effectiveness evidence has value before an incident |
| HHS Office of Inspector General, General Compliance Program Guidance (November 2023) and industry-specific guidance | Seven elements adapted to healthcare; board oversight; compliance officer independence; auditing and monitoring; the program as the line between error and fraud | Healthcare organizations: the healthcare guide |
| UK Bribery Act 2010 (adequate procedures, six principles) and the Economic Crime and Corporate Transparency Act 2023 failure-to-prevent-fraud offence (in force 1 September 2025, with government guidance on reasonable procedures) | Top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, monitoring and review | UK-exposed organizations: a second structural checklist |
| EU Whistleblower Directive (2019/1937) and national laws; US anti-retaliation provisions (Sarbanes-Oxley, Dodd-Frank, the SEC whistleblower program) | Internal reporting channels with acknowledgment and feedback deadlines; confidentiality; protection from retaliation; the risk that employees report externally first | Speak-up channel tests and retaliation handling |
| ISO 37301:2021 (compliance management systems) and ISO 37001:2016 (anti-bribery) | Certifiable management system requirements: context, leadership, planning, support, operation, evaluation, improvement | Criteria where the organization has adopted them |
| Sector regulators (financial services conduct rules, FCPA and sanctions enforcement, antitrust compliance guidance, data protection authorities) | Program expectations specific to the regulated risk | Added to the frame for the risks the organization carries |
The program’s components and what to test
The frameworks converge on the same components, and the audit tests each for design (does it exist and fit the organization’s risks), operation (did it run as designed in the period, evidenced) and effect (did it change behavior or catch misconduct, measured). The components: a compliance risk assessment that drives the program; governance, independence and resources for the compliance function; the code of conduct and the policies beneath it; communication and training that reach and are understood by the people who need them; speak-up channels and protection from retaliation; investigation of allegations to a consistent standard; discipline applied consistently and incentives aligned with compliance; third-party management for the intermediaries and suppliers who create risk; monitoring, data and testing that tell the program what is happening; and a cycle of review and improvement. The sections below give the tests. The audit is scoped as a whole-program review every few years with deeper dives on components in between (speak-up and investigations one year, training and third parties the next), and it draws on the function’s other work (the culture audit, the governance audit, the fraud and third-party programs) rather than repeating it.
| DOJ question | Components it reaches | Evidence the audit gathers |
|---|---|---|
| Is the program well designed? | Risk assessment; code and policies; training design; speak-up channel design; investigation protocol; third-party program design; incentive and discipline design | Current risk assessment traced to program elements; policy inventory and content review; training plan by population; channel options and protocol documents; discipline matrix; third-party tiering method |
| Is it applied earnestly and in good faith (adequately resourced and empowered)? | Governance and independence; budget and headcount; CCO access to the board; compliance access to data and systems; stature of the function; care in delegating authority | Committee minutes and private sessions; benchmarked resources; data access evidence; background and conflict checks on positions of trust; how senior-level matters were handled |
| Does it work in practice? | Training completion and comprehension; hotline volume and handling; investigation files; discipline outcomes; incentive outcomes; monitoring results; program changes after incidents | Re-based completion and assessment data; benchmarked speak-up metrics and case sample; outcome analytics by level and region; bonuses and promotions joined to findings; monitoring output; improvement log |
Risk assessment and program design
A program is only as good as its understanding of what could go wrong, and the compliance risk assessment is where that understanding lives or does not. The tests: an assessment exists, is current (updated at least annually and on change), covers the organization’s actual risk profile (the jurisdictions, the business models, the third parties, the regulated activities, the employee populations and the new risks the 2024 DOJ update names, including the organization’s use of AI), uses data as well as interviews (hotline trends, investigation outcomes, audit findings, regulatory developments, loss events), rates risks with a defined method, and drives the program visibly: the policies, training, monitoring and resources should trace to the rated risks, and the audit traces them. A risk assessment that has not changed in three years while the business entered two countries and deployed generative AI in customer service is a design finding, whatever the document’s quality. The compliance risk assessment guide gives the method in depth and the risk taxonomy guide the structure for naming the risks.
