Compliance
Also known as: Corporate compliance program · Regulatory compliance · Ethics and compliance
The set of policies, controls and responsibilities that ensures a company follows laws, regulations and its own rules — and can prove that it does.
Legal basis
U.S. DOJ Criminal Division — Evaluation of Corporate Compliance Programs (Sept. 2024)
Compliance describes less a department than a capability: knowing which rules apply to the business, having controls that enforce them and records that let you demonstrate it to a regulator, an auditor or a prosecutor.
In the US the benchmark is the Justice Department's Evaluation of Corporate Compliance Programs, last updated in September 2024, which prosecutors use when deciding how to resolve a corporate case. It turns on three questions: is the program well designed, is it adequately resourced and empowered to function effectively, and does it work in practice. The 2024 update added expectations on managing the risks of AI and emerging technology and on using data to test controls.
In regulated sectors — lending, insurance, payments — compliance meets the Bank Secrecy Act, know-your-customer and privacy law. What ties them together is the same requirement: decide on verified information and keep the trail of why each decision was made.
Frequently asked questions
What is a compliance program?
It is the organized set of policies, risk assessments, controls, training, reporting channels and testing through which a company prevents and detects violations of law and of its own rules, and shows that it does.
What does DOJ look for in a compliance program?
Whether it is well designed, whether it is adequately resourced and empowered to function effectively, and whether it works in practice, as set out in the Criminal Division's Evaluation of Corporate Compliance Programs.