Compliance Program Design and Monitoring
This domain tests whether you can design a compliance program that is proportionate to the organization's risk and prove it works - the difference between a program that exists on paper and one a regulator or prosecutor would credit.
Design anchors
- US Sentencing Guidelines §8B2.1: standards and procedures, knowledgeable high-level oversight, no one with known misconduct in a position of authority, effective training, monitoring and auditing, incentives and discipline, and a response that prevents recurrence after detection.
- DOJ Evaluation of Corporate Compliance Programs (updated 2024) asks three questions: is the program well designed; is it applied earnestly and in good faith, with adequate resourcing and empowerment; does it work in practice?
- ISO 37301 frames compliance as a plan-do-check-act management system with leadership, planning, support, operation, performance evaluation, and improvement.
Design sequence
Risk assessment of obligations and activities, then a policy hierarchy (code, policy, standard, procedure), roles and governance, training and communication, third-party due diligence, speak-up and investigations, monitoring and testing, and finally incentives, discipline, and continuous improvement.
Monitoring, testing, auditing
Monitoring is ongoing and embedded in the first or second line: dashboards, approvals, quality review. Testing is periodic and sample-based, performed by the second line. Audit is independent, third-line assurance. A monitoring plan is risk-based: high-risk obligations receive more frequent coverage, defined sample sizes, named testers, and reporting to a committee with issues tracked to closure.
Worked example
Building an annual monitoring plan: rank obligations by inherent risk and open issues; assign quarterly testing to the top quintile (anti-bribery payments, sanctions screening, privacy notices); semi-annual to the middle band; annual to the remainder. Each test carries an owner, a written procedure, a sample size, and a result template recording Pass, Fail, or Partial plus a remediation field. Results roll into a quarterly dashboard showing open issues by age and severity.
Traps that cost marks
- Using training-completion rates as a proxy for culture or effectiveness.
- Copying another organization's program without a risk assessment.
- Monitoring only what is easy to measure.
- Leaving third-party intermediaries uncovered, the exact gap enforcement agencies look for.