Policy Governance · 20 min read
Compliance Program: The Seven Elements and How to Build One at a Growing Company
A compliance program is the system a company uses to follow the laws, regulations, standards and contracts that apply to it: written policies, a person responsible for them, training, a way to raise concerns, consequences, regular checks, and a way to fix problems when they turn up. For a company of 50 to 500 people, the challenge isn’t knowing what the elements are, because every guide lists the same seven, but running all of them with no compliance department and producing proof that they work.
This guide walks through the seven elements of an effective compliance program as regulators actually describe them, shows the minimum version of each that a growing company can realistically run, and lays out a phased plan to build one. It sits inside our wider guide to policy governance, which covers how the policies themselves are written, owned, approved and kept current.
Key takeaways
- A compliance program is more than a binder of policies, because regulators judge it on whether it is designed for your risks, given real resources and working in practice.
- The seven elements come from HHS-OIG guidance and closely track the US Sentencing Guidelines, so the same structure works well outside health care too.
- A company without a compliance officer can run every element by naming one compliance lead, giving policies to department owners and keeping the scale proportionate to its risks.
- The records that each element leaves behind, such as approvals, acknowledgments, reviews and fixes, are what prove the program works when someone asks.
What is a compliance program?
A compliance program is everything a company does, on purpose and in writing, to prevent breaking the rules that apply to it, to notice when it does, and to put things right afterwards. The rules can be laws and regulations, such as employment law, privacy law or health care billing rules, but they can just as easily be standards you’ve chosen, such as ISO 9001 or SOC 2, or obligations you’ve signed up to in customer contracts.
The word “program” matters, because it separates a working system from a set of documents. A company with a well-written code of conduct that nobody has read, no one in charge of it and no record of any review has policies, but it doesn’t have a compliance program in any sense a regulator, an auditor or a court would recognize.
For most private companies a compliance program is voluntary, and the reasons to have one are practical: fewer violations, faster detection, better answers for auditors and customers, and, if something does go wrong, credit for having tried in good faith. For some organizations it is mandatory. Nursing facilities and Medicare Advantage organizations must keep one under federal rules, and our page on the HHS-OIG compliance program guidance sets out what health care entities are expected to write down and keep. Federal contractors on larger contracts must also keep a written code of business ethics and an internal control system under the Federal Acquisition Regulation.
Sources: oig.hhs.gov, General Compliance Program Guidance (November 2023), acquisition.gov, FAR 52.203-13
Why a compliance program matters for a growing company
At a dozen people, compliance mostly lives in the founder’s head, and that works because the founder sees everything. Somewhere between 50 and 500 people that stops being true, as work spreads across teams, locations and managers who joined last quarter, and federal employment law adds new obligations at 50 and 100 employees on top of whatever your industry already demands.
The outside pressure grows at the same time. Larger customers send security questionnaires and supplier codes of conduct, certification bodies come back every year for surveillance audits, insurers ask how you manage risk, and in regulated industries surveyors and examiners want to see the program, not just hear about it. Each of them asks a version of the same question, which is whether you can show that your rules exist, reached the right people and are actually followed.
There is also a legal reason. The US Sentencing Guidelines reduce an organization’s culpability if it had an effective compliance and ethics program when an offense happened, and the Justice Department weighs the quality of a company’s program when it decides whether to charge and how to resolve a case. Very few growing companies expect to be in that position, but the same standard shapes what auditors and regulators consider good practice.
Sources: ussc.gov, Guidelines Manual §8B2.1 and §8C2.5(f) (2024), justice.gov, Evaluation of Corporate Compliance Programs (updated September 2024)
The seven elements of an effective compliance program
Almost every guide to compliance programs lists the same seven elements, because they come from the HHS Office of Inspector General’s compliance guidance and closely follow the minimum requirements in the US Sentencing Guidelines. The Guidelines apply to every kind of organization, which is why compliance teams in manufacturing, technology and financial services use the same structure as hospitals do.
