Many organizations can demonstrate that they have a Code of Conduct, an Anti-Bribery and Corruption Policy, an AML framework, sanctions procedures, and an annual training program. They can report how many employees completed their training, how many third parties were screened, and how many compliance reviews were conducted during the reporting period.
But there is a more important question: Do these activities actually reduce the organization's exposure to compliance risks?
Having policies does not necessarily mean employees understand them. Completing due diligence does not guarantee that business partners are appropriately assessed. Conducting training does not automatically translate into ethical decision-making. And a high number of completed compliance checks does not necessarily indicate that the controls are effective.
Throughout my professional experience in banking, investment services and the energy sector, I have worked on developing, implementing and strengthening compliance frameworks in different business environments. One lesson has remained consistent: building a compliance system is only the first step. Its real value becomes evident when it is integrated into business operations, responds to actual risks and produces measurable results.
An effective compliance program should not simply demonstrate that the organization has fulfilled its formal obligations. It should demonstrate that the organization can identify, prevent, detect and respond to compliance risks.
Are we measuring activity or effectiveness?
One of the most common mistakes in compliance reporting is relying too heavily on activity-based indicators.
For example:
- Number of compliance policies developed or updated.
- Number of employees who attended compliance training.
- Number of third-party due diligence checks completed.
- Number of sanctions and PEP screenings conducted.
- Number of compliance consultations provided.
- Number of compliance assessments performed.
These indicators are useful. They demonstrate the scope of work performed by the compliance function and help management understand its operational workload. However, they do not necessarily tell us whether the program is working.
Consider two organizations. Both report 100% completion of annual compliance training. In the first organization, employees understand how to identify conflicts of interest, recognize potential bribery risks and report concerns. In the second, employees complete training simply to satisfy an internal requirement. Their training completion rates are identical, but the effectiveness of their compliance programs may be very different.
This is why I distinguish between two categories of indicators:
Activity indicators measure what the compliance function does and whether planned activities are completed.
Effectiveness and outcome indicators assess whether those activities produce the intended results, improve controls and reduce exposure to compliance risks.
Both are necessary. The challenge is to avoid treating activity as evidence of effectiveness.
Which five dimensions show whether a compliance program works?
I believe that the effectiveness of a compliance program should be assessed across five interconnected dimensions.
Risk management and control effectiveness
A compliance program should be designed around the organization's actual risk profile, rather than a generic collection of policies and procedures.
A financial institution, an investment company and an energy business may face different risk exposures. Even organizations operating in the same sector can have different risk profiles depending on their geographical presence, counterparties, ownership structures, business models and operational activities.
Therefore, the first question should be whether the compliance framework addresses the risks that are most relevant to the organization.
Useful indicators include:
- Percentage of identified high-risk areas covered by documented and implemented controls.
- Percentage of high-risk business processes subject to periodic compliance reviews.
- Number and severity of control weaknesses identified through testing.
- Percentage of previously identified control deficiencies successfully remediated.
- Time required to address significant compliance control gaps.
- Frequency of compliance risk assessments and updates following material business or regulatory changes.
For example, if an organization identifies sanctions exposure as a significant risk, it should not measure effectiveness only by counting the number of screening checks performed. It should also assess whether relevant counterparties are screened before entering into business relationships, whether ongoing screening is functioning, whether potential matches are appropriately investigated and whether unresolved cases are escalated before transactions proceed.
The same principle applies to anti-bribery controls, conflicts of interest, AML/CFT and other compliance areas.
A control is effective only when it operates as intended and addresses the risk for which it was introduced.
Employee awareness and compliance culture
A compliance program cannot be effective if it exists only within policies and the compliance department.
Employees make decisions every day that can create or mitigate compliance risks. Their understanding of company requirements, willingness to raise concerns and confidence in internal reporting mechanisms are therefore important indicators of effectiveness.
For this reason, training attendance should not be the only measure of compliance awareness.
Organizations should consider:
- Compliance knowledge assessment results before and after training.
- Percentage of employees who can correctly identify and report potential compliance concerns.
