This article was first published on GIR on 8 September 2026; for further in-depth analysis, please visit the GIR - The Guide to Compliance; Edition 5.

Introduction

Over time, scrutiny of compliance programmes has shifted from their design – including how companies structure their governance, policies and procedures – to programmes’ operating effectiveness, including their ability to surface emerging risks, diagnose control breakdowns and embed changes based on lessons learned. Companies facing regulatory investigations know this all too well. In resolution discussions, prosecutors critically examine whether corporate controls did enough and whether they can be trusted to prevent future misconduct.

It takes time and effort to assemble the building blocks of an effective programme, but the real test is how prepared you are to demonstrate how your programme has evolved over time in response to changes to your business and lessons learned from monitoring, auditing and investigations. In the end, neither a “paper” programme nor a stagnant one is likely to withstand scrutiny under third-party or regulatory pressure, whether in the context of M&A diligence, an audit or a regulatory investigation or inquiry.

In this vein, prosecutors at the United States Department of Justice will distil their evaluation of a company’s corporate compliance programme into one final question: whether it “works in practice”.^[1] Recognising that no one can reasonably expect a compliance programme to prevent all misconduct, this assessment largely centres on how the company proactively evaluates programme effectiveness and how it reacts when something goes wrong.

Whether in response to a regulatory investigation or M&A diligence, these two facets – proactively evaluating programme effectiveness and diagnosing and correcting issues in a timely manner – form the bedrock of effective monitoring and auditing activities and are critical elements of managing risk and demonstrating to third parties that your programme works.

Frameworks and regulatory guidance

Several resources outline leading practices for corporate compliance programmes, including publications from global regulators that describe their expectations and the questions their prosecutors are likely to ask during criminal investigations. Similarly, international bodies such as the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Organisation for Economic Co-operation and Development (OECD) and the International Organization for Standardization (ISO) have published frameworks outlining best practices with respect to corporate compliance.

• The US Department of Justice states in its “Evaluation of Corporate Compliance Programs” guidance that an organisation’s “capacity to improve and evolve” based on lessons learned is a hallmark of an effective compliance programme.^[2]
• The United States Sentencing Commission, in defining the elements of an effective corporate compliance programme for purposes of calculating the culpability score, states that organisations should periodically assess risks across their organisation and “take reasonable steps to respond appropriately … to prevent further similar criminal conduct, including making any necessary modifications” to the organisation’s programme.^[3]
• The US Department of Health and Human Services’ Office of Inspector General (OIG) lists “risk assessments, auditing, and monitoring” among its seven elements of an effective compliance programme.^[4] A March 2026 Corporate Integrity Agreement^[5] – often referenced as a benchmark for OIG’s compliance programme expectations – requires the entity to “develop work plans for reviewing, monitoring, and auditing compliance risks”.
• In guidance on The Bribery Act 2010, the UK Ministry of Justice explains that companies’ risk profiles change over time and that companies should therefore “monitor and evaluate the effectiveness of their bribery prevention procedures and adapt them where necessary”.^[6]
• The National Financial Prosecutor's Office and the French Anti-Corruption Agency describe in their Judicial Agreement in the Public Interest the expectation that companies pursuing deferred prosecution agreements maintain “regularly updated” risk-mapping documents designed to identify, analyse and prioritise risks.^[7]
• The COSO guidance on compliance risk management embeds the concept of auditing and monitoring throughout several sections, noting that compliance programmes should be prepared to “proactively address new or changing compliance risks”.^[8]
• The OECD states in its Good Practice Guidance that an organisation’s compliance programme should be “regularly monitored, re-assessed, and adapted as necessary to ensure the continued effectiveness of the company’s internal controls, ethics, and compliance programme or measures”.^[9]
• ISO 37301 (Compliance management systems) requires continual improvement, including corrective actions in response to nonconformities identified through monitoring and audits.

Thus, compliance programme evolution is a common theme across all the authoritative sources. Whether and how a programme evolves depends, in part, on the quality of information and insights feeding it, including how companies digest and distil findings from risk assessments, monitoring and audits.

