United Kingdom Risk & Compliance Statistics

Key findings

Respondents more likely to say UK-based organizations have mature R&C programs

To help determine the state of programs in 2025, NAVEX asked respondents to self-report their risk and compliance (R&C) program maturity based on the Framework for Ethics & Compliance Program Excellence criteria from the Ethics and Compliance Initiative (ECI). This five-point scale begins at the least mature, “Underdeveloped,” and advances in maturity through the stages of “Defining,” “Adapting,” “Managing” and, finally, “Optimizing.” It is worthy of note that there is no “end” to the spectrum – even the most mature programs have room to refine their approach. 

Sixty-three percent of respondents representing organizations based in the U.K. said their R&C program was either Managing or Optimizing – the two most mature designations on the ECI scale. Fifteen percent said it was Defining or Underdeveloped – the two least-mature designations. For Europe as a whole, 60% were said to be in the more mature designations, with 16% in the less mature designations. Globally, 57% of organizations were said to be at a top-two maturity level, and 18% in the lower two.

‘Privacy/cybersecurity breach’ tops compliance issues for UK organizations

Consistent with previous polling, data privacy/cybersecurity breaches remain the top compliance issue respondents said their organizations experienced in the past three years. Still, nuances remain that may help readers better understand how they compare to regional peers.

For organizations in the U.K., 35% of respondents said the organization had experienced no compliance issues in the past three years. This compares to 27% for Europe as a whole, though matches the overall response rate globally. Sixteen percent said their organization faced difficulty meeting obligations around EU regulations, compared to 23% in Europe but, again, level with the global response rate.

Like others, most UK compliance investigation programs are centralized

Globally, most respondents (67%) said their organizations use a centralized approach in their day-to-day compliance investigations program. This was largely consistent with U.K.-based organizations, where 69% of respondents said their organization uses a centralized investigations program. Generally, response rates to this question for the U.K., Europe and globally were very similar.

UK boards show lower engagement in some key areas compared to European peers

It stands to reason that organizations where boards of directors are engaged in Compliance are more effective and resilient in R&C. 

For U.K.-based organizations, 35% of respondents knowledgeable about ethics and compliance said their board of directors has oversight of the compliance program. This compares to 43% in Europe, and 52% globally. Twenty-three percent of respondents representing U.K. organizations said their board has oversight of risk identification and management, compared with 28% for Europe and 33% globally. Fifty-three percent said their board receives periodic reports on compliance matters, compared to 61% for Europe and 64% globally.

Greatest share of compliance programs in the UK are ‘somewhat involved’ in use of AI

As artificial intelligence plays an evolving role across different organizations, the role of Compliance in its implementation is also evolving.  

For U.K.-based organizations, the largest share of respondents (39%) said Compliance was “somewhat involved” in the use of AI. In Europe as a whole, the same share said the same, which was also close to the response rate globally. Respondents said compliance was “not involved” at a rate of 9% for U.K.-based organizations, compared to 10% for Europe and 12% globally. Response rates across the three cohorts were generally similar.

Only 39% of UK organizations are said to have a hotline

A concerningly low level of respondents indicate their organization has an internal whistleblower hotline, a trend we have seen across several of our annual surveys. This is despite the fact that a mechanism for individuals to report misconduct anonymously and/or without fear of retaliation is a core part of any compliance program.  

For organizations based in the U.K., 39% of respondents knowledgeable about ethics and compliance said the organization had a hotline or whistleblower internal reporting channel. This compares to 45% percent in Europe, and 53% globally. 

The lack of indication of a process to detect retaliation is also notable. For U.K. organizations, 27% were said to have a process to detect retaliation. For Europe, this was 28%, and globally, 29%.