Conduct leaves traces in the records
Culture is usually measured by asking people how they feel. That matters, but it is half the picture. The other half sits in the systems, and it is often more candid.
Overrides show where rules bend
How often are credit holds released, approval limits exceeded or purchase orders raised after the invoice arrives? Who does it, and is it recorded? An override rate concentrated in one region or under one manager says more about tone than a survey answer can.
Report outcomes reveal real trust
We trace each speak-up report from intake to closure: how long triage took, who investigated, whether the reporter heard back and whether anything changed. A channel that receives reports but never closes them with a finding teaches employees not to use it.
Leaders face the same tests
Senior leaders' expenses, related-party payments and approvals of their own transactions are tested with the same rules as everyone else's. The article on related-party transactions explains what a sound approval route looks like.
Federal prosecutors use a public checklist
The Department of Justice's Evaluation of Corporate Compliance Programs asks whether a program is well designed, whether it is applied in good faith with adequate resources and authority, and whether it works in practice. Its September 2024 version added questions on how companies manage risks from AI and how they use data in compliance. A company that never expects a prosecutor's call can still use those questions as a test. Our compliance program evaluation applies them at a scale that suits a mid-size company.
Boards need fewer, better pages
Oversight is only as good as what the board reads. We review the board pack, committee charters, the delegation-of-authority matrix and the minutes together, because a weakness in one usually shows up in another. A charter that gives the audit committee oversight of related-party transactions does little if the minutes never record one being reviewed.
Assessments should fit the company
A 150-person company does not need a compliance department modeled on a bank's. We scale every assessment to the company's size, sector and risk, and say plainly where a lighter process is enough. A two-page conflicts procedure with a named reviewer can do more than a 30-page policy that nobody owns.
Findings stop short of legal conclusions
An assessment says what the evidence shows: a policy nobody follows, a related-party payment nobody approved, a report that sat untouched for five months. It does not decide whether a law was broken. Where a finding could carry legal consequences, we tell the person you named at scoping and recommend that counsel take it from there. That boundary keeps the assessment useful to your lawyers rather than in their way, and it reflects the fact that Finance Ethics does not give legal advice.