The Compliance Program Self-Assessment

Are you looking to assess your E&C program’s overall effectiveness when it comes to things like structure, oversight, monitoring, training, and more?

Introducing the 2024 Compliance Program Self-Assessment by Ethisphere. Built from our industry-leading Ethics Quotient® (EQ) questionnaire and benchmarking from this year’s list of World’s Most Ethical Companies® honorees, this 20-question program assessment provides compliance leaders a unique glimpse into the overall effectiveness of their work to date, for free and within minutes!

Simply answer questions about different aspects of your program and organization and receive an overall program score, list of strengths and opportunities for improvement, plus analysis and additional resources from the industry’s leading experts and largest benchmarking dataset.

The demands for a program’s continued evolution and proactive efforts to improve are no longer reserved for the largest organizations in the most risk-heavy industries, they’re table stakes across the board in today’s day and age. Complete the 2024 Compliance Program Self-Assessment today to plot a course for your program’s improvement!

Begin Compliance Program Self-Assessment

Self-Assessment Instructions & General Information

This self-assessment is made up of 20 questions, broken out into 8 dimensions related to your program. It will take approximately 15-20 minutes to complete and will require a working knowledge of the company’s programs and initiatives in the areas of ethics and compliance and corporate governance.

Please read each dimension description, question text, and response sets carefully before responding. Unless specified otherwise, when considering possible responses, select the answer choice(s) that best reflect the general state of your company’s program. This page does not save responses until after full submission, so please be sure that you are able to complete it in one sitting. Once the self-assessment is submitted, you will receive your results via email using the address provided in your responses.

Corporate Governance

This section examines the availability and quality of systems designed to ensure strong corporate governance including oversight, governance principles, and risk management. When evaluating an organization's corporate governance, organization-specific factors such as ownership structure are taken into consideration.

Please note that any reference to "other governing authority" throughout this questionnaire applies ONLY to organizations that do not have a Board. Also, for purposes of this questionnaire, the term "director(s)" refers to Board member(s) or to member(s) of your organization's governing authority, if different than a Board.

1. In the past two years, has your organization provided the Board or other governing authority with standalone training on ethics and compliance risks relevant to the organization's business?*Yes, we have conducted sessions (separate from program updates) specifically to train the Board or other governing authority on individual ethics and compliance risk topics.No, we do not provide standalone training but rely on education provided during ethics and compliance program updates.Please complete this field

2. Which of the following functions would be part of onboarding or orientation for a new director (or other partnership/owners/members for a non-Board governing authority)?*Ethics and compliance (to discuss either their role relating to the oversight of our ethics and compliance program and/or ethics and compliance risks relevant to our organization)Legal (separate from a session on the ethics and compliance program)FinanceIT/Information securityRisk managementHuman resourcesNone of the abovePlease complete this field

Program Structure, Oversight, Responsibility, and Resources

This section examines overall program structure and how responsibility for compliance oversight is assigned to high-level personnel. The regulators have signaled, and we agree, that the organizational chart sends a message about organization priorities. Do those running the ethics and compliance program have a “seat at the table”? Examination is also conducted on how resources and authority have been allocated to those individuals. In short, is the program appropriately staffed for the size and complexity of the business?

Second, we review if members of the organization's governing authority are actively engaged in the ethics and compliance program, whether they are knowledgeable about its content and operations, and whether they exercise reasonable oversight of that program.

If your organization has separated the ethics and compliance program from the regulatory compliance program (the function that focuses on the interpreting and applying the laws relevant to an organization's business), unless specified, please answer the following questions on behalf of your ethics and compliance program or function.

1. How often does the ethics and compliance function conduct scheduled update presentations regarding the implementation and effectiveness of the ethics and compliance program to the Board, committee of the Board, or other governing authority that oversees the ethics and compliance program?*Regularly scheduled, not less than quarterlyRegularly scheduled, three times per yearRegularly scheduled, twice per yearRegularly scheduled, annuallyAd hoc only, as neededNeverPlease complete this field

2. Over the last twelve months, what information was included in scheduled update presentations regarding the ethics and compliance program to the full Board, the committee of the Board, or the other governing authority that oversees the ethics and compliance function?*Hotline and misconductDetails on ALL misconduct investigations and resolutionsDetails on SOME misconduct investigations and resolutionsEthics and compliance training initiativesEthics and compliance program audit resultsEthics and compliance program assessment or benchmarking findingsEthics and compliance risk assessment findingsEthics and compliance risk mitigation strategy and tacticsPrivacy risk assessment and resultsCulture of ethics assessment or survey findingsEthics and compliance trends, industry trends, and best practices updatesCode of Conduct updates or revisionsNeeded resources to achieve program objectives (often reflected in a review of the budget for the ethics and compliance program's annual activities)Please complete this field

