3 Compliance and Ethical Practice

Compliance and ethical practice

Organizations operate under requirements arising from laws, regulations, licenses, contracts, and their own policies. Compliance and ethical practice means identifying those requirements, meeting them in daily work, and responding responsibly when something goes wrong. A written policy alone is not enough: an effective program is designed around the organization’s risks, supported by leadership and resources, and tested in practice.

Identifying and managing obligations

Requirements vary according to industry, location, organization, and activity. They may concern employee safety, privacy, financial reporting, fair competition, anti-bribery, environmental protection, or contractual commitments. Organizations should determine what applies to their operations and to people acting on their behalf, including relevant contractors, suppliers, and agents.

A practical process is to:

1. Identify obligations: Track relevant laws, regulations, permits, contracts, and internal standards.

2. Assign responsibility: Clarify who interprets each requirement and who carries it out.

3. Translate requirements into work practices: Provide accessible procedures, training, and controls.

4. Review changes: Reassess when laws, business activities, locations, technology, or relationships change.

5. Keep evidence: Retain appropriate records of decisions, training, approvals, checks, and corrective action.

For example, before entering a new market, a company may need to review local licensing rules, employment requirements, data-handling obligations, and risks associated with local intermediaries. Requirements are jurisdiction-specific, so organizations should seek qualified legal or compliance advice for their particular circumstances.

Ethical decisions and leadership

Compliance sets a minimum standard. Ethical conduct also asks whether an action is honest, fair, and consistent with the organization’s responsibilities. Employees should follow applicable law and policy, avoid misleading others, protect confidential information, disclose conflicts of interest, and refuse improper payments or favors.

When a decision is unclear, consider whether it is lawful, consistent with policy and stated values, and something you would be comfortable explaining to a colleague, customer, regulator, or the public. If doubt remains, pause and seek guidance. Leaders shape ethical culture by modeling standards, rewarding responsible choices, and making it safe to raise concerns.

Controls and accountability

Controls help prevent, detect, or correct failures to meet obligations. Good controls are proportionate to the risk and built into ordinary work.

• Preventive controls reduce the chance of a breach. Examples include approval limits, role-based access, training, supplier checks, and separation of duties.

• Detective controls identify problems. Examples include reconciliations, transaction reviews, audits, access logs, and confidential reporting channels.

• Corrective controls address detected problems and reduce recurrence. Examples include correcting records, restricting access, revising procedures, and retraining staff.

A gifts-and-hospitality process, for example, might set approval thresholds, require employees to record gifts offered or received, and periodically review records for unusual patterns. Controls should have named owners, be documented, and be applied consistently. Senior leaders and governing bodies should oversee the program; compliance personnel need suitable authority, access, and resources to do their work.

Monitoring and improvement

Monitoring checks whether controls are being followed and work as intended. It may include routine supervision, data reviews, audits, employee surveys, training assessments, and analysis of complaints or incidents. Review the program periodically and when significant changes occur, such as expansion into a new market or introduction of a new product.

Monitoring should lead to action. Organizations can track overdue training, repeat control failures, time taken to investigate concerns, and completion of corrective actions. A high number of reports does not automatically mean that a program is failing; it may indicate that people trust the reporting process. Consider whether concerns are handled fairly, patterns are recognized, and the organization learns from results. Program effectiveness depends on whether it is well designed, adequately resourced, and effective in practice.

Responding to possible breaches

When a possible breach is identified, respond promptly and impartially in a way suited to the facts and applicable requirements.

1. Receive and protect the report. Provide safe reporting channels, respect confidentiality where possible, and prohibit retaliation.

2. Triage and contain. Assess urgency and potential harm; take appropriate steps to stop ongoing conduct and preserve relevant records.

3. Investigate fairly. Use qualified, sufficiently independent investigators; document decisions and findings; and protect the rights of those involved.

4. Escalate and seek advice. Notify appropriate leaders or oversight bodies and obtain legal advice where needed. Consider whether law, regulation, or contract requires notification or other action.

5. Apply proportionate consequences. Address substantiated misconduct consistently, regardless of seniority, while considering relevant facts.

6. Remediate and learn. Correct harm where possible, address root causes, improve controls or training, and check whether the changes work.

Do not destroy, alter, or conceal relevant information. Whether to report externally, to whom, and when depends on the facts and applicable obligations. Seek qualified advice rather than assuming disclosure is always required or never required. Investigation, discipline, root-cause analysis, and remediation are important elements of an effective response.

A continuous compliance cycle

Effective compliance combines clear obligations, ethical leadership, practical controls, ongoing monitoring, and a fair response to concerns. The cycle is continuous: identify risks and obligations, put safeguards in place, test them, respond to failures, and improve the system.

• Compliance obligations