State of Risk & Compliance Report

Nearly one-quarter of respondents who are knowledgeable about ethics & compliance (23%) said their compliance program was split across multiple departments. This was the most common response, yet our analysts would have expected this share to be even higher. It is quite common for compliance obligations to be shared across HR, IT, Risk, Finance and potentially other functions. This highlights the importance of close relationships between these functional areas. 

Twenty-one percent said their organization’s compliance program rested within Legal, and 20% said it was an independent function reporting to the CEO and/or board of directors.  

Three percent said their program is within Finance – a potential red flag as these functions may be better able to facilitate effective governance when operating independently.

The majority of respondents – 77% - said their employees would most likely make a report of misconduct internally. Fourteen percent said employees would most likely turn to an external entity such as a regulatory or the media to make a report. Only 9% said employees were unlikely to make a report at all.

As in years past, a concerningly low share (61%) of respondents who are knowledgeable about ethics and compliance said their organization has a hotline or whistleblower internal reporting channel. Only 55% said their organization has a non-retaliation policy.

With the caution that direct year-over-year comparisons are imprecise due to changes to survey structure and differing respondent bases, these numbers do represent an improvement over 2023. At that time, only 51% of respondents said they had a hotline or whistleblower internal reporting channel, and 51% said they had a nonretaliation policy.

Internal reporting is a central pillar for any effective compliance program. Those reports can bring misconduct to light that would otherwise be free to damage the organization and its culture. The ability to speak up without fear of reprisal also helps broadcast to employees and others that the organization takes ethics seriously. While it is possible more organizations are implementing internal reporting programs compared to last year, the numbers indicated in this survey are still concerningly low.

Generally, the share of respondents that are knowledgeable about ethics & compliance who indicated positive behaviors was greatest regarding senior executives. Over two-thirds of respondents (68%) said senior executives have encouraged compliance and ethics within their organization. Sixty-one percent said the same about middle management, and 56% said so about first-line managers and supervisors. Half (50%) of respondents said senior executives have persisted in a commitment to ethics in the face of competing objectives, a share that declines to 44% for the front line. 

The picture is not entirely straightforward – senior executives were said to tolerate greater compliance risks in pursuit of new business objectives and/or greater revenues (30%) slightly more commonly than other levels of leadership (29% of middle management and 27% of first-line managers and supervisors). There were also slightly more commonly said to have impeded compliance personnel from effectively implementing their duties (15% of senior executives, 14% of middle management, and 11% of first-line managers and supervisors).

Two-thirds of respondents who are knowledgeable about ethics & compliance (66%) said their board receives periodic reports on compliance matters. Of concern is that one-third did not say the same – 100% of boards should receive periodic reports on compliance matters. 

Fifty-eight percent said the board has oversight of the compliance program. Fewer than half of respondents (30%-42%) affirmed any of the other board compliance activities on the list, and near the bottom, only 30% said the board was highly engaged in the compliance program. 

While changes to this year’s survey and respondent base complicate a simple year-over-year comparison, the share of respondents who said their board receives periodic reports on compliance matters was slightly greater in 2024 than in 2023 – 66% versus 62%. A somewhat greater share of respondents said the board has oversight of the compliance program – 58% versus 52%. Not all comparisons were positive – for example, the share of respondents who said members of their board have compliance experience and/or expertise was a bit lower, 41% versus 48%. These comparisons may reflect any number of drivers, but may provide readers fodder for internal conversations as to how the relationship between Compliance and their boards of directors is trending.

More than four out of five respondents who are knowledgeable about ethics and compliance (81%) said their organization’s compliance program is either “strong” or “moderate” in its influence on business decisions. Only 17% said the program has limited influence.

A large majority of respondents who are knowledgeable about Ethics & Compliance – 91% - said their organization has some kind of strategy for third-party due diligence. Most common (36%) was to use a risk-based approach to apply different levels of due diligence based on risk throughout the engagement. 

Concerningly, a quarter of respondents (25%) said their organization conducts the same due diligence across all third parties regardless of risk level. This is certainly less effective than a risk-based approach – for example, it may place undue burden on third parties with a low risk level.