3. Select the types of interactions the ethics and compliance function has with other functional groups in your organization.*Invited/allowed to provide input regarding audit design and receive audit resultsInvited/allowed to attend human resources training events to educate on ethics and compliance topicsInvited/allowed to add ethics and/or compliance questions to employee surveysInvited/allowed to provide input on environmental, social, and governance (ESG) reporting and assessmentInvited/allowed to provide input regarding technology solutions that support the ethics and compliance programInvited/allowed time in sales/marketing meetings (excluding ethics or compliance training) to educate on the relevance of the ethics and compliance program as a competitive advantageInvited/allowed to provide formal input on overall corporate business strategyInvited/asked to sit on a steering committeeInvolved in hiring decisions regarding positions of authority which may affect ethics and compliance functions (e.g., audit, finance, human resources)Significant input/role in the process for organizational strategic business development decisions such as mergers and acquisitions, new market entry, expansion, business partnerships/alliances, and joint venturesSignificant input/role in specific product or services decisions such as product or services development, launch, or discontinuationSignificant input/role coordinating with relevant business functions (e.g., procurement) to ensure ethics and compliance risks/interests are included in the process of product/supplier sourcingPlease complete this field

Written Standards

This section evaluates the written standards created to provide guidance to employees on how to conduct business with integrity. Well-written, comprehensive, and well-communicated policies, procedures, and controls play a critical role in preventing and detecting misconduct. Written standards should be literally accessible, meaning that an employee can find the documents, as well as linguistically accessible, meaning the employee can understand the documents.

1. Does your organization have a policy on policies?*Yes, and it applies to ALL corporate policiesYes, and it applies only to certain policiesNo, we do not have a policy on policiesPlease complete this field

2. What guidance does your policy on policies provide to policy drafters?*A standard template (layout) that policies must followA suggested writing style with target reading levelA suggested writing style with a targeted passive or active voice percentageGuidance for appropriately cross-referencing other relevant policies, procedures, or controlsGuidance about consulting with affected business units during the drafting and approval processGuidance about consulting with subject matter experts during the drafting and approval processGuidelines about when policies must be reviewed and updatedRevision historyOwnership of Policy (Minimum: title and department of policy owner)None of the aboveNot applicable, we do not have a policy on policiesPlease complete this field

Ethics & Compliance Training, Awareness, and Communication

This category assesses the extent to which an organization takes steps to periodically educate employees on its standards, procedures, and other aspects of its ethics and compliance program through training and other communications

1. Outside of an ethics and compliance training curriculum or plan, does your organization use any of the following methods to assign ethics and compliance training during the course of the year?*We assign training in response to misconduct trendsWhen acquiring a new business, we assign training until the acquired entity can be integrated into our ethics and compliance program's regular training cycleWe assign training at a manager or business unit leader's requestWe maintain a library of courses that employees can elect to take on demandNone of the abovePlease complete this field

2. Select the following ethics and compliance communication resources, if any, that your organization provides to people managers in order to help them promote ethics and compliance within the organization.*Ethics and compliance communication toolkit(s) (e.g., language to include in an email, links to ethics and compliance newsletters to distribute to employees, responses to questions that may arise, FEQs for current issues or initiatives), available on demand or distributed to people managers directlyMeetings-in-a-box - these are turn-key materials to incorporate into meetings or conversations on ethics and compliance topics (e.g., suggestions of topics to discuss, speaking guides, presentation materials, videos to watch and discuss)A schedule of potential topics to discuss throughout the year and guidance on expected frequencyCommunications regarding ethics and compliance topics for the people manager to cascade through his or her organizationRegularly scheduled discussion time with ethics and compliance personnel (e.g., brown bag lunches, seminars, or ethics and compliance team road shows)Tools and resources to allow people managers to recognize or incentivize direct reports that exhibit ethical conduct or promote the ethics and compliance programVideos, online vignettes, or other educational multimedia resourcesResearch, whitepapers, or curated news reports on ethics and compliance issues specifically directed at people managersNone of the abovePlease complete this field

3. Does your organization require people managers to have discussions with their direct reports regarding specific ethics and compliance topics at least once throughout the year?*Please complete this field

Detection, Monitoring, and Auditing

This category focuses on how an organization identifies its key risks and determines how to allocate resources. This includes whether the organization conducts periodic evaluations of the effectiveness of its ethics and compliance program.

Ethisphere also evaluates whether the organization employs auditing and monitoring systems designed to prevent and detect misconduct. Among other things, Ethisphere looks at whether the organization operates a whistleblower system, providing employees mechanisms by which they can anonymously report misconduct and seek guidance on issues or questions.

1. Indicate the resources or tools available for reporting misconduct and raising concerns at your organization.*Documented open-door policy for in-person reporting to direct supervisorsDocumented open-door policy for in-person reporting to senior/executive managementThird-party-maintained hotline with the option to remain anonymous where allowed by local lawIn-house hotlineOmbudspersonWeb-based reporting toolOrganization-wide reporting email accountApp or mobile-specific reporting tool or platformMailing addressLabor union or works counsel (or equivalent) grievance procedureNone of the abovePlease complete this field

2. Separate from reports to the Board or other governing authority, does your organization communicate how many ethics concerns were reported, the types of concerns reported, and the results of reports and investigations?*Yes, we make this information available to the public as a standalone reportYes, we make this information available to the public in our ESG/Sustainability report and/or in our annual report, or equivalentYes, we circulate this information to C-suite-level leaders beyond those involved in Board reportingYes, we circulate this information to other levels of managementYes, we share this data in an employee training course or coursesNo, we do not communicate this informationPlease complete this field

3. If your organization conducts evaluations of the effectiveness of the entire ethics and compliance program using internal resources, how often does your organization conduct evaluations of the effectiveness of the ethics and compliance program?*Please complete this field

Enforcement, Discipline, and Incentives

This topic assesses how organizations incentivize ethical behavior, handle reports of misconduct, track investigations, support investigators, and protect those who report misconduct.

