What Makes a Compliance Program Effective in 2026?

Governance authority should be visible, not implied

Our research showed many organizations are facing a “say-do” gap between the positive rhetoric leaders broadcast about compliance and how they embody those concepts in their own behaviors. Employees can sense the gap when leaders encourage ethical behavior but fail to model it, which ultimately undermines trust in the organization’s culture of ethics and the effectiveness of the compliance program. 

While 70% of senior leaders were reported to encourage compliance and ethical behavior, only 55% were seen as modeling that behavior, according to survey respondents. Only 52% of middle management was said to have modeled ethical behavior, and only 50% of first-line managers and supervisors. 

As the eyes and ears for misconduct and risk, workers may be less likely to elevate a concern if they come to believe leaders are holding themselves to a weaker ethical standard than employees. Conversely, when reporters see leaders acting with a high standard of ethics, they grow in their embrace of the compliance program. 

Risk assessments that change decisions 

It is important to note that “risk” is not necessarily a bad thing. When leaders are said to tolerate greater compliance risk in pursuit of business objectives, that may indicate the risk-weighted decision-making of an effective, mature compliance program. Applying the full scrutiny of Compliance to a relatively trivial supplier relationship may rob limited resources from managing a relationship with much greater stakes, for example. 

In this case, effective compliance programs also have leadership engaged in “speaking the same language” of risk in partnership with compliance when considering how to pursue major business objectives. Periodic review and continuous data inputs across all areas of the business operations are key for risk-tailored resource allocation.  

Our survey shows most organizations – 61% – are using risk assessments to review, test and improve the compliance program. The remaining 39% is an opportunity gap.

Policies, training and reporting that work together

To better inform efforts such as ongoing risk-based assessment and strategy, effective compliance programs also have individual elements that work together toward common goals. Policy management, training and reporting reinforce one another when expectations are clear, and reporters know where to go with questions or concerns.  

This approach includes a supportive tone from the top, continually reinforcing the value of the compliance program. Those managing the program should also be able to see how individual elements work together and to establish measures of success that account for each element. For example, ask yourself: 

• Are substantiation rates for reporting improving as policies are made easily available for prospective reporters to better understand what constitutes misconduct?  
• Is training tailored to the misconduct risks an organization faces, and is it possible to assess the impact as training evolves to fit changing needs over time?  

Organizations are said to be at different stages in this journey – for example, 32% of respondents said their firm does not use any metrics to measure policy management effectiveness, while 76% said their organization has an ethics and compliance training plan. 

Metrics to measure how well a program is working can include case closure times, substantiation rates, reporting patterns, report outcomes, enumeration of policy updates and accounting of risk-review follow-through. 

Speak-up channels reporters will actually use 

Effective compliance programs also provide multiple channels through which individuals can make a report. This is important as reporter preferences change over time. As highlighted in the NAVEX 2026 Hotline & Incident Management Benchmark Report, which draws directly from customer internal reporting data, the median organization in 2025 received 60% of reports through a Web channel. This share has increased over the years.  

Still, reporters will not use any channel to report misconduct if they fear retaliation or have little trust that the organization takes misconduct seriously. Once again, this hinges in part on a consistent tone from the top. 

See how your program compares 

The NAVEX 2026 State of Risk & Compliance Report provides a unique lens to help readers understand how the dynamics of their programs and organizations compare to peers – and what defines an effective program today. Join the June 10th webinar, featuring Carrie Penman, Rebecca Walker and Adam Turteltaub as they discuss the findings from this year’s survey benchmark report.