Compliance programs in the services industry need 7 elements

Compliance programs have many moving parts, to address issues from data security to employee training. But each of these parts must be built upon core fundamentals.

“At the center of every well-designed compliance program is a culture of ethics and compliance,” said Grant Thornton National Managing Partner Fred Kohm. “From there, you have key elements, areas, and activities that are all built upon a company’s culture.”

Compliance programs can be seen as a wheel that has culture at the hub, with building blocks, strategies, processes, and topics populating the outer rings. But why start with culture, and how does a professional services firm translate culture into compliance? 

Compliance programs perform essential functions: managing significant risks, maintaining integrity, and building trust. They can prevent or soften the reputational damage of negative news, facilitate the completion of required reporting, and reduce operational and financial risks like employee fraud. 

Show image description -->

Compliance programs are especially important to professional firms because these firms rely on trust and are held accountable to specified requirements. Requirements vary by industry, jurisdiction and firm, but there are some common elements that every compliance program should include.

7 common elements

It’s important to consider past examples as we consider the risks and costs of compliance violations at U.S. organizations. The U.S. Sentencing Commission Guidelines Manual encourages firms to proactively combat fraud and other criminal activity, and the commission recently reviewed the past 30 years of sentencing for violations under Chapter Eight in the manual. The themes of this guidance can be reflected as seven requirements:

1. Establish standards and procedures, and document the culture.
2. Implement oversight by high-level personnel, including the appointment of a compliance officer and committees.
3. Exercise due care in delegating substantial discretionary authority, like checking the backgrounds of compliance personnel.
4. Ensure effective communication with all levels of employees.
5. Take reasonable steps to achieve compliance, which include systems for monitoring, auditing and reporting suspected wrongdoing without fear of reprisal. Have systems and use them. Enable and reward whistleblowing. Know who takes the phone call and what actions they take.  
6. Maintain consistent enforcement of compliance standards, including disciplinary mechanisms. Be fair, reward whistle-blowers, and punish wrongdoers.  
7. Take reasonable steps to respond to and prevent further similar offenses upon detection of a violation. Install a process for turning mistakes into structural change.

Professional firms will want to look at the relevant laws and regulations in their jurisdictions, as well as professional standards and ethical guidelines.

Finally, all firms will want to review enforcement actions that affect them, look at the technology they have in place, ensure their supply chain partners and contractors align with their efforts, and create robust training and communication programs.  

Compliance as a key to government contracts

The Government Accountability Office reported that, in fiscal 2022, the Federal Government awarded $694 billion in contracts — and $279 billion of that was non-defense spending. That outlay does not include state and local spending. For firms looking for a share of that market, compliance can be a worthwhile new business enabler.

At first, the process can be overwhelming. But once you make the initial investment to gain the required expertise, compliance can become much easier. 

Responding, adapting and adjusting 

Customizing your program

Apart from adapting to changes in the larger compliance environment, your compliance program must adapt to your organizational needs. For example, Kohm said, “A publicly traded consulting firm is going to have a compliance program that looks different than a regional, privately held firm. But they should be considering all the same issues. Ultimately, one size does not fit all.  Each firm will focus on specific areas of need.”