Every so often, corporate governance debates that we thought were settled come roaring back. The reporting line for the chief compliance officer is one of them. For years, the trend line pointed in the right direction — more companies elevating the CCO to report directly to the CEO, with independent access to the board. Lately, I am seeing troubling signs of backsliding, with companies quietly tucking the compliance function back under the general counsel. This is a mistake, and boards should recognize it as such.

Let’s go back to first principles. Where the CCO reports is not an org-chart technicality. It is the single clearest signal a company sends — to regulators, to employees, and to itself — about what compliance means inside the organization.

Structure Is Strategy

A CCO who reports to the CEO sits at the leadership table. He or she hears business strategy as it is being formed, not after decisions are made. Compliance considerations get built into new market entries, acquisitions, product launches, and third-party relationships at the design stage — where risk mitigation is cheap — rather than bolted on afterward, where it is expensive and often ineffective.

A CCO buried two or three layers down in the legal department hears about the deal when the documents arrive for review. By then, the strategic choices have been made, and compliance is reduced to a cleanup function. That is not a compliance program; that is a compliance afterthought.

Independence Is Not Optional

The empowerment question also matters when things go wrong. When serious allegations surface — particularly allegations touching senior management — the CCO must have the independence to investigate, escalate, and if necessary deliver unwelcome news to the board without fear for his or her position. A direct reporting line to the CEO, paired with a dotted-line relationship to the audit committee, provides exactly that protection. The dotted line guarantees the CCO unfiltered access to the board: regular executive sessions, direct escalation authority, and a channel that no member of management can block.

Regulators understand this. Prosecutors evaluating a compliance program’s effectiveness ask pointed questions about the CCO’s stature, autonomy, resources, and access to the board. A company that cannot demonstrate genuine CCO empowerment starts the conversation at a disadvantage — and no policy manual can paper over a reporting structure that tells a different story.

The Message Employees Actually Hear

Employees are astute observers of organizational signals. When the CCO stands shoulder to shoulder with the CFO and the general counsel as a direct report to the CEO, employees understand that ethics and compliance are core to how the company does business. When the compliance function is a subsidiary office within legal, employees draw the opposite conclusion — that compliance is a technical specialty, someone else’s job, a box to be checked. Culture follows structure. It always has.

Compliance Action Items

– Review your CCO reporting structure and assess honestly whether it reflects empowerment or subordination.

– Establish a direct CCO reporting line to the CEO, with membership or standing participation in the senior leadership team.

– Create a formal dotted-line relationship to the audit committee, including regularly scheduled executive sessions without management present.

– Document the CCO’s escalation authority, budget autonomy, and protection from retaliation in the compliance charter.

– Benchmark the CCO’s stature, compensation, and resources against peer executives — regulators certainly will.

The companies that get this right treat their CCO as a strategic partner in building sustainable, ethical growth. The companies that get it wrong will eventually explain their org chart to a prosecutor. In my next post, I take on the other side of this coin — why the drift back to legal-department reporting reflects a dangerous “mere compliance” mindset that shortchanges the business itself.