NAVEX Global recently released an important compliance report – 2019 Definitive Corporate Compliance Benchmarking Report (HERE).  NAVEX’s report contains a number of interesting findings and brings together several current compliance trends and themes.  In contrast to focused benchmarking reports, NAVEX’s new report provides a more holistic view of compliance programs. 

NAVEX’s new approach reflects the trend of consolidating compliance functions and responsibilities.  As this trend continues, and with the increase in automation and other technology solutions, compliance professionals are rapidly demanding a single compliance dashboard that captures ongoing compliance activities built on monitoring capabilities.

NAVEX’s report confirms that effective ethics and compliance programs are established through strong leadership buy-in and support, and use of technology to automate program management.  Some other common traits of comprehensive compliance programs include adequate funding and staffing; risk-based priorities; agile policy and procedure management; high quality, risk-based training; a reliable internal reporting and case management system; a comprehensive approach to third party risk management; and continuous improvement.  Another important finding was that creating and sustaining an ethical workplace culture was a key objective for effective ethics and compliance programs. 

Automation was a critical part of effective ethics and compliance program.  Companies that deployed automated compliance management solutions reported that they were able to advance program objectives more effectively than companies which did not rely on automated solutions.  Companies reported that compliance staff that used automated solutions were able to operate more efficiently and concentrate additional time and resources on new and emerging risks.

As expected, leadership buy-in to an ethics and compliance program has a significant impact on the success of a compliance program.  Organizations with strong executive support achieve greater success.

Companies are focused on four major risks – harassment, data privacy/security, bribery/corruption and conflicts of interest.  To address these risks, companies are relying on training, policies and other controls.  A significant number of companies reported that current strategies may not be sufficient to mitigate risks.

As to compliance budgets, the NAVEX report noted that 74 percent of respondents expected their budget to remain the same in the next year.  Only one out of four respondents expected a budget increase of at least ten percent over the next year.

The size of compliance departments depended on program maturity and size of the company.  For example, almost half of the reporting compliance departments with 6000 or more employees employ at least 11 full-time equivalents.

A significant percentage of compliance departments reported that their primary activities were training, policy management, and support of senior officers and managers in carrying out their responsibilities.

The NAVEX report includes an interesting discussion of measurement of compliance program data.  Companies collect data from employees (surveys and subjective perceptions) and combine such data with objective data.  Compliance professionals primarily rely on subjective data to track the company’s culture. 

NAVEX also noted that only 41 percent of reporting companies track whistleblower complaints, substantiation rates, and retaliation. This is a surprising result since such data provides an important indication of the company’s culture and the existence of a speak up culture.  In addition, only 71 percent of responding companies reported that they maintained an anonymous reporting system. Finally, half of all reporting organizations stated that their training programs reduced legal liability and increased the number of employees who report concerns,  Nearly half noted that such training improves employee trust of leadership and overall employee morale