- Employee awareness of whistleblowing channels.
- Results of periodic compliance culture surveys.
- Employees' perception of management commitment to ethical conduct.
- Percentage of declared conflicts of interest reviewed and appropriately addressed.
- Timeliness and quality of gifts, hospitality and other mandatory declarations.
An increase in reported concerns should not automatically be interpreted as a deterioration in compliance culture. It may indicate that employees have greater confidence in reporting mechanisms and are more aware of what constitutes misconduct.
The quality of reports, their handling, investigation outcomes and the organization's response should be considered together.
Another important element is management behavior. Employees observe how management responds when commercial objectives conflict with compliance requirements. If business targets consistently take priority over established controls, even the strongest policies will have limited impact.
Third-party and business relationship risk management
In many industries, particularly energy and infrastructure, organizations depend on extensive networks of contractors, suppliers, consultants, intermediaries and joint venture partners. This creates compliance exposure beyond the organization's direct operations.
Third-party due diligence should therefore be measured not only by the number of completed assessments but also by the quality of risk identification and the actions taken in response.
Relevant indicators include:
- Percentage of active third parties risk-rated before the commencement of business or first payment, as applicable.
- Percentage of high-risk third parties subject to enhanced due diligence.
- Percentage of active third parties covered by ongoing sanctions screening.
- Number of red flags identified and the percentage resolved with documented justification.
- Percentage of high-risk relationships subject to periodic reassessment.
- Number of business relationships rejected, suspended or terminated due to unresolved compliance concerns.
- Percentage of identified third-party control deficiencies addressed within agreed timelines.
An important aspect is whether due diligence findings influence actual business decisions.
If a compliance assessment identifies significant ownership concerns, unexplained intermediaries or questionable payment arrangements, the organization should be able to demonstrate how those findings were considered before proceeding with the relationship.
A due diligence process that identifies risks but does not influence procurement, contracting or payment decisions is unlikely to provide meaningful protection.
Compliance monitoring, investigations and remediation
One of the strongest indicators of a functioning compliance program is its ability to identify weaknesses, investigate concerns and prevent similar issues from recurring.
The absence of reported violations does not necessarily mean that an organization has no compliance problems. It may also indicate that monitoring is insufficient or employees are reluctant to raise concerns.
Therefore, organizations should assess both the effectiveness of detection mechanisms and the quality of their response.
I would recommend monitoring:
- Number of compliance incidents and potential violations identified.
- Percentage of reported concerns investigated within established timelines.
- Average time required to complete investigations.
- Percentage of investigations with documented root-cause analysis.
- Percentage of corrective actions completed by their agreed deadlines.
- Number of recurring issues or repeated control failures.
- Percentage of previously identified deficiencies that remain unresolved.
- Number of significant findings escalated to senior management or the governing body.
Root-cause analysis deserves particular attention.
When a compliance incident occurs, the objective should not be limited to identifying the individual responsible. Organizations should also understand why the control failed.
Was there an unclear procedure? Insufficient employee awareness? A lack of segregation of duties? Inadequate management oversight? A weakness in the approval process?
Without understanding the underlying cause, corrective actions may address the immediate incident without preventing recurrence.
An organization should also be able to demonstrate that lessons learned from investigations, monitoring activities and internal reviews are reflected in updated procedures, training and controls.
Governance, accountability and management commitment
Compliance effectiveness cannot be assessed independently of the organization's governance structure.
A compliance function may have comprehensive policies, qualified professionals and appropriate monitoring tools, but its effectiveness will remain limited if it lacks sufficient authority, resources, access to information or management support.
The following indicators can help assess this dimension:
- Percentage of compliance recommendations implemented within agreed deadlines.
- Number of overdue high-priority compliance actions.
- Percentage of significant compliance risks with clearly assigned business owners.
- Frequency of compliance reporting to senior management and the governing body.
- Percentage of business units completing their assigned compliance responsibilities.
- Timeliness of management decisions on escalated compliance matters.
- Adequacy of compliance resources relative to the organization's risk profile.