In the context of a regulatory inquiry or investigation, the compliance programme is only as good as you can prove it is. So, a prosecutor, auditor or board will judge a company’s ability to describe and then illustrate with real-world artefacts the feedback loop through which the company continually refines its programme when deciding whether the programme can be trusted to deter and detect future misconduct. In this context, monitoring and auditing functions often provide the clearest and most compelling evidence and are therefore critical components of an effective compliance programme.

Monitoring versus auditing: distinct but complementary

Monitoring and auditing share similar objectives but play different roles within the organisation. Monitoring typically refers to preparing real-time analyses aimed at spotting patterns or trends within data that warrant further inquiry, while audits represent formal retrospective analyses of processes and controls. Put another way, monitoring often represents a “second-line” function responsible for supporting management and first-line control owners whereas internal audit represents a “third-line” function responsible for providing independent assurance over the adequacy and effectiveness of the company’s risk management processes.^[10] Although both endeavour to surface opportunities for the organisation to strengthen key programme elements, they differ in terms of their degree of independence, the cadence of their activities and the scope and uses of their work.

Companies typically embed monitoring functions in operational workflows and closely connect the monitoring function to real-time business processes. A monitoring function uses organisational data to surveil controls, surface threshold alerts, generate exception reporting and analyse compliance trends, among other activities. Some organisations centralise monitoring activities within a dedicated group while others maintain monitoring activities independently across various functional areas. Because monitoring activities exist and occur alongside normal business activities, they enable organisations to respond promptly to (and, in many cases, prevent) various forms of misconduct, including improper payments and transactions.

Audit functions perform structured, independent assessments designed to evaluate whether processes and controls are functioning as designed in applicable policies and procedures. Auditors carry out this function through a variety of activities, including interviews, process walkthroughs, document review and sample-based testing. Because auditors are responsible for providing assurance that processes and controls adequately mitigate risk, they must remain independent of the underlying process or function under examination. And, because audits are retrospective in nature, they are not necessarily designed to prevent violations in real time and instead aim to identify improvement opportunities that can further mitigate future risk.

Although different, monitoring and auditing functions should work in concert to support an organisation’s broader efforts to manage risks. Auditors should be aware of and periodically evaluate the effectiveness of monitoring procedures and monitoring groups should refine their procedures based on audit findings. At many organisations, internal audit plans are informed, among other sources, by findings from the company’s ongoing monitoring procedures that surface new or emerging risks.

In discussions with regulators, companies should be prepared to explain the design and make-up of the two groups, including their resourcing, autonomy, empowerment and any changes the company has made to its programme in response to their findings.

Deciding where to focus your monitoring and auditing resources

Regulators recognise that compliance programmes are not one-size-fits-all and companies should design programmes that make sense based on their size, industry and risk landscape. Effective monitoring and audit plans consider the likelihood and impact of various risks to the business, taking into account the reliability of existing controls.

A risk assessment is typically the first step in designing an effective compliance programme. That assessment should identify the company’s inherent risks based on its industry, locations, route to market, counterparties and regulatory requirements; assess their severity; and compare them to existing policies, procedures and controls. Where gaps exist, including in new or emerging risk areas not yet governed by a policy or control, the company may consider assigning compliance resources to better understand, manage and monitor residual risks. The efforts might include deploying new compliance-monitoring activities (such as data analytics to identify and study outliers within an operational data set) or allocating additional internal audits to a business process or area that carries heightened risk.

Many monitoring and audit groups establish annual plans that define their focus areas and activities for the coming year. Because monitoring activities occur in real time and are forward-looking, they are often nimbler and more dynamic, allowing organisations to refine them throughout the year in response to observations and emerging risks. Audit plans, on the other hand, are often formally approved by a company’s audit committee or board and, although subject to revision, are generally less flexible than ongoing monitoring activities.

In any event, the annual planning process should consider changes to the company’s business model and risk landscape, along with findings from past monitoring, audits and internal investigations to ensure the organisation’s procedures are timely and relevant.

