6 Minutes - Read Now 
Here’s a number worth sitting with: 52%.
That’s the share of employees in our global data set who, after observing what they believed to be potential misconduct, actually reported it. Roughly half. And for non-managers, the number is even lower.
The compliance professionals I talk to find this frustrating. They’ll tell me their speak-up messaging is constant: it’s in the code, it’s in the retaliation policy, it comes up in every training. They’ve built the infrastructure. So why aren’t the numbers higher?
The answer lies in what the infrastructure can’t tell you. A program assessment can confirm that a reporting hotline exists, that the code addresses retaliation, that managers are trained on investigations. What it can’t measure is whether employees believe any of it will actually make a difference if they use it.
That’s what a culture assessment is designed to find out.
What’s holding employees back
When employees say they witnessed misconduct and didn’t report it, we ask them why. The top two reasons globally: fear of retaliation, and a belief that no corrective action would be taken. For non-managers, that second concern actually ties with the first.
This is the organizational justice problem. Employees who submit reports often hear nothing back. They don’t see anything change. The person they reported is still around weeks later, and they have no idea whether anything happened. Most of the time, something did happen — but organizations aren’t communicating the story, so employees fill in the blank themselves. Usually with nothing.
The challenge is that organizations can’t always disclose specifics about investigations. But there’s more room to communicate than most are using. Among Ethisphere’s World’s Most Ethical Companies honorees, we’re seeing a growing trend: more organizations are sharing aggregate data about their investigations — substantiation rates, categories of reports, ranges of disciplinary outcomes. The goal isn’t case-by-case disclosure. It’s giving employees enough of a window into the process that it stops feeling like a black box.
It works. Employees who understand roughly how the system operates are more likely to trust it and more likely to use it. Regulators have taken note: the DOJ’s updated Evaluation of Corporate Compliance Programs now explicitly asks how companies assess their employees’ willingness to report misconduct. Measuring speak-up culture might have been optional once upon a time, but now, it’s an expectation.
The manager effect
Culture data has also taught us something important about managers that often surprises compliance teams: they are, by a wide margin, the most common reporting channel. When employees say they reported misconduct, more than half identify their manager as the person they went to. Anonymous hotlines and web tools rank much further down the list. Employees want to report to a person, and that person is usually their immediate manager.
This makes the quality of the manager relationship central to everything.
We look at this directly in our survey. We ask employees how frequently their manager has conversations about ethics and compliance topics — frequently (roughly monthly), occasionally (quarterly), rarely, or never. Then we split the data set into cohorts based on those answers and look at how favorable their responses are across key questions.
The differences are significant:
- Comfortable approaching manager with an ethics or compliance question: 98% (frequent conversations) vs. 50% (never)
- Faith in the non-retaliation policy being enforced: 88% vs. 49%
- Belief that concerns will be fully investigated: 91% vs. 51%
Only 35% of employees in our data say their manager has frequent conversations about ethics and compliance. That means most employees are sitting somewhere in the occasionally-to-never range — and the trust gap that creates is visible in every other metric we track.
Culture data identifies this gap clearly. But knowing the gap exists doesn’t tell you why. That’s where a program assessment fills in the picture. When my colleague Jodie’s team looks at what organizations are doing to equip managers — what the training actually covers, what resources exist for those conversations, whether anyone is tracking whether the conversations happen at all — it explains what’s driving the culture data. Having both makes each set of findings more useful.
When the data raises more questions than it answers
Something I tell organizations after every culture survey: some findings will be clear, and some won’t. For the clear ones, you don’t need to wait for anything else to start acting. If speak-up scores are below benchmark and employees are citing fear of retaliation, you know where to focus.
But usually there are three or four areas where the data leaves you wondering. Employees are answering a question in a way that surprises you, and the culture survey alone doesn’t explain it. That’s where a program assessment earns its value; it’s an in-depth, expert review of every programmatic element, and it can answer the “why” questions that culture data surfaces but can’t resolve.
I saw a good example of this around code and policy access. One organization’s overall scores in this area were strong. But when we looked at regional breakdowns, one country was consistently lower. The program assessment context helped explain it: policies weren’t loading in the correct language for employees accessing them through a particular intranet configuration. It was a technical fix, not a program failure. But without the culture data, no one would have looked. And without the program-side review, the cause would have stayed unclear.
If you have culture data but no program assessment
The business case for adding a program assessment comes down to this: it tells you what to do about what you’re finding.
Culture surveys are good at identifying gaps. They’re less able to prescribe solutions, because the solutions are programmatic. When employees report that misconduct isn’t being addressed fairly, or that they don’t trust the investigation process, knowing that is valuable — but it doesn’t tell you which specific program elements to examine. Is it how discipline calibration works? How investigations are communicated? What managers are trained to do when a report comes in?
A program assessment benchmarks your program design against what high-functioning programs actually do and gives you specific, grounded guidance on where to focus. It turns “employees don’t trust the system” into a set of concrete program elements to examine and improve.
Neither assessment replaces the other. A program assessment tells you what the system is designed to do. A culture assessment tells you what employees believe it actually does. You need both to close the distance between them.
And closing that distance is the whole point.
Author Bio
Curtis Leicht | Data Analyst, Ethisphere
Curtis Leicht is the Manager of Culture Services at Ethisphere. He leads a team of Culture Analysts who guide Ethisphere clients through their Ethical Culture Improvement Journey. The Culture Team at Ethisphere specializes in providing bespoke survey and benchmarking solutions to measure and improve ethics culture for organizations around the world. The team also provides insights into global ethics culture trends, through analysis of over 4.5 million survey responses from 300+ organizations around the world. These insights help to drive program maturity and innovation in the Ethics & Compliance space.
