Over the past decade, the idea of what constitutes an effective compliance program has changed. Historically, many organizations viewed compliance as a set of policies with in-person training delivered to employees. It wasn’t a program, it was a set of rules. The best tie to the business was usually some input on the policies and participation in the training.

The game has changed. Modern compliance functions are expected to act as trusted advisors closely collaborating with the various business units in an organization so that the compliance function can appropriately identify and minimize the risk for the overall organization. These functions use data to manage risk and develop policies and controls that are tailor-made to the particular business. They embed compliance in the business and actively work to build an ethical culture. Compliance leaders provide periodic updates to senior management and the relevant board or board sub-committee. The chapter in the United States Sentencing Guidelines outlining what an effective compliance and ethics program should have provide a baseline, but the modern program is embedded in the business. Effective programs are not a set of minimum requirements—they embrace the business culture. They are simple and practical. They work regardless of the people in different positions. For today’s program that works well, you really can’t tell the compliance program from the business.