Access to relevant data sources

In addition to aligning monitoring and auditing activities with the organisation’s most pressing risks, companies should ensure that relevant groups have access to relevant organisational data. In guidance to its prosecutors, the DOJ asks whether compliance personnel have sufficient access to data for purposes of timely and relevant testing of policies, controls and transactions. Where possible, giving monitoring and auditing functions direct access to relevant data sets enables more complete and reliable analyses while reinforcing their empowerment and autonomy within the organisation.

Beyond understanding where relevant data resides and how it flows through the company’s systems, personnel in monitoring and auditing roles should also maintain a strong grasp of the company’s business model, commercial profile and route to market. Without it, they risk misinterpreting false positives in monitoring results or publishing audit findings that lack context and face resistance from business stakeholders.

The specific data sources relevant to monitoring and auditing personnel depend on the nature and scope of their activities. Enterprise-resource planning (ERP) systems, which house transaction-level accounting data that companies use to prepare financial statements, are almost always relevant. Other relevant systems may include procurement and expense-management systems that house important financial and operational data; customer- and supplier-relationship management systems that manage commercial and counterparty data; and other industry-specific systems such as trading platforms (in the commodities and securities industries), electronic medical records systems (in the healthcare industry) or project-management systems (in the construction industry).

This is also an area where prosecutors and third parties will dig. Companies should be prepared to answer questions about the accuracy and completeness of data underlying their monitoring and audit procedures, including how data was sourced, cleansed and reconciled. This is particularly important when monitoring and auditing personnel lack direct system access. For example, consider a monitoring tool designed to flag purchase orders above US$50,000 associated with transportation vendors based in countries outside the United States. If the tool’s logic relies upon manually created data from inconsistently populated free-text fields and the monitoring team is unaware of and has not reviewed the underlying data, the tool’s effectiveness and credibility could be damaged in the eyes of a third party. Organisations with fragmented ERP systems, manual data sources or inconsistent reporting formats may create similar challenges that monitoring and auditing personnel should resolve before commencing substantive analyses.

A deeper dive on monitoring

Monitoring activities can be carried out by operational management and business units within the company’s first line of defence or by oversight functions such as risk and compliance that exist within the organisation’s second line. Unlike periodic audit procedures, companies embed monitoring activities within business processes and use operational and compliance data to identify anomalies, surface emerging risks and enable timely intervention. Effective monitoring often focuses on identifying patterns and behaviours indicative of control circumvention rather than reviewing transactions in isolation.

Companies must be able to describe how monitoring occurs in practice, including how the monitoring function designs, calibrates and tests rules and how it reviews, triages and addresses outputs. The logic underlying monitoring rules should be risk-based and periodically recalibrated to ensure it remains relevant to the company’s business operations, systems and risks. Failure to do so could result in rules that either fail to identify meaningful risks or overwhelm monitoring personnel with false positives that drain resources.

Many companies effectively deploy compliance monitoring for third-party payments. In this context, analytics-based monitoring procedures can be particularly helpful in flagging anomalous transactions that warrant further scrutiny, including mismatched payment details, round-value payments, duplicate payments, payments without underlying purchase orders and payments just below value-based approval thresholds, among other red flags. Many companies also monitor the recording and approval of journal entries to spot risk factors such as weekend entries, postings to seldom-used accounts or adjustments recorded directly to the general ledger.

Identifying an exception or anomaly through monitoring is often just the starting point and should not be the end goal. The effectiveness of a company’s monitoring function depends not only on the quality of the output it generates but also on whether those outputs lead to meaningful analysis and, where necessary, remediation. Organisations should view their monitoring functions as an iterative component of their broader compliance ecosystem, with clear responsibilities, escalation protocols and documentation standards for analysing and adjudicating exceptions. When effectively designed and governed, monitoring functions not only prevent and detect isolated incidents of potential misconduct but also help organisations anticipate risks, refine controls and strengthen the overall effectiveness of the compliance programme.

A closer look at auditing

While monitoring generally provides real-time visibility into controls and operations, auditing provides structured and independent validation of organisational governance and risk-management processes. Audit functions conduct periodic reviews that provide objective and measurable observations on the design and effectiveness of key processes and controls, including their compliance with applicable policies and procedures.

