Talk is cheap, especially when it comes to ethics and compliance programs. Words are easy but action and commitment are even harder. The compliance industry needs to put more meat on the bones of compliance. It is not enough to rely on subjective standards for determining whether an ethics and compliance program is effective.

Compliance professionals need to design meaningful measurements and standards for ethics and compliance programs. These are not ironclad standards that have to be met, but they are factual inquiries that can guide the analysis and the conclusion of overall effectiveness.

Whether you want to label them as requirements, guides, or ratings, the goal is to minimize or eliminate subjective standards that prevent meaningful comparison of compliance programs. Of course, in the design of any set of standards, a bit of caution is needed – standards without validity are nothing but false indicators.

The elements of an effective ethics and compliance program are fairly well established, deriving from the US Sentencing Guidelines, compliance profession training and experience, and organizational management principles.

In the drive to measure and audit compliance programs, some important principles can be overlooked. I am wary of those compliance businesses that develop their own “power ratings” or measurements of compliance success. In many cases, they rely on analyses contrary to statistical principles, such as population distribution and deviations.

Industry comparisons can be important. Benchmarking across industries usually has little relevance. I am concerned that benchmarking is really a means by which CCOs reduce their own anxiety about their company’s compliance program.

Most important, however, is a historical record of measurement within a company. Even then, such historical records of measurement have to be discounted for significant events – acquisitions of large companies or business transformation. Nonetheless, internal measurement and comparison over time can be very helpful.

From a practical standpoint, a company can get a pretty good picture of a country’s performance by looking at data relating to complaints, investigations, productivity or financial performance, turnover rates, enforcement actions (if any), and employee culture surveys. Compliance officers should not just collect these statistics for fun; they should use them as valuable indicators and red flags for increased attention.

Unfortunately, the compliance profession has embraced the number of complaints, the number of people trained, and the number of certifications as indicators of a compliance program’s “effectiveness.” I hate to burst everyone’s bubble, but this is setting the compliance bar too low. By doing so, the compliance profession is setting itself up to fail in the minds of senior management and the board.

The question is not how many people have attended training. The real question is how many people understand the training material and have embraced the message as part of the company’s culture.

We all know that the number of complaints received on a hotline is meaningless and can be interpreted any way you want – if more complaints come in, the CCO can say that the company’s Speak Up culture has improved. If fewer complaints come in, the CCO can argue that the company is responding to concerns and reducing the amount of concerns and improving morale. In the end, the CCO is touting the measurement as a positive indicator.

So long as CCOs, senior management and the board embrace these phony measurements, they are drinking the kool-aid of effectiveness that will certainly be shattered when the company violates the law and the government initiates an investigation and prosecution of the company and individuals.