Governance, independence and resources
The Sentencing Guidelines require specific individuals with overall responsibility, adequate resources and authority, and direct access to the governing authority; the DOJ asks whether the compliance function is independent, has stature, is adequately resourced and staffed with people of experience, and has access to the data it needs. The tests: a chief compliance officer with a defined mandate (charter or job description), a reporting line that gives direct and unfiltered access to the board or its committee (a reporting line solely to the general counsel or chief financial officer is a common finding, accepted only with a documented and exercised right of access to the committee and private sessions), board or committee oversight evidenced in minutes (reports received, discussion recorded, decisions made), a budget and headcount proportionate to the risk profile and benchmarked where possible, qualifications and continuity in the compliance team, and access to systems and data (the 2024 update’s point: compliance should not depend on the business to run its own reports). The audit also tests the “care in delegating authority” element: background and conflict checks on people placed in positions of trust, and the handling of individuals with a history of misconduct. The corporate governance guide covers the board-level tests and the audit committee charter guide the committee’s own responsibilities for compliance oversight.
The code and the policies
The code of conduct is tested for content against the risk assessment and the rules (does it address the risks the assessment rated, the mandatory topics such as anti-corruption, conflicts, gifts, insider trading, harassment, data protection, speak-up and anti-retaliation, and the sector’s requirements), for accessibility (plain language, translated for the workforce, findable), for currency and approval, and for the attestation process (who attests, how often, what the attestation rate is and what happens to non-attesters). The policies beneath it are tested as a framework, which the governance guide describes: inventory, ownership, review cycles, consistency, communication. The effectiveness question for policies is whether people can find and use them: the audit asks a sample of employees where the gifts policy is and what it says, and the answers are evidence. The DOJ’s guidance asks specifically whether policies are accessible to employees and third parties and whether the company tracks access to them; usage data from the policy portal is evidence of a kind many programs never look at.
Training reach and comprehension
Training is the component most programs measure and measure wrongly: completion rates say who clicked through, not who understood, and they are usually computed on the population the learning system knows about rather than the workforce. The tests: a training plan that traces to the risk assessment (the right topics to the right populations, with depth proportionate to exposure: a sales team in a high-corruption market gets more than a module), completion rates computed against the full workforce by population (salaried, hourly, contractors, new hires within the required window, managers), the content’s quality (accurate, current, relevant to the audience, in the audience’s languages), comprehension testing (assessments with pass marks, and what happens on failure), targeted and in-person training for high-risk roles, training on the speak-up process itself, and evidence that training content changes in response to incidents and investigation findings. A completion rate of 97 percent among salaried staff and 71 percent among hourly store staff, with no comprehension testing, describes a program that reaches the people least likely to face the risks. The first 90 days as a staff auditor guide’s point about how people actually learn applies to compliance training as much as to audit training.
Speak-up channels and the hotline benchmarks
A program’s speak-up channel is the clearest effectiveness signal it has, because employees vote with their reports. The tests: channels exist that employees know about and trust (hotline, web, in-person, manager escalation, with anonymous options and languages), awareness is tested (a survey question or the audit’s own interviews), reports are acknowledged and handled within the timelines the organization and the EU directive set, confidentiality is protected in practice (case system access, how identities are handled), retaliation is prohibited, monitored and investigated (the DOJ’s 2024 update puts weight here), and the volume and mix of reports are benchmarked. The benchmark data published annually by the major hotline providers gives the comparison: for 2024 data covering some 4,000 organizations and 2.15 million reports, the median was 1.57 reports per 100 employees, 46 percent of closed reports were substantiated, web intake (33 percent) overtook the telephone hotline (29 percent) for the first time with in-person and other channels the largest share (37 percent), and retaliation reports continued to rise (about 3 percent of reports, substantiated at 18 percent, the lowest of any category). An organization reporting at 0.5 per 100 employees is more likely to have an awareness or trust problem than a conduct advantage, a substantiation rate far below the benchmark suggests either poor triage or a channel used for grievances, and an anonymous share far above peers suggests fear. The audit also tests the case-level handling: a sample of reports from intake to closure for timeliness, triage decisions, investigator assignment, communication back to the reporter and the quality of closure. The culture guide covers the trust dimension; this guide covers the mechanism.
