​

• What is the structure of the ethics and compliance program and the manner in which overall responsibility for compliance oversight is assigned to particular high-level personnel? 
• ​In particular, analyze the:
  
  • Staffing of the ethics and compliance team - ask yourself: Does this seem appropriate for the size and scope of the business? Consider benchmarking with peers.
  • Interactions with steering committees, the Board of Directors, and senior executive leaders
  • Interactions with other shared services groups
  • Use of ethics liaisons or ombuds persons
  ​

• Do those running the ethics and compliance program have a “seat at the table”? 
• What resources and authority have been allocated to those individuals? Are they sufficient? 

• Are the members of the organization’s governing authority actively engaged in the organization’s ethics and compliance program? For instance:
  
  • Are they knowledgeable about its content and operations?
  • Do they exercise reasonable oversight of that program, including the performance of person with overall responsibility for the ethics and compliance program?
  • What ethics and compliance training is provided and how frequently?
  ​

• How does the organization gather information about the culture of its workforce?
• What does the organization do in response to the information (e.g., how does it use that information)?
• How often does the organization measure its overall ethical health and compliance environment?
• Does the measurement include:
  
  • Awareness and perceived effectiveness of available ethical resources,
  • Tone at the top and the middle (ethical leadership from executives and direct supervisors),
  • Pressure to commit misconduct,
  • Confidence in reporting,
  • Fear of retaliation, and
  • Perceived organizational justice
• Do members of both executive management and the governing authority exhibit support for and involvement in the program (e.g., “tone from the top”)?
• ​Does middle management exhibit support for and involvement in the program (e.g., “tone from the middle”)?​
  
  

• What is the status of documentation supporting the ethics and compliance program, including the following:
  • Written code of conduct,
  • Key standalone policies, and
  • Other relevant standards

• Are the documents well-written, comprehensive and well-communicated? 
• Where are the documents and when were they last updated?​

• Are they versions of policies and codes created for specific audiences when needed (e.g., a Code of Conduct for the Board of Directors or a Supplier’s Code, etc.)?​

• What are the company’s current compliance training and communications program components? Are there risk areas that are not covered?
• How often is training delivered, to whom, in what format/modality, and how it is tracked?
• How does the company enforce its training requirements?
• How, and how often, is the quality and effectiveness of the training and communication initiatives measured?
• How does the company provide information to managers on their special role in supporting the ethics and compliance program?

​

• Does the organization conduct periodic evaluations of the effectiveness of its ethics and compliance program?
• How often and in what form does the organizations conduct a risk assessment to evaluate the company’s high-risk areas, such as:
  • Conflicts of interest disclosures
  • Gifts and entertainment tracking
  • Travel and expense reporting
  • Business specific high risk situations – (e.g., large deals, sales incentives, interactions with government officials, etc.)
• What are the organization’s supply chain oversight systems and anti-bribery compliance efforts?
• Does the organization employ auditing and monitoring systems designed to prevent and detect misconduct?
• Is the organization is using reasonable efforts to exclude from positions of high authority any individuals who have engaged in illegal activities or other improper conduct?

• Does the organization operate a whistleblower system, giving employees a way to anonymously report potential or actual misconduct and seek guidance on issues or questions?
• Does the organization have a case management system and does it have an integrated tracking platform?
• Who conducts ethics and compliance investigations and how are they trained?
• What is the process for investigations and how is it communicated? 
• What steps does the organization take to respond to and prevent instances of similar misconduct, including making any necessary changes to its policies and procedures?
• ​How does the organization promote non-retaliation and monitor for retaliation against those who have raised concerns?
• ​Does the organization use systems that incent and promote employee behavior in the areas of ethics and compliance? Does the organization enforce and encourage compliance through disciplinary measures?
• ​Does the organization’s promotion system and performance evaluation systems allow for ethics and compliance input?​
  

​

• What is the perception of the ethics and compliance function among other areas of the business?
• Who are the champions and allies for the ethics and compliance function within the business?
• Where are there relationship challenges that hinder collaboration?