| Element | The minimum at 50 to 500 people | The evidence it leaves |
|---|---|---|
| 1. Written policies and procedures | A code of conduct and the policies your risks call for, each with an owner, an approval and a review date | Approved versions, review history, acknowledgments by name and version |
| 2. Compliance leadership and oversight | One named compliance lead with time set aside, reporting to the CEO, and a small committee of department heads | Appointment memo, committee notes, reports to leadership or the board |
| 3. Training and education | Compliance training at onboarding and once a year, with extra sessions for high-risk roles | A training plan and completion records for each person |
| 4. Open lines of communication | A published way to raise concerns that doesn’t depend on your manager, and a written no-retaliation rule | The policy, proof staff received it, and a log of reports and answers |
| 5. Enforcing standards | Written consequences that apply the same way to everyone, and recognition for doing the right thing | The disciplinary policy and consistent records of how cases ended |
| 6. Risk assessment, auditing and monitoring | A yearly risk review and a short audit plan aimed at your top risks | The risk review, audit results and follow-up actions |
| 7. Responding and fixing | A written way to look into problems, fix causes and update the policy that should have prevented them | Investigation notes, corrective steps, and the new policy version sent out and acknowledged |
Sources: oig.hhs.gov, General Compliance Program Guidance, Section III (November 2023), ussc.gov, Guidelines Manual §8B2.1(b) and (c) (2024)
1. Written policies and procedures
Everything else in the program rests on written standards, starting with a code of conduct that states what the company expects of everyone, and continuing with policies and procedures for the areas where you carry real risk, such as data protection, workplace safety, anti-harassment, conflicts of interest, financial controls or the specific rules of your industry. HHS-OIG recommends reviewing policies at least once a year, and it treats policy maintenance as part of this element, not an afterthought.
At a growing company the practical problems are rarely about writing the first version. They are about knowing which version is current, who approved it, who it applies to, whether those people have read it and when it is next due for review, which is the territory of a good policy on policies and a named owner for each policy.
2. Compliance leadership and oversight
Someone has to be in charge. The Sentencing Guidelines ask for three layers: a governing authority, such as the board or the owners, that understands the program and oversees it, a senior person with overall responsibility, and specific individuals with day-to-day responsibility who have enough resources, real authority and direct access to the top.
For a company without a compliance department, that usually means the CEO holds overall responsibility, one senior person in HR, operations or finance becomes the compliance lead with protected time for the role, and department heads meet every quarter or so as a small compliance committee. HHS-OIG suggests that small entities that can’t support a compliance officer designate a compliance contact who reports to the owner or CEO at least quarterly, and that is a sensible floor for any company of this size.
3. Training and education
People need to know what the policies say and how they apply to their own jobs, so the program needs compliance training when someone joins, a refresher at least once a year, and extra sessions for roles that carry more risk, such as managers, finance staff or anyone who handles sensitive data. Training is usually delivered through an HR platform, a learning tool, an outside provider or plain live sessions, and what matters for the program is a plan that says who gets what and a record that shows they completed it.
Training and policy acknowledgment are related but different. Training shows someone was taught, while an acknowledgment shows they received and confirmed a specific version of a specific policy, and auditors often ask for both.
4. Open lines of communication
Problems surface faster when people know how to raise them and trust that they won’t be punished for doing so. This element covers both directions: the company communicating its standards to staff in a way they can actually take in, and staff having a route to report concerns or ask questions, including at least one route that doesn’t pass through their own manager, with a written promise of no retaliation.
The Sentencing Guidelines talk about communicating standards “periodically and in a practical manner,” and that is where most growing companies fall short. Emailing a policy to everyone is communication in name only if you can’t say who opened it, which is why an acknowledgment record by name and version is the practical proof that a policy reached the people it covers.
5. Enforcing standards: consequences and incentives
A policy with no consequences tends to become a suggestion, so the program needs written disciplinary standards that apply in the same way to everyone, from a new hire to a senior executive, along with some positive recognition for people who raise concerns or handle a difficult situation well. Consistency is what regulators look for here, because a rule enforced against junior staff and waived for top performers tells everyone what really matters.
6. Risk assessment, auditing and monitoring
The Sentencing Guidelines expect an organization to assess its risks periodically and shape the rest of the program around what it finds, which keeps a growing company from spending its limited compliance time on low-risk areas. Once a year, list the laws, standards and contracts you answer to, rank where a failure would be most likely or most damaging, and write a short audit plan that checks your top few risks during the year.
Monitoring also includes checking the program itself, such as whether policies were reviewed on time, whether everyone in scope acknowledged the current versions, and whether training was completed, because a gap there is usually the first sign that a program is drifting.