Investigation quality
Investigations are where the program meets its hardest cases, and the tests are the ones a prosecutor would apply: a documented investigation protocol (intake, triage and severity classification, assignment by severity and subject matter, independence of the investigator from the subject and the reporting line, privilege decisions, evidence preservation, interview standards, timelines, documentation, outcome communication, escalation to the board for senior-level or systemic matters); a case management system that holds every case with a complete record; quality of the files in a sample (allegations understood, scope appropriate, evidence gathered and preserved, interviews documented, conclusions supported, root cause identified, remediation and discipline recorded, closure communicated); timeliness against the protocol; and the handling of the matters that test independence most (allegations against executives, matters involving the compliance or legal functions themselves, matters with regulatory reporting obligations). Internal audit’s own methods apply: the first 48 hours guide, the interview techniques guide and the root cause analysis guide describe the standards the investigation files should meet. A pattern of substantiated cases closed without root cause or remediation is the finding that recurs most, and it means the program punishes individuals without fixing anything.
Discipline consistency and incentives
Consistency is the test employees apply to the whole program: if the regional vice president and the store associate receive different consequences for the same violation, the code is a document about associates. The audit tests it with data: the population of substantiated violations in the period, classified by type and severity, joined to the disciplinary outcomes and to the subject’s level, region and function, with the distribution of outcomes compared across groups and outliers examined (the same violation producing termination in one region and a warning in another; senior employees with lesser consequences; repeat subjects). A discipline matrix (expected consequences by violation type and severity) is the control that produces consistency, and its absence is a design finding. Incentives are the other half: the Sentencing Guidelines and the DOJ ask whether compensation and promotion reward compliance and penalize misconduct, and the tests are whether bonus plans carry compliance gates or clawbacks for misconduct, whether performance evaluations include conduct, whether people with substantiated findings were promoted or paid bonuses in the period (a data join the audit can run), and whether sales and operational incentives create the pressure the risk assessment should have named. The governance guide’s compensation process tests and the conduct risk guide’s incentive analysis apply.
Third parties
Most corruption, sanctions and fraud cases run through intermediaries, suppliers, distributors and agents, and the program’s third-party component is tested for risk-based due diligence (screening and depth proportionate to the third party’s risk: country, role, government touchpoints, payment terms), contractual protections (compliance clauses, audit rights, termination rights, training requirements), ongoing monitoring (re-screening, payment pattern monitoring, red flag escalation), training and certification of high-risk third parties, and the data the program has about the population (a complete list of third parties by risk tier is the first test, and often fails). The third-party risk management and due diligence by tier guides give the program structure, the procurement fraud schemes guide the schemes, and the audit’s contribution is to reconcile the compliance function’s third-party inventory to the vendor master and payment data, which is where the unscreened intermediaries are found.
Monitoring, data and continuous improvement
The DOJ’s 2024 update sharpened a long-standing question: does compliance have access to data and the capability to use it? A program that learns about misconduct only from the hotline is reactive; one that monitors expense reports, gifts and entertainment, third-party payments, discount and pricing exceptions, access to sensitive data and trading activity finds patterns before they become cases. The tests: a monitoring plan tied to the risk assessment, the analytics or reviews actually performed in the period with results, compliance’s access to the systems and data it needs (or its dependence on the business), the use of hotline, investigation and audit data to find trends and adjust the program, periodic testing of the program (including internal audit’s own prior work and what changed because of it), and a documented improvement cycle with changes traced to their triggers. The procurement fraud analytics and continuous monitoring guides describe what compliance monitoring can look like without a large platform, and the KRI program guide the indicators a compliance committee should see.
