Starting from the company's actual risks
A useful program begins with an honest look at where the business is exposed, which differs sharply between, say, a manufacturer that exports, a health care provider, and a consumer lender. The risks that matter might include bribery through intermediaries, sanctions and export controls, data privacy, wage and hour practices, or industry-specific rules. Policies should be written for those risks in language employees understand, and controls should be built into the processes where the risk actually arises, such as vendor onboarding or expense approval. Federal prosecutors have published guidance describing how they evaluate programs, and it emphasizes whether the program is tailored to the company and whether it works in practice. A program copied from another company rarely meets that standard.
Keeping it alive and documented
Assign responsibility to someone with authority and access to leadership, and give that function a budget that matches the company's size. Train employees on the risks relevant to their roles rather than on everything at once. Offer a reporting channel that allows anonymous reports, and make sure reports are actually investigated and tracked to resolution. Test controls periodically and record what was found and fixed. Board minutes should reflect that directors receive compliance reports and ask questions, because oversight that leaves no record is hard to show later. Update the program after acquisitions, new markets, or changes in law.
Where an outside review helps
We often work with companies that have a program on paper but are unsure how it would hold up. We look at the risk assessment, the policies, the reporting system, and how past reports were handled. We focus on gaps that are proportionate to fix, since an unrealistic program can create its own problems. For companies entering a regulated industry or preparing for investment or sale, we help build a program that buyers and investors will be able to examine. When a specific problem has already been reported, the analysis shifts toward investigation and possible disclosure, which we handle separately.
