The Productive Tension Between Legal and Compliance

It’s a tale as old as time…or, at least since the 90s, when the Federal Sentencing Guidelines for Organizations incentivized companies to build out and formalize compliance as a distinct corporate function. What is the role of compliance vis à vis legal, and when the inevitable sticky situations arise, who has the final say?

In most organizations with which I’ve worked, legal and compliance operate as partners, aligned on most matters and moving together. Tensions that may arise between them aren’t a problem to solve; they’re central to how healthy governance works. Consider the different mandates: Legal protects the company from liability. Compliance reduces risk and ensures legal and ethical operations. Both mandates are legitimate, and both are necessary. So what happens when they point in different directions?

Transparency vs. Exposure

Most often , I see this tension play out in speak-up reports. Ethics and compliance wants employees to trust the concerns-raising process, to believe a report of misconduct will lead somewhere real. To support that, many companies publish aggregate misconduct-reporting statistics on an annual (or more frequent) basis: the number of concerns raised, what categories they fell into, substantiation rates, the anonymous-to-named split, and types of disciplinary or corrective actions taken. This level of transparency turns raising a concern from a black box into a process that employees can see the shape of.

And yet, I routinely hear comments like “my legal team would never go for it,” or “how did you get your general counsel on board?” From legal’s perspective, broadly sharing such data is an exposure risk. Publishing trends on harassment and discrimination complaints, for instance, could weaken the company’s position in a future lawsuit. That’s a legitimate concern. The question ultimately becomes one of risk tolerance: does the benefit to our ethical culture outweigh the legal exposure risk?

How companies share these statistics in a manner acceptable to legal—especially at smaller companies, that lack the anonymity that scale provides—is worth its own article. But the fact that 75% of this year’s World’s Most Ethical Companies® Honorees make this information available to all employees tells us that the two goals can be met at once.

Four More Flashpoints

Speak-up reporting isn’t the only place where these mandates can clash with each other. Other common scenarios we see include:

• Mergers and acquisitions: Compliance flags diligence findings and wants them reflected in the valuation or contract terms. Legal instead builds in representations, warranties, and escrow provisions, protecting against liability after close and preserving recourse if the target misrepresented its compliance posture.
• Vendor selection: Legal can confirm that a contract has strong indemnification, audit rights, and liability caps—standard protections that create accountability and recourse if things go wrong. Compliance’s vendor diligence, however, may uncover weak controls that create operational and reputational exposure that’s hard to remediate after the fact.
• Data privacy: Legal focuses on contractual protection and liability allocation, so that the company can shift or limit risk if something goes wrong. Compliance builds preventive controls and monitoring to ensure the business operates securely in the first place.
• Investigations: Perhaps the trickiest of these scenarios involves an allegation of misconduct against a senior leader. Compliance may want to escalate to the board, whereas legal may want to let the investigation play out until there is more certainty around whether the allegation is credible.

In each case, both positions are valid, and both come from the same underlying goal to protect the company. They just arrive at that goal by different routes.

Org Charts and Independence

Reporting lines are another dynamic that can muddy the waters of how to handle the inevitable tensions. Ethisphere has long held the position that CECO independence is best supported by a direct reporting line to the CEO or board (committee). This is a position backed by the U.S. Department of Health and Human Services, Office of Inspector General’s General Compliance Program Guidance (November 2023), which states “(t)he compliance officer should report either to the CEO with direct and independent access to the board or to the board directly.”

The reality, however, is that most U.S. compliance programs report into legal. And to be fair, in plenty of companies, that structure works quite well and is even preferable. I know many a CECO who says sitting inside the legal department supports a closer collaboration between the two functions and indeed provides the exact type of operational relationship that can best resolve the tensions explored in this article.

What matters more than the org chart is whether the CECO’s relationship with the board is truly independent.

• Does the CECO control what gets shared with the board’s oversight committee, or does the GC have to sign off first?
• Does the CECO present on the program directly, or does the GC deliver it using compliance’s deck?
• Does the CECO hold standing executive sessions without the GC or other members of management in the room?
• Does firing the CECO require board approval under the committee or program charter?

These questions are the real test of independence, not the box on the org chart.

Build the Framework Before You Need It

Conflict and tension don’t have to result in dysfunction. Rather, they can keep organizations, relationships, and groups strong – just ask Priya Parker. The companies that manage this well do it with that most scintillating tool in governance: documented protocol. A framework, developed collaboratively, before anyone needs it, so that when the moment comes, everyone already knows their role. Here are a few examples:

Concerns handling matrix. This guides your triage. Depending on the matter and who is implicated, it outlines who leads the investigation, who supports, and who gets informed. This includes when matters escalate to the board and when to bring in outside counsel (e.g., when a report implicates an executive). Such a protocol is an important safeguard against internal teams finding themselves in the position of having to investigate their bosses or peers. A matrix establishes, in advance, who does what.

Investigation procedures. These set out how ethics and compliance should run an investigation, including when privilege is asserted. For example, how privileged documents get labeled and stored, who receives the final report (typically designated legal counsel), and how to keep a case record without waiving privilege.

Escalation protocols. These name the forum for resolving disagreements. For example, if legal and compliance disagree about onboarding a vendor, perhaps the matter routes to your supply chain committee. This allows multiple stakeholders to consider, discuss, and document the final decision, whatever it may be.

Design for Tension

Every organization depends on a strong compliance-legal partnership. The tension that can arise between them signals that both functions are doing what they’re supposed to do.

To make that tension productive, design your program with that tension in mind. Determine up front how you’ll handle the inevitable moments when risk priorities collide, and create structures that let both functions move without one overriding the other by default.

This way, your compliance and legal teams can each do what they do best, and their combined efforts become a whole greater than the sum of their parts.

Author Bio

Emily Miner  |  Director, Data & Services, Ethisphere

Emily is a Director at Ethisphere in the Data & Services team. Her work includes evaluating client’s ethics and compliance programs, benchmarking against peer practices, providing guidance and implementation support to early-stage programs, and developing compliance and ESG risk assessments.