The metrics that show effectiveness
| Component | Metric | What good looks like | What a bad reading suggests |
|---|---|---|---|
| Risk assessment | Age; coverage of current risks; traceability of program elements to rated risks | Updated in the last year; new risks (AI, new markets) present; every training module and monitoring routine traces to a risk | Static assessment; program elements with no risk rationale |
| Governance | Board reports per year; private sessions; budget and headcount per 1,000 employees against peers; CCO access evidenced | Quarterly reporting with discussion minuted; benchmarked resources | Annual report only; CCO never alone with the committee |
| Code and policies | Attestation rate by population; policy portal usage; policies past review date | Above 95 percent attestation across all populations; usage tracked; under 10 percent past review | Hourly or contractor populations unattested; orphan policies |
| Training | Completion by population against the full workforce; comprehension pass rates; targeted training delivered to high-risk roles | Completion above 90 percent in every population; assessments with failures followed up | Completion measured on the learning system’s population only; no comprehension data |
| Speak-up | Reports per 100 employees against the 1.57 benchmark; substantiation rate against 46 percent; anonymous share; awareness survey; acknowledgment and closure times | Near benchmark volume; substantiation 40 to 50 percent; awareness above 80 percent; closure within protocol | Very low volume (awareness or fear); very low substantiation (triage or grievance channel); rising retaliation reports |
| Investigations | Cycle time; files meeting the protocol in sample; root cause and remediation recorded; senior-level matters escalated | Median closure within protocol; root cause in every substantiated case | Cases closed without remediation; executive matters handled informally |
| Discipline and incentives | Outcome consistency across groups for comparable violations; subjects of substantiated findings promoted or paid bonuses; compliance gates in incentive plans | Matrix applied; no unexplained variation by level or region; gates present | Variation by region or level; bonuses paid to subjects |
| Third parties | Share of third parties risk-tiered; high-risk due diligence completion; re-screening; inventory reconciled to vendor master | Complete inventory; 100 percent of high-risk parties screened | Unscreened intermediaries found in payments |
| Monitoring | Analytics performed against the plan; findings acted on; compliance’s data access | Routine analytics with documented follow-up | Hotline as the only detection source |
| Improvement | Program changes traced to triggers (incidents, audits, assessments) | A documented change log | Same program as three years ago |
A worked engagement: Tamarack Stores’ FY26 ethics and compliance program audit
Tamarack Stores is the small-cap listed retailer used in the retail examples on this site: 240 stores in 11 states, $1.9 billion of revenue, 14,000 employees of whom 70 percent are part-time, 30 percent private label sourced through about 60 international suppliers, and a 10-person internal audit function. The ethics and compliance program is run by a chief compliance officer reporting to the general counsel with a dotted line to the audit committee, a team of four, a hotline operated by a vendor, annual code training through the learning system, and a compliance committee of executives meeting quarterly. The FY26 audit (380 hours) covered the whole program against the frame above, with the speak-up, investigation and discipline components tested at case level and the discipline and incentive analytics run on the full year’s data.