1. Which of the following are part of your organization's process for gathering feedback from individuals who participated in an investigation after the investigation is closed?*We conduct follow-up conversations with known reportersWe conduct follow-up conversations with witnessesWe conduct survey-based follow-up with known reporters to ask about their experience with our investigators and investigation experienceWe conduct survey-based follow-up with witnesses to ask about their experience with our investigators and investigation experienceWe do not follow up with known reporters or witnessesPlease complete this field

2. Is your organization currently conducting root cause analysis to assign root cause(s) to incidents of misconduct?*Yes, on all investigations, regardless of how the issue was raised or the investigatorYes, on all investigations of a certain level of significance regardless of how the issue was raised or the investigator, but not on all investigations (e.g., only substantiated matters)Yes, but only on those investigations handled by the ethics and compliance functionYes, for investigations handled by some functions, but not all functions who conduct investigations (e.g., audit and ethics and compliance, but not human resources)No, we are not consistently conducting root cause analysis after investigationsPlease complete this field

Measurement of Ethical Culture

This topic examines methods and outcomes associated with measuring the organization's culture of ethics, along with who monitors that information.

1. Which of the following methods, if any, are part of your organization's approach to measure employee perceptions of ethical culture and/or the ethics and compliance program?*Employee survey(s) that includes questions specific to the ethical culture of your organizationEmployee focus groups (either in-person or using virtual gatherings on Zoom, etc.)Employee interviews (non-people managers) to assess ethical culture and employee perceptionsManagement interviews to assess ethical culture and employee perceptionsSurveys of external stakeholders, such as clients, customers, vendors, or partners, that include questions specific to the ethical culture of your organizationVisits by ethics and compliance personnel to sites outside of headquartersReviewing social media (e.g., Twitter, Facebook) or other websites that include feedback or comments about the organization (e.g., Glassdoor.com)Monitoring a real-time, direct-to-employee feedback system or tool (e.g., Salesforce Feedback app, Yammer comments, intranet site comments) that allows for comments, suggestions, or inputNone of the abovePlease complete this field

2. How have your efforts to measure ethical culture and the perception of the compliance program been utilized within your organization in the last two years?*Paired with data from other control functions to help identify patterns or “hotspots”Factored into risk assessments of functions, geographies, and/or business unitsPrompted creation of new communications, trainings, or other initiatives for the entire organizationPrompted creation of new communications, trainings, or other initiatives specifically targeted at low-performing functions, geographies, and/or business unitsInform roadmap of ethics and compliance program investment and improvementSome other way not listed aboveNone of the abovePlease complete this field

Third Party Demographics

This topic focuses on evaluating the selection and performance of value chain partners.

1. What information does your organization consider in due diligence of third parties?*Ownership information (e.g., registration information, beneficial ownership)Information on relationships with current and former public officials or political parties, including relationships of close family membersInformation on related organizationsRisk assessment practicesUse of subcontractors on work to be done for the organizationThird-party risk management practicesEthics and compliance policy documentationTraining program for the third party’s employeesReporting requirement and mechanismExistence of ethics and compliance functionPast misconduct (e.g., serial litigation, civil, criminal and regulatory issues, labor issues/problems, etc.)Sanctions and embargo listsGeneral reputationNone of the abovePlease complete this field

2. Which of the following best describes the methods your organization uses to communicate with its third parties about compliance requirements?*Internet portalEmailLive or synchronous communications from organizational control functions like procurement or ethics and complianceLive or synchronous communications from the business people responsible for the third-party relationshipAnnual vendor/supplier meetingNone of the abovePlease complete this field

3. What ongoing training or other awareness raising resources does your organization make available to third parties to help them build their own ethics and compliance practices?*We provide ethics and compliance communication resources to third parties for their adoption and useWe provide ethics and compliance e-learning coursesWe provide live or synchronous trainingWe provide “train the trainer” assistance to our third partiesWe provide ethics and compliance “how to” resources on specific topics (e.g., how to perform third party due diligence or how to set up a training program)We provide information on how to use our reporting lineNone of the abovePlease complete this field

Contact Information

Please provide additional information about yourself and your organization to help Ethisphere continue to benchmark companies within your space and deliver your Compliance Program Self-Assessment results.

Company name*Please complete this field

Headquarter country*Please complete this field

Number of employees*Please complete this field

Which of these best reflects your job role?*Please complete this field

First name*Please complete this field

Last name*Please complete this field

Job title*Please complete this field

Email*Please complete this field

Step 1 of 5

You have submitted this form already!