2025 Global Risk & Compliance Statistics

Key findings & top takeaways from our global compliance survey

Does compliance have enough influence on corporate AI policies?

Our survey data suggests organizations are roughly divided into thirds regarding Compliance’s engagement with artificial intelligence decision making:  

• 33% of respondents say compliance is a “very involved” group 
• 32% are “somewhat involved”  
• A remaining third is either “minimally,” “not involved” or “not sure” (35%)

While the opportunities arising from AI are monumental, these technologies also introduce a new range of risks. Compliance needs a seat at the table for AI decision making within organizations, along with Risk and other disciplines, to navigate those risks that may include ethical use of AI and compliance with emerging regulations.

Centralized whistleblowing investigation programs are most common – and used within the most mature organizations

67%of respondents overall said their organization had a centralized program for day-to-day compliance investigations, with only 23% saying they had a decentralized approach. Respondents who said their organization had a more mature R&C program (i.e., a program that is considered managing/optimizing) were far more likely (73%) than those with less mature programs (55%) to say they have a centralized approach.

Compliance functioning closely with Risk

Ten years from now, where will Compliance sit in the organization? Is it possible that Compliance will be incorporated under a Risk leader? 

70% of global compliance survey respondents said their compliance function was “highly engaged” in risk assessment and management. Taken with those who said that Compliance was “moderately engaged,” a full 93% said Compliance was at least engaged to some degree in the risk assessment and management process.

Only two thirds of boards receive periodic compliance reports

Only 64% respondents who are knowledgeable about ethics and compliance say their boards of directors receive periodic reports on compliance matters. This number rises a bit for the largest organizations – respondents from organizations with 10,000 or more employees said the same at a rate of 71%. Only about half (52%) of respondents who are knowledgeable about ethics and compliance said the board of directors has oversight of the compliance program.

We would have hoped to see more respondents indicating their boards receive periodic reports on compliance matters, and for the level of engagement and expertise of boards regarding compliance to improve. This is a critical area where boards have an opportunity to understand how the organization is navigating a complex risk landscape that continues to evolve amid global regulatory shifts.

Some leaders encourage employees to act unethically

It is encouraging to see most respondents flagging “positive” behaviors among different levels of leadership. For senior executives, for example, 73% of respondents who are knowledgeable about ethics and compliance were said to “have encouraged compliance and ethics” within the organization.

Negative behaviors fall off sharply in the distribution – but they do not reach zero. Roughly 10% say leaders across all levels have encouraged employees to act unethically to achieve a business objective. Specifically, 9% say senior executives and middle managers have acted in this way, while 11% report the behavior from first-line managers and supervisors. This reality – or even the impression that this may be true – could be an extremely detrimental signal in supporting a culture of ethics and compliance, and a signal of risk to organizations.

Are organizations doing enough to identify and manage third-party risk?

A majority of respondents who are knowledgeable about ethics and compliance said their organization was embracing two elements of screening third parties (regulatory compliance, 58%; cybersecurity and data protection, 54%), with all others failing to reach a majority. These included financial health and stability (49%), human rights (33%) and litigation history (30%).

It is true that not all third parties require the same level of scrutiny, yet some of these areas struck us as surprisingly uncommon in our respondent base. Financial health, for example, can be a leading indicator for a range of other potential risks by suggesting a level of resourcing to achieve elements like cyber resilience. This could serve as a reminder for organizations to take an intentional approach in the specific screening criteria for third parties.

Only half of respondents surveyed have an internal whistleblower hotline

As with previous years’ response cohorts, respondents in 2025 were surprisingly unlikely to say their organization has a hotline or whistleblower internal reporting channel as part of their organization’s incident management program. Only 53% of respondents – just more than half – said they have an internal whistleblower hotline or reporting channel. 

This was less true for larger organizations (69% for those whose company has 10K+ employees vs. 43% with 0-999 and 54% with 1,000-9,999) and organizations based in North America (59% vs. 45% of whose companies are headquartered in Europe), but levels still remained far below what might be expected for this foundational program element. Similarly, fewer than half (49%) of respondents said their organization had a non-retaliation policy. As in years past, we find these numbers to be unexpected given the critical importance of internal reporting programs.

Purpose-built risk and compliance software emerges as most common approach for ethics and compliance

Most organizations use purpose-built risk and compliance software to administer the various aspects of their ethics and compliance programs. This suggests organizations are finding value in such technologies that, in many cases, facilitate easier holistic management of compliance program processes “under one pane of glass.” When one program aspect can connect with another, as is often the case with such technology, new opportunities emerge for Compliance to serve as a strategic asset to the business.

Respondents who are knowledgeable about ethics and compliance were most likely to say they used purpose-built technology for ethics and compliance training (78%), yet other ethics and compliance program elements, such as policy management, also showed strong majority responses (between 59%-73%).