A particularly important consideration is whether compliance requirements are embedded in business processes.
For example, compliance should be involved at the appropriate stages of procurement, onboarding, contracting, investment decisions and third-party engagement, rather than being approached only after a business decision has already been made.
The objective is not to transfer business responsibilities to the compliance department. Business functions should own and manage the risks arising from their activities, while compliance provides oversight, guidance, challenge and independent monitoring.
How do you move from activity-based reporting to meaningful KPIs?
Once the main dimensions of effectiveness have been identified, the next step is to translate them into measurable indicators.
The following examples illustrate how an organization can move beyond basic activity reporting.
Table 1. From activity indicators to effectiveness indicators
| Compliance area | Traditional indicator | More meaningful effectiveness indicator |
|---|---|---|
| Training | Number of employees trained | Improvement in knowledge assessment results |
| Third-party due diligence | Number of counterparties screened | Percentage of active high-risk counterparties appropriately assessed and monitored |
| Sanctions compliance | Number of screenings performed | Percentage of potential matches resolved before relevant business activity proceeds |
| Whistleblowing | Number of reports received | Timeliness of investigations and implementation of corrective actions |
| Conflicts of interest | Number of declarations collected | Percentage of identified conflicts appropriately mitigated |
| Compliance monitoring | Number of reviews conducted | Percentage of material control deficiencies remediated |
| Policy management | Number of policies approved | Percentage of relevant employees and business processes covered by implemented requirements |
| Governance | Number of reports submitted to management | Percentage of high-priority recommendations acted upon within agreed timelines |
Importantly, organizations should not adopt every available KPI.
The right indicators depend on the organization's size, complexity, industry, geographical footprint and compliance risk exposure.
Each KPI should have a clearly defined calculation methodology, reporting frequency, responsible owner, target and escalation threshold. Otherwise, the same indicator may be interpreted differently by different departments, making comparisons and management decisions unreliable.
How do you build a compliance dashboard that supports decisions?
A compliance dashboard should be designed for management decision-making, not simply to demonstrate the workload of the compliance department.
In my experience, management reporting is most useful when it is concise, risk-focused and action-oriented.
A practical dashboard can be structured around four elements:
- Risk exposure: Current high and critical compliance risks; significant changes in the risk profile; high-risk business relationships and activities.
- Control performance: Results of compliance monitoring and testing; identified control deficiencies; overdue remediation actions.
- Compliance culture and behavior: Training effectiveness; employee awareness and survey results; conflicts of interest and gifts declarations; whistleblowing and investigation trends.
- Management action: Key recommendations requiring management attention; responsible business owners; agreed deadlines; progress against previously approved actions.
Trend analysis is equally important. A dashboard showing the current quarter's results provides only a snapshot. Comparing results over several reporting periods helps management identify recurring weaknesses, emerging risks and areas where controls are improving or deteriorating.
It is also important to distinguish between a genuinely improved control environment and an apparent improvement resulting from incomplete reporting or insufficient monitoring.
For instance, a reduction in reported incidents may be positive, but only if reporting channels remain accessible, employees trust them and monitoring activities continue to operate effectively.
Why test the controls instead of just reporting the numbers?
KPIs provide an indication of performance, but they do not replace independent testing.
A compliance program may report that 100% of required checks have been completed. However, a sample-based review may reveal that assessments were conducted after business relationships commenced, supporting documents were incomplete or identified red flags were closed without sufficient justification.
This is why I consider periodic compliance testing essential.
A practical testing approach can include:
- Reviewing a sample of business transactions: Check whether required compliance approvals were obtained before the relevant activity took place.
- Testing third-party files: Verify whether risk assessments, ownership information, screening results and enhanced due diligence were completed appropriately.
- Testing sanctions controls: Assess whether screening systems and escalation procedures identify and appropriately handle relevant potential matches.
- Reviewing closed cases: Examine whether investigations and due diligence findings were resolved with sufficient evidence and documented reasoning.
- Testing employee declarations: Verify whether gifts, hospitality and conflicts of interest were declared, assessed and addressed in accordance with internal requirements.
