8 Steps to an Effective Compliance Programme

Risk Assessment

A risk assessment is key to developing your organisation’s risk profile – the starting point of an effective programme. Your risk profile is an evaluation that identifies the unique risks your organisation may face given its industry, geography and employee population. A periodic, comprehensive risk assessment will help regularly identify potential criminal, reputational and ethical risks.

Need help managing and assessing your risks? Contact us to see how we can help. 

Use the chart below as a self-assessment to see how you are currently evaluating your risks.

• Green: We have the best practices in place with a robust process
• Yellow: We are in the process of developing a robust process
• Red: We do not have a process in place or know how to implement one

If your responses fell mostly in the green column, you have the right processes in place to get an accurate picture of your risks. If most of your responses fell in the yellow or red category, review the resources included below to get a better idea of where your risks may be. 

Standards, Policies & Procedures

As we build on the foundations of an effective compliance programme, policies and procedures play a massive role. Your code of conduct is the first step in establishing effective policies and procedures as it is the cornerstone policy of your organisation. Beyond writing policies like your code of conduct, thought must also be given to how you will manage the ever-increasing number of polices organisations have today. In fact, according to the 2017 NAVEX Policy & Procedure Management Benchmark Report, 41 percent of organisations surveyed manage over 100 policies and procedures.

Managing the writing, editing, distributing and attesting to policies and procedures is no easy task. 

Interested in finding out how you can more effectively manage your policies and procedures? Schedule a demo of PolicyTech to see how. 

Use the chart below as a self-assessment to see how your policies and procedures, particularly your code of conduct, are measuring up to best practice standards.

• Green: We have a best practice code of conduct in place
• Yellow: We are in the process of developing our code of conduct
• Red: We do not have a code of conduct in place and don’t know where to start

If your responses fell mostly in the green column, you have a good handle on your code of conduct. Take a look at the resources below to learn more about effectively managing policies and procedures.

If your responses fell mostly in the yellow or red column, you have some writing to do. Take a look at the code of conduct eBook below for some advice on how to write and distribute your code of conduct.

Communications & Training

The policies and procedures in your compliance programme must be accompanied by a strategic communication plan and training programme to keep employees informed about the components of the programme and tested on the policies they’re responsible for knowing.

Communicate

Having all of the right policies in place and an effective reporting process for employees has no value if employees don’t know where to go to find policies or who to call when witnessing misconduct.

Work with departments across the organisation like Marketing and HR to develop a good communication plan so employees, leadership and third parties are crystal clear about the tools available to them and the expectations placed on them. Take a look at the example Awareness Materials below to help you communicate.

Need help with your ethics training and content? Get in touch with a NAVEX expert for a demo.

Train

Beyond knowing what tools employees have available to them, you must ensure they know what is expected of them. Compliance training ensures employees are up-to-date on specific legislation and your company’s policies. It’s best to provide training in a risk-based manner with the highest risk employees receiving applicable training first.

A common practice programme has the following elements:

• Ethics and compliance training tied to a risk assessment
• Managers are aware of their responsibilities and how to respond to issues
• Leadership support is messaged throughout the programme
• A multiyear education plan exists with various formats and lengths of training

A best practice programme takes them a step further to include: 

• Education deployed relative to an employee’s role
• Assessment of the effectiveness of the training deployed
• Board and leadership training, not just briefing

Drive measurable value with your training programme with resources below. 

Culture

When an organisation’s policies, procedures, rewards or even its Code of Conduct are in conflict with its culture, culture wins. Therefore, in order to have an effective ethics and compliance programme, an organisation must pay as much attention to culture as it does to policies, training, auditing and other programme elements.

Compliance supports the strategic goals and mission of an organisation just as much as any other department or function. Achieving an effective ethics and compliance programme requires more than simply adding rules and additional layers of controls. Successful programmes are integrated efforts that align financial and compliance requirements with the organisation’s mission and values.

Forward thinking organisations strive to build a culture where all employees know that doing the right thing is expected, understand the standards that apply to them and are confident their management is committed to operating with integrity. These same employees should feel empowered to raise concerns about misconduct without fear of retaliation and believe their concerns will be addressed.

If doing the right thing is the expected practice, behaviour that is unethical or otherwise misaligned with organisational standards will stand out and can be more easily addressed. The only way to know this by assessing the organisation’s culture as part of the assessment of the ethics and compliance programme.

Answer the following questions to see if your culture is one that promotes ethics and respect.

• Is all staff held equally responsible for their actions?
• Does doing things right trump revenue and company goals when the rubber hits the road? Is unethical behaviour clearly seen as out of bounds?
• Do employees believe that management will take appropriate action if misconduct is communicated to them?
• Do employees believe they can raise issues to management or the 0800 number without fear of retaliation?
• Is the program viewed as a paper programme or as a genuine commitment?