Here's the nice thing about compliance: once you clear the hurdle of what the Federal Sentencing Guidelines require, you’re free to do whatever is going to work best for your company to get compliant.
That's obviously a lot of choice, and so it's natural for a conscientious compliance officer to look to benchmarks for your industry, or put out by a vendor, or whatever. And then it's natural to want to implement those things immediately on the assumption that you need all of them too.
If you do, however, all you’re doing is falling into the same “check-the-box” compliance mentality that you’re trying to escape by looking to benchmarks in the first place—the only difference is that you’re adding more boxes to check.
Instead, embrace the freedom (and, you know, terrifying responsibility) of getting to do whatever works best to achieve compliance for your company, and your culture, and your people. Start with benchmarks, sure—there’s obviously great value there—but don’t implement them until you think critically about whether they’ll work for you or not.
Because when you turn a benchmark into a checkmark, you run the risk of doing things that look like compliance, but may be hurting actual compliance at your company.
Here's an example.
You probably do annual compliance training, and you probably want your CEO to do a short little video introducing the training. There is no requirement that your CEO does this, of course, but if you do any benchmarking at all you'll see that this is pretty standard stuff as a tone-at-the-top thing.
But before you go hire a videographer, you should ask yourself one question:
Is your CEO good at being on camera?
Lots of CEOs are good at being on camera, especially those at consumer-facing companies. But it's not every CEO's thing, nor does it need to be. For every ultra-charismatic Richard Branson out there, there’s a talented, empathetic, ethical CEO who loathes media coverage—and turns into a stiff automaton on camera.
If that’s your CEO, don’t make them film this message.
The point of the video message is to show that the CEO genuinely supports compliance. But appearing relaxed and natural and genuine on camera is a weirdly specific skill, and if your CEO doesn't have it, then doing this is likely to backfire.
Put simply, if your CEO looks like they're going through the motions (or worse, reading the message at gunpoint), then you're not going to win over too many employees—and you've put your CEO in an awkward position where they look disingenuous despite really meaning what they're saying. You've tried to do something that commonly indicates tone at the top, but since it doesn't work for your leader, you've ended up doing the opposite.
Instead, think critically: sure, lots of companies might do a video, but that might not work for you. The goal is to show genuine CEO buy-in, and so for you that might mean having your CEO record an audio message, or appear in a town hall meeting, or write a note—whatever will work best for them to convey that their buy-in is genuine.
And the same principle applies to everything else. Use benchmarks as a data point, but remember that they're there to help you make decisions—not to replace your judgment or your knowledge of your company's culture and people. Do what works for you.