- Following up on previous findings: Confirm that corrective actions have been implemented and that the underlying weaknesses have been addressed.
The results should be documented, assigned to responsible owners and reported to management.
Where possible, testing should involve an independent reviewer or a function that was not responsible for performing the original control. This creates a more objective picture of whether the compliance framework operates as designed.
How can technology improve measurement, not just reporting?
Digital transformation can significantly improve the ability of compliance functions to measure effectiveness.
Automated KYC and onboarding solutions, sanctions screening systems, transaction monitoring tools, case management platforms and compliance dashboards can help organizations collect and analyze information more efficiently.
My experience with compliance-driven digital transformation in financial services has shown that technology is most valuable when compliance requirements are incorporated into the design of business processes from the beginning.
For example, automating client onboarding can improve the consistency of KYC information collection, support risk scoring and create a documented approval trail. However, the existence of an automated workflow does not automatically demonstrate that the underlying control is effective.
Organizations should also assess:
- Whether systems capture complete and accurate information.
- Whether risk-based rules are configured appropriately.
- Whether alerts are reviewed and escalated within established timelines.
- Whether access rights and approval workflows are functioning correctly.
- Whether system limitations and exceptions are identified.
- Whether management can obtain reliable compliance data for decision-making.
Technology should strengthen the control environment, not create an additional layer of complexity that employees can bypass.
The same principle applies to emerging technologies, including artificial intelligence. Their use should be supported by appropriate governance, risk assessment and monitoring. The 2024 update of the DOJ's Evaluation of Corporate Compliance Programs explicitly asks how companies assess and manage the risks of new technologies, including artificial intelligence, both in their business and in their compliance programs.
Why is effectiveness not a one-time assessment?
A compliance program should evolve as the organization changes.
New markets, business models, joint ventures, regulatory developments, technological solutions and changes in the geopolitical environment can introduce risks that were not previously considered.
For this reason, measuring compliance effectiveness should be a continuous process rather than an annual reporting exercise.
I would recommend establishing a recurring evaluation cycle:
Quarterly: Review key compliance indicators, significant incidents, monitoring results and outstanding remediation actions.
Annually: Conduct a comprehensive assessment of the compliance program, including its risk coverage, governance, resources, controls and culture.
Following significant changes or incidents: Reassess relevant risks, investigate root causes and determine whether existing controls require modification.
The results should feed into the organization's compliance strategy, risk assessment, annual work plan and resource allocation.
International guidance increasingly reinforces this approach. The US Department of Justice's Evaluation of Corporate Compliance Programs, updated in September 2024, organizes its assessment around three fundamental questions: whether the program is well designed, whether it is adequately resourced and empowered to function effectively, and whether it works in practice.
Similarly, ISO 37301:2021 provides a framework for establishing, evaluating and continually improving a compliance management system. The newer ISO 37302:2025 specifically provides guidance and an indicator framework for evaluating the effectiveness of such systems.
These frameworks reinforce an important principle: compliance effectiveness requires evidence, evaluation and continuous improvement, rather than documentation alone.
Can you prove that your compliance program works?
Ultimately, the effectiveness of a compliance program cannot be demonstrated by the number of policies approved, employees trained or checks completed.
It must be demonstrated through evidence that the organization understands its compliance risks, has implemented appropriate controls, identifies weaknesses, responds to incidents and continuously improves its processes.
I would suggest that every compliance professional ask management five simple questions:
- Do we know our most significant compliance risks, and are our controls designed to address them?
- Can we demonstrate that employees understand and apply our compliance requirements?
- Are compliance controls operating effectively across our business processes and third-party relationships?
- Do we identify weaknesses, investigate their root causes and implement corrective actions?
- Does management use compliance information to make better-informed business decisions?
If an organization can provide evidence-based answers to these questions, it is moving beyond a formal compliance framework towards an effective compliance management system.
The ultimate measure of a successful compliance program is not how much compliance work an organization performs, but how effectively that work protects the organization, supports responsible business decisions and strengthens a sustainable culture of integrity.