| Component | What the audit found | Rating and outcome |
|---|---|---|
| Risk assessment | Last updated in 2023; no coverage of the private-label supplier expansion into two new sourcing countries, the loyalty data program or the AI tools deployed in customer service; training and monitoring not traceable to rated risks | High. Assessment refreshed with a defined method; program plan rebuilt from it |
| Governance and resources | CCO reported to the general counsel; the dotted line to the committee had produced one meeting in two years and no private session; compliance headcount (4 for 14,000 employees) below peer benchmarks; compliance depended on finance to run its own expense and vendor reports | High. Charter amended for quarterly committee reporting and a private session; two hires approved; read access to the ERP and expense systems granted to compliance |
| Code and policies | Code attestation 91 percent overall but 78 percent among part-time store staff; 38 of 112 policies past review (from the governance audit); gifts policy contradicted by the supplier conduct guide | Medium. Attestation extended into store onboarding; contradictions resolved |
| Training | Completion 97 percent salaried, 71 percent hourly, computed on the learning system’s population, which excluded 1,900 seasonal hires; no comprehension assessment; no targeted anti-corruption training for the 14 sourcing staff dealing with international suppliers | High. Completion re-based on the HR population; assessments added; targeted training delivered |
| Speak-up | 148 reports in the year (1.06 per 100 employees against the 1.57 benchmark); anonymous share 61 percent; awareness survey in 30 stores found 54 percent of hourly staff could not name a way to report; acknowledgment within two days in 96 percent of cases; 7 retaliation allegations, 1 substantiated | High. Store-level communication campaign; manager training on receiving concerns; retaliation monitoring of reporters’ employment events for 12 months |
| Investigations | Protocol existed; of 40 sampled cases, 31 met it; 9 substantiated cases closed without root cause or remediation beyond the individual; median closure 41 days against a 30-day target; one allegation against a regional vice president was investigated by the region’s HR lead who reported to him | High. Root cause and remediation mandatory fields; independence rule for senior subjects; the regional matter re-investigated by outside counsel |
| Discipline and incentives | Analytics on 212 substantiated violations: for comparable policy violations, termination rates ranged from 28 percent in one region to 61 percent in another; 6 subjects of substantiated findings received full bonuses; store manager bonus plans had no compliance gate | High. Discipline matrix adopted; compliance gate added to FY27 incentive plans; bonus clawback provision drafted |
| Third parties | Anti-corruption screening performed for 41 of 60 international suppliers; the compliance inventory of intermediaries reconciled to vendor payments found 12 sourcing agents paid $3.1 million with no screening record | High. Screening completed; agents brought under the due diligence program; payments to unscreened agents blocked in the ERP |
| Monitoring and improvement | No analytics performed; detection relied on the hotline and the external audit; program unchanged since 2023 | Medium. Monitoring plan with five routines (gifts and entertainment, supplier payments, discount overrides, loyalty data access, expense patterns) built with internal audit’s analytics team |
The report rated the program Needs Improvement and framed it for the committee in the DOJ’s three questions: designed on a stale risk assessment, under-resourced and without the independence or data to function, and demonstrably not working in practice where it mattered most (the stores, the suppliers, the discipline). The committee moved the chief compliance officer’s reporting line to a solid line to the committee with administrative reporting to the general counsel, approved the resources, and asked for a follow-up audit of the speak-up and investigation components in FY27. The chief compliance officer, who had asked for most of these changes for two years, treated the audit as the evidence she had lacked, which is the relationship the reporting section describes. The retail pillar places the engagement in Tamarack’s plan.
Failures that recur
| Failure | How it shows | What the audit should do |
|---|---|---|
| Existence audited as effectiveness | “A code exists, training is delivered, a hotline operates: satisfactory” | Test operation and effect with data and cases |
| Stale risk assessment | New markets, products and technologies unaddressed | Trace program elements to current rated risks |
| Compliance without access | CCO reports through the general counsel; no private session; no data | Test the reporting line in practice and the data access |
| Completion as comprehension | High completion, no assessment, population understated | Re-base on HR data; test comprehension |
| Hotline volume read as virtue | Low volume celebrated | Benchmark; survey awareness |
| Investigations without remediation | Individuals disciplined; causes untouched | Root cause and remediation in every substantiated case |
| Discipline by geography or seniority | Same violation, different consequence | Join violations to outcomes and demographics |
| Incentives unexamined | Bonuses to subjects of findings; no gates | Data join of findings to compensation |
| Third-party inventory incomplete | Unscreened agents in payments | Reconcile to vendor master and payments |
| Program never tested | No monitoring; no changes in years | Monitoring plan; improvement log; periodic audit |
Reporting without usurping the chief compliance officer
The compliance program is run by a peer function with its own board access, and the audit’s report should strengthen that function’s hand rather than compete with it. In practice: discuss findings with the chief compliance officer first and often (the management responses guide applies, and most findings will be ones the compliance officer already knows and has been unable to resource); frame the report in the enforcement frame (the three questions, the seven elements), because that is the frame the committee will be judged by if something goes wrong; separate findings about the program’s design and resources (which are the organization’s to fix, often the committee’s) from findings about the compliance function’s execution (which are the compliance officer’s); quantify with the metrics table, so the committee sees benchmarks rather than opinions; and handle the matters that surfaced during the audit (an unscreened agent, an investigation that was not independent) through the appropriate channels rather than the report alone. The five Cs and severity guides give the writing and rating standard, the internal audit versus SOX versus compliance versus ERM guide the boundary the report should respect, and the board risk reporting guide where the program metrics belong once the committee asks to see them every quarter, which, after a good audit, it will.
