Compliance Programme

Most programmes follow a recognisable shape. Leaders set the tone and appoint someone to run it with enough authority and resources. A risk assessment says where breaches are most likely. Written policies and a code of conduct translate rules into instructions, and training makes sure people understand them. A confidential channel lets staff raise concerns without fear. Monitoring, testing and audit check the controls, while investigation and discipline deal with failures, and lessons are fed back into the policies. Programmes tied to ethics add values and conduct standards to legal duties, which is why some firms call theirs an ethics and compliance programme. Prosecutors and regulators in several countries ask whether a programme is well designed, properly resourced and working in practice when they decide how to treat a company that has broken the law. When a prosecutor decides whether to treat a company leniently, the first test is whether this machinery ran before the offence or was assembled afterwards.

A construction group wins its first contracts abroad. It appoints a compliance head, writes an anti-bribery policy, trains 300 managers and sets up an independent hotline. A risk assessment flags customs agents as high risk, so the programme adds due diligence checks on agents and yearly audits of payments to them.