U.S. compliance programs are strong compared to global peers, yet recent NAVEX survey data tells a deeper story.
The data, drawn from the survey behind the NAVEX 2026 State of Risk & Compliance Report, consistently points to a gap between U.S. organizations with zero compliance issues and those with two or more. It isn’t down to elements like investment and perceived program maturity. It comes down to whether compliance is genuinely experienced, whether leaders at every level act in line with what they promote, and whether investment is focused on embedding compliance in practice or just making it visible from the outside.
Strong programs with diverging views of compliance
U.S. compliance programs generally demonstrate strength and maturity, but there’s a clear divide between the organizations that don’t experience compliance issues (those reporting zero issues in the past two years) and those that do (those that disclosed two-or-more issues).
The current regulatory environment illustrates how differently these two groups are operating. Despite federal enforcement priorities shifting and state-level rules diverging, organizations reporting no issues are more so holding course. Twenty-nine percent in that group say they have made no changes at all in response to the regulatory evolution, against just 7% of those with two or more issues – a 22-percentage point difference. This suggests organizations with two or more compliance issues in the past two years might be in a reactive mode. The regulatory environment isn’t creating the gap between these two groups, but it is exposing it.
Leadership: The gap between belief and behavior
The data for compliance outcomes in the U.S. shows a strong relationship between perceptions of senior leadership behavior and risks in the real world. When we compare organizations with zero reported compliance issues to those with two or more, 46% of organizations with two or more issues say their senior leaders have tolerated greater compliance risk in pursuit of business objectives, against 13% in zero-issue organizations: a 33 percentage point gap.
Speak-up culture: when infrastructure isn’t enough
Driven in part by requirements under 2002’s Sarbanes-Oxley Act, organizations in the U.S. have invested seriously in speak-up initiatives. On structural measures like anonymous reporting channels and the promotion of speak-up expectations in training, respondents indicate the country’s organizations are ahead of the global average.
However, as seen in our full report, areas where respondents indicated speak-up challenges inside U.S. organizations with two or more issues are of a different scale. Across all challenges, organizations with two or more compliance issues outpaced those with zero issues anywhere from 13 to 33 percentage points. As we’ve seen in other regions, fear of retaliation (real or perceived) is still the number one issue, meaning this is not a channel problem. It is a trust problem, operating at a scale the speak-up infrastructure cannot address on its own.
AI adoption in compliance is taking a different path in the US
The U.S. uses AI less in compliance than global peers, and in the context of the market’s regulatory environment or their litigation-heavy culture, this may not be as surprising as it initially seems. What is more revealing is where U.S. organizations are directing their AI investment, and what it says about how they are trying to solve a problem that technology alone cannot fix.
Across almost every compliance function, U.S. AI adoption trails the global average. For a country at the forefront of AI development more broadly, this seems counterintuitive.
Final thoughts
Get the reportThe U.S. has largely built strong programs that perform on par with the rest of the world, but what separates American organizations that genuinely embed compliance into decision-making from those that do not comes down to whether people in the organization believe their leaders view compliance as a strategic advantage.
In a moment when the regulatory environment is shifting and the margin for reactive compliance is narrowing, the organizations best positioned are those that have already done the cultural work. For those that haven’t, the opportunity is not necessarily to spend more. It is to ask honestly whether compliance is experienced at every level as something leadership genuinely values.
Download the full State of Risk & Compliance in the US report to explore detailed findings, benchmarks and recommendations for strengthening your compliance program.