Corporate Compliance’s Eighth Element: Culture
Reprinted with permission. Copyright © 2025 by Society of Corporate Compliance and Ethics (SCCE) & Health Care Compliance Association (HCCA).
For decades, the gold standard for evaluating corporate compliance programs has been the seven elements framework, outlined by the U.S. Sentencing Commission.1 The commission’s seven elements — policies and procedures, leadership and oversight, training and education, effective communication, enforcement and discipline, auditing and monitoring, and response and prevention — have become foundational in shaping program design that aligns with regulatory expectations. The commission defines these elements as critical for organizations to demonstrate their commitment to compliance and mitigate the risk of potential misconduct.
However, in a world in which policy violations often stem not from poor policies and procedures themselves but from misaligned behaviors and decision-making, we are posing the question: Are these seven elements enough to ensure your compliance program works in practice?
Enter culture, the eighth element
While the seven elements provide essential components that make up a strong compliance program from a structural viewpoint, they focus heavily on the what, stopping short of addressing how these elements should be brought to life. If organizations use the seven elements as their only compass, they’re missing a significant piece of the equation: organizational culture as a vital part of compliance program effectiveness.
Culture cannot be an afterthought. Evaluating the effectiveness of your compliance program without considering culture is like inspecting a building without checking its foundation: it may appear sturdy until pressure reveals the cracks.
The U.S. Department of Justice (DOJ), however, does not make the same omission. In its Evaluation of Corporate Compliance Programs guidance,2 DOJ emphasizes the importance of corporate culture as an imperative benchmark of compliance effectiveness, specifically citing leadership commitment, middle management messaging, and employee perception of the compliance function. It challenges organizations to evaluate whether their culture supports compliance in practice — not just on paper. However, while this guidance raises some of the right questions, it doesn’t — and can’t — define how to truly shift behavior in your organization.
What is culture and why does it matter?
Even the most well-designed compliance programs may fail if the culture doesn’t promote ethics and compliance. A company can have meticulously drafted policies and procedures, a state-of-the-art compliance hotline, and a robust training curriculum. However, if the culture prompts employees to view compliance as an obstacle to success, unethical behavior is seen as tolerated for certain employees or leaders, and/or there is fear of retaliation when reporting misconduct, it may suggest that the compliance program only exists on paper — not in reality.
In short, culture shapes behavior. It guides employees’ decision-making, both in clear, black-and-white situations and in the ambiguous “grey areas” of compliance — where ethical decision-making is particularly important. Culture defines which behaviors are reinforced and celebrated within an organization, the behaviors that are tolerated, and those that are not acceptable. A strong compliance culture also equips organizations to anticipate and adapt to emerging risks, such as those posed by cybersecurity threats and the rapid adoption of artificial intelligence. Without aligning organizational culture to support your compliance program, you’re left managing risk reactively, rather than cultivating ethical decision-making proactively.
Five tips for strengthening your culture of compliance
Building and sustaining a culture of compliance requires more than just messaging and cannot be achieved overnight. It requires ongoing, intentional work across every level of the organization. Key elements of a culture of compliance include:
Ensure leaders set the tone:
Tone at the top is critical for an organization’s culture of compliance. The actions, attitudes, and priorities of senior leaders directly influence how compliance is perceived from all levels.
Help middle managers carry the message:
Managers are the primary influencers shaping employees’ everyday experiences. They must feel equipped to model ethical behavior, reinforce its significance, and help employees navigate challenges.
Create open dialogue and psychological safety:
While it’s imperative to cultivate a speak-up culture in which employees are encouraged to report issues anonymously, it’s equally important to create an environment that enables open dialogue. Employees should feel comfortable asking questions and challenging decisions without fear of retaliation.
Integrate into broader business management:
Compliance should be hardwired into all aspects of the business, including hiring practices, incentive programs, performance expectations, professional development, and internal communications. Compliance should clearly connect to organizational purpose, values, and strategy, and not be siloed.
Establish a steady drumbeat of communication:
Make sure your messaging is relevant and inspires a shared sense of purpose and integrity — and delivered in creative, engaging ways. Use storytelling to illustrate real-life scenarios Article that resonate with employees so they can apply their knowledge of compliance to their own situations.
Assessing and strengthening compliance culture
Culture is the enabler of your compliance program. To begin evaluating your organization’s culture of compliance, start by asking yourself the following questions:
- Are employees empowered to speak up, and do they?
- How often does leadership discuss ethics and compliance, and what prompts them to do so?
- Are mid-level managers modeling ethical behavior?
- Is your compliance function seen as a partner or a barrier?
- How are you measuring the effectiveness of your compliance program today? Is it providing meaningful insight?
These questions can give you a head start in thinking about current strengths and opportunity areas for your program in advance of more formalized methods of measurement, such as a dedicated compliance culture survey.
Conclusion
As enforcement agencies increasingly scrutinize not just what companies say about compliance but what they do and how they behave, culture must be treated as a distinct component. By recognizing culture as the eighth element, organizations can close the gap between compliance on paper and compliance in practice. Not only does it elevate the other seven elements — it makes them real.
Related Expertise
Related Insight
References
1. USSG § 8B2.1 (U.S. Sentencing Comm’n 2018).
2. U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs, updated September 2024, https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
FTI Consulting, Inc., including its subsidiaries and affiliates, is a consulting firm and is not a certified public accounting firm or a law firm. FTI Consulting is an independent global business advisory firm dedicated to helping organizations manage change, mitigate risk and resolve disputes: financial, legal, operational, political and regulatory, reputational and transactional. FTI Consulting professionals, located in all major business centers throughout the world, work closely with clients to anticipate, illuminate and overcome complex business challenges and opportunities. ©2025 FTI Consulting, Inc.
All rights reserved. fticonsulting.com