7. Responding to problems and fixing them
When something goes wrong, the program should have a written way to look into it, decide what happened, fix the immediate problem and then fix the cause, which often means changing a policy or a procedure. The Sentencing Guidelines specifically mention making any necessary changes to the program itself after misconduct is found.
That last step is where the paperwork usually breaks down. A corrected policy only helps if the new version is approved, reaches the people it covers and is acknowledged by them, and if the record shows the old and new wording side by side so anyone reviewing the fix can see exactly what changed.
What makes a compliance program effective, not just present
The Justice Department’s guidance for prosecutors boils effectiveness down to three questions, and they work just as well as a self-test for a company with no legal trouble at all: is the program well designed, is it applied in good faith with enough resources and authority, and does it work in practice.
Source: justice.gov, Evaluation of Corporate Compliance Programs (updated September 2024)
The third question is the one that catches growing companies out, because a well-written program that isn’t followed looks, from the outside, exactly like one that doesn’t exist. When I’ve been through SOC 2, ISO 27001 and more than ten ISO 9001 audits, the auditors spent far less time on whether a policy was well written than on whether we could show it was approved, current, reviewed on schedule and acknowledged by the people it applied to.
How to size a compliance program to your company and your risks
The good news for a mid-sized company is that the standards expect proportion. The Sentencing Guidelines say plainly that a small organization may meet the requirements with less formality and fewer resources than a large one, as long as it shows the same commitment, and they give examples: leaders managing the compliance effort directly, training through informal staff meetings, using existing staff rather than hiring a separate team, and modeling the program on well-regarded programs at similar organizations.
Source: ussc.gov, Guidelines Manual §8B2.1, Application Note 2(C) (2024)
Three things should decide how big your program is. The first is your industry, because a behavioral health provider, an investment adviser or a defense supplier carries specific regulatory obligations that a marketing agency doesn’t. The second is who checks you, such as a regulator, an accreditor, a certification body or large customers, because each of them will expect to see particular records. The third is your history, since a company that has already had a problem in one area is expected to put more effort there.
A 60-person software company selling to larger customers might run its program around a code of conduct, information security policies, HR policies and the evidence its SOC 2 auditor wants, while a 300-person manufacturer adds safety programs, quality procedures and supplier requirements. Both use the same seven elements, but the weight sits in different places.
Who runs a compliance program without a compliance officer
Most companies between 50 and 500 people don’t have a full-time compliance officer, and many never will, which is fine as long as the work is clearly assigned. The pattern that works is a single accountable lead, policies owned by the people closest to the risk, and a regular report upwards.
The most common failure at this size is giving the compliance lead the title without the time, so the role becomes an extra job that gets done the week before an audit. The second is letting one person own every policy, which turns them into a bottleneck and leaves the policies out of step with how each department really works, which is why we treat the policy owner as a role in its own right. When the work outgrows your team, an outside consultant can help with the risk review, the first set of policies or a specific standard, and Policy and Compliance, our sister site, lists consultants by standard and industry.
How to build a compliance program in four phases
For a company of 50 to 500 people, a realistic first version of the program takes three to six months, and the order of work matters more than the speed. Starting with a stack of policy templates, before you know your risks or who will own each policy, is the most common way to end up with documents that look complete and don’t fit the business.
Phase 1: decide who and what. Name the compliance lead and agree, in writing, how much of their time the role takes and who they report to. Then list everything you answer to, including laws by headcount and industry, standards you hold or want, and obligations in your biggest customer contracts, and rank the risks so the rest of the work starts in the right place.
Phase 2: write and approve. Write or update the code of conduct and the policies your top risks need, and before you write the rest, agree a policy on policies that sets the format, the approval path, the review cycle and the owner for each policy. Policies that touch legal risk, such as conflicts of interest or records retention, are worth a review by outside counsel, who can sit in the approval workflow as an approver.
Phase 3: roll out and prove it. Send each approved policy to the people it covers, collect an acknowledgment from each of them, run the first round of training, and publish how people can raise concerns. Keep the records as you go rather than reconstructing them later, because this first round becomes your baseline.
Phase 4: check, fix and repeat. From then on the program runs on a yearly rhythm: review each policy on its review date, run a yearly policy attestation so everyone reconfirms the policies that matter most, audit your top risks, fix what you find, and report to leadership on what happened and what changes next year.