Questions about auditing the ethics and compliance program
What does an ethics and compliance program audit cover?
The program’s components tested for design, operation and effect: the compliance risk assessment, governance and resources, the code and policies, training reach and comprehension, speak-up channels and anti-retaliation, investigation quality, discipline consistency and incentives, third-party management, monitoring and data, and the improvement cycle, measured against the criteria enforcement authorities use.
What criteria should the audit use?
The US Sentencing Guidelines’ seven elements and the Department of Justice’s Evaluation of Corporate Compliance Programs (updated September 2024, with its three questions: well designed, applied in good faith with adequate resources, works in practice), plus sector guidance (HHS OIG for healthcare), the UK Bribery Act and failure-to-prevent-fraud guidance where relevant, the EU Whistleblower Directive for channels, and ISO 37301 where adopted.
What hotline benchmarks apply?
Published benchmarks for 2024 data across some 4,000 organizations put the median at 1.57 reports per 100 employees, a 46 percent substantiation rate, web intake (33 percent) overtaking the telephone hotline (29 percent) with in-person and other channels largest (37 percent), and retaliation reports at about 3 percent of all reports with an 18 percent substantiation rate. Low volume more often signals low awareness or trust than good conduct.
How do you test discipline consistency?
Take the period’s substantiated violations classified by type and severity, join them to disciplinary outcomes and to the subject’s level, region and function, compare outcome distributions across groups, examine outliers, check whether subjects of findings received bonuses or promotions, and test whether a discipline matrix exists and was applied.
How is the audit different from what compliance does?
Compliance designs and runs the program and monitors compliance with the rules; internal audit independently tests whether the program works, using cases, data and benchmarks, and reports to the audit committee. The audit should strengthen the compliance function’s position, not duplicate its work or take over its reporting.
How often should the program be audited?
A whole-program review every two to three years with component deep dives in between (speak-up and investigations, training and third parties), more often in highly regulated sectors or after an incident; the DOJ’s guidance treats periodic testing by internal audit as part of what makes a program effective.
Related guides
- Auditing corporate culture and ethics — the behavioral side of the same question.
- How to run a compliance risk assessment — the program’s first component in depth.
- Compliance risk: a comprehensive guide — the risk the program manages.
- Conduct risk — incentives and behavior.
- Internal audit vs compliance — the boundary.
- Internal audit vs SOX vs compliance vs ERM — the wider map.
- Risk taxonomy — naming the compliance risks.
- How to audit corporate governance — board oversight, policies and compensation.
- The audit committee charter — the committee’s compliance oversight.
- When internal audit finds fraud: the first 48 hours — the investigation standard.
- Audit interview techniques — interview quality in investigations.
- Root cause analysis for audit findings — remediation beyond the individual.
- Third-party risk management program — the third-party component.
- Vendor due diligence by risk tier — screening depth.
- Procurement fraud schemes — what intermediaries do.
- Procurement fraud analytics — compliance monitoring routines.
- Continuous monitoring on a small budget — monitoring without a platform.
- KRI program — indicators for the compliance committee.
- Evaluating management responses — working with the chief compliance officer.
- The five Cs of audit findings — writing the findings.
- Finding severity ratings — rating them.
- Board risk reporting — program metrics in the pack.
- Internal audit in healthcare — the OIG frame.
- Internal audit in retail — Tamarack’s wider program.
Leave a Reply