What compliance covers
Compliance law is less a single body of law than a practice: identifying the rules that apply to a business and building the policies, training, controls, and reporting lines that keep people inside them. The rules vary by industry and can include anti-corruption, anti money laundering, sanctions and export controls, privacy, employment, and sector-specific regulation. A program matters not only for preventing problems but for how a company is treated when something goes wrong. Federal prosecutors evaluate corporate compliance programs when deciding how to resolve cases, and the federal sentencing guidelines give weight to an effective program. Regulators in many fields take a similar view.
What makes a program credible
Prosecutors and regulators generally ask whether a program is well designed for the company's actual risks, whether it has the resources and authority to function, and whether it works in practice. A thick binder of policies no one reads tends to count for little. What counts is evidence that people were trained, concerns were investigated, discipline was applied consistently, and lessons were carried into changes. Leadership's tone matters, and so does whether compensation and incentives reward the conduct the policies demand. Keep records of risk assessments, training, hotline reports and their outcomes, and how audit findings were fixed, because those records are what the company will rely on later.
Starting or rebuilding a program
When we first meet, we look at what the business does, where it operates, who it sells to, and which regulators already have a view of it. From there we identify the highest risks and the order in which to address them, rather than adopting a full program all at once. If a concern has already surfaced, we discuss whether an investigation should come first and how to keep it privileged. For growing companies, we also consider which compliance functions can be supported by outside providers and which need someone inside the business with real authority.