The evidence that proves your compliance program works
When an auditor, a regulator, a certification body or a large customer looks at your program, they rarely read every policy. They pick a few and ask who approved them, when they were last reviewed, who they apply to, whether those people acknowledged the current version, and what happened the last time something went wrong. A program that produces those answers as a side effect of normal work survives that conversation easily, and one that relies on someone rebuilding the record from email does not.
Earlier in my career I delivered services to one of the largest healthcare companies in the world, and none of our people could start work until they had signed that client’s policies and we could show proof of it. That experience is a good picture of where every compliance program ends up, because sooner or later someone outside the company asks you to show, not tell.
Where AllyMatter fits in a compliance program
We built AllyMatter for the policy side of a compliance program, which is the part that touches every element and produces most of the evidence. It runs written policies and procedures from draft to approval, sends each approved policy to the people its tags cover, records each acknowledgment by name and version, keeps every version with a word-by-word comparison, puts a review alert on each policy when its review date arrives, and keeps an audit trail you can filter by date or person and export as a PDF or CSV.
The other parts of the program, such as training courses, a reporting hotline, investigations and the risk assessment itself, are usually run with tools and people built for those jobs, and the policies, acknowledgments and records in AllyMatter sit alongside them. You can bring whatever standard you answer to, whether that is HHS-OIG guidance, SOC 2, ISO 9001, HIPAA or your own code of conduct, and run all of it in one place.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.
Common compliance program mistakes at growing companies
Buying policies before knowing the risks. Template packs fill a folder quickly, but a policy that doesn’t match how your company works is worse than no policy, because it creates a written standard you are visibly not meeting.
A compliance lead with no time. Naming someone without changing their workload produces a program that only moves before audits, which is exactly the pattern regulators describe as a paper program.
Treating a sent email as communication. An announcement tells you that a policy was sent, while an acknowledgment by name and version tells you it was received, and only the second one counts as evidence.
Reviews that never happen. Policies quietly go stale as laws, systems and teams change, and an out-of-date policy in front of an auditor is often the first finding of the visit.
Fixing the problem but not the policy. After an incident, teams fix the immediate issue and move on, leaving the policy that should have prevented it unchanged and the same failure ready to happen again.
Questions about compliance programs
What is a compliance program?
A compliance program is the set of written policies, people, training, reporting channels, checks and responses a company uses to follow the laws, regulations, standards and contracts that apply to it, and to find and fix problems when they happen.
What are the seven elements of an effective compliance program?
The seven elements, in the form HHS-OIG uses, are written policies and procedures, compliance leadership and oversight, training and education, effective lines of communication, enforcing standards through consequences and incentives, risk assessment with auditing and monitoring, and responding to detected problems with corrective action. The US Sentencing Guidelines set out a very similar list of minimum requirements.
Does a small or mid-sized company need a compliance program?
Every company has legal obligations, so every company needs some version of one, but the size of it should match your size and your risks. The Sentencing Guidelines say a small organization can meet the standard with less formality and fewer resources, using the people it already has, as long as its commitment is just as real.
Who should run a compliance program at a company without a compliance officer?
Name one compliance lead, usually someone senior in HR, operations or finance, give them protected time and direct access to the CEO, and have department heads own the policies in their own areas. HHS-OIG suggests that small entities designate a compliance contact who reports to the owner or CEO at least quarterly.
How long does it take to build a compliance program?
For a company of 50 to 500 people, a first working version usually takes three to six months: about a month to name the lead and rank the risks, two months to write and approve the core policies, and a few more to roll them out, train people and collect acknowledgments. After that it runs on a yearly cycle of review, audit and repair.
How do you show a compliance program is effective?
With records of what actually happened, not just the policies. The Justice Department asks whether a program is well designed, adequately resourced and working in practice, and the practical answer is evidence such as approval history, acknowledgments by name and version, review dates kept, training completion, audit results and the fixes that followed.
Is compliance software required for a compliance program?
No law requires software, and a small program can run on documents and spreadsheets. Software starts to pay for itself when chasing approvals, acknowledgments and review dates by hand becomes a regular job, or when an auditor, a regulator or a customer asks for proof you can’t produce quickly.
A compliance program is judged on what it can prove, and for a company of 50 to 500 people the proof has to come from ordinary work rather than from a scramble the week before someone asks. Get the seven elements in place at the size that fits you, give them an owner and a yearly rhythm, and keep the records as you go, starting with the policies that every other element depends on.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.