Broadly speaking, internal audit is responsible for understanding how the organisation identifies and manages risks and then evaluating whether associated governance, risk management and control processes are functioning effectively. Identifying control gaps is a critical part of that process. Audit departments generally perform document review and process walkthroughs to understand how transactions are initiated, reviewed, approved and recorded and then sample-based control testing to assess the adequacy and effectiveness of existing controls at mitigating inherent compliance risks.

Like monitoring, effective auditing requires more than simply identifying isolated control exceptions. A sophisticated audit function should critically examine audit findings and trends to assess whether they reflect design flaws (such as unclear policies or inconsistently applied review procedures), gaps associated with weak or missing controls, or active control circumvention.

Audit findings should translate into concrete remediation and demonstrable follow-through. Where audit procedures surface legitimate gaps or improvement opportunities, reports should clearly articulate the nature of identified issues, the risks posed by those issues and the specific actions needed to address them. Corresponding management action plans should assign ownership for remediating audit findings within defined timelines. Based on a finding’s severity and urgency, auditors should work with management and business stakeholders to evaluate whether management’s remediation plans satisfactorily address the root causes of findings. In this role, the audit department should monitor management’s progress towards remediation and hold the organisation accountable for resolving identified risks and control deficiencies.

When you find something: root-cause analyses and remediation

Prosecutors expect effective corporate compliance programmes to conduct timely post hoc analyses of identified misconduct to surface root causes and inform subsequent remediation. Like analyses of audit findings, root-cause analyses should seek to determine how breakdowns occurred, including whether they were due to innocent misunderstandings, mistakes or omissions, or whether they signal more troubling conduct, such as collusion, control circumvention or fraud.

This process should culminate in the development and implementation of targeted remediation that addresses the root causes of misconduct and reduces the risk of recurrence. Remediation may include, for example, revisions to policies, procedures and training; enhanced system-based controls; or disciplinary measures for culpable employees. In cases involving significant control failures, complex data sources or regulatory scrutiny, third-party forensic accounting experts often help companies diagnose, remediate and test implicated processes and controls.

Closing the feedback loop requires a structured approach. Organisations should establish clear workflows to analyse findings from monitoring and auditing activities and, where necessary, develop targeted remediation plans that address root causes. Remediation plans should detail timelines, owners and measurable outcomes that can then be tested through follow-up monitoring, auditing or external review to confirm that revised controls are operating as intended and capable of preventing and detecting similar issues. In doing so, companies foster an environment in which data-driven insights empower the organisation to proactively make timely and risk-based enhancements rather than reactively responding with piecemeal adjustments when major issues arise.

Conclusion

A static compliance programme is ineffective and unlikely to withstand external scrutiny. In today’s environment, compliance programmes must be dynamic enough to adapt to changes in operating models, risk landscapes and regulatory environments – and companies must be prepared to demonstrate that evolution, if asked. Thoughtful and timely risk assessments remain the bedrock of effective compliance programmes and their findings should directly inform monitoring and auditing plans to ensure that resources are allocated to the business’s greatest risk exposures.

Monitoring and auditing activities are important components of effective compliance programmes and often yield the greatest tangible evidence of how a company’s programme works in practice. Although governance, policies and training help shape an organisation’s risk-management framework, monitoring and auditing activities give it the teeth needed to support evidence-based decision making and answer tough questions about how the programme actually works.

When effectively deployed across an organisation, monitoring and auditing activities help organisations identify emerging risks, evaluate control performance, remediate deficiencies and demonstrate continuous improvement. When integrated with thoughtful risk assessments, targeted root-cause analyses and timely remediation, monitoring and auditing help form an iterative feedback loop that proactively manages risks and generates real-world evidence of programme effectiveness.

Case study: monitoring, auditing and remediation

The following hypothetical case study illustrates how effective monitoring and auditing procedures support broader remediation and continuous improvement efforts.

Monitoring

• As part of its anti-corruption monitoring programme, a US-based multinational manufacturing company maintains algorithms that flag, in real time, payment requests that present one or more risk indicators, including those involving (1) third parties acting as consultants, agents or intermediaries, (2) third parties operating in jurisdictions that present elevated corruption risks, (3) payment requests that lack an underlying purchase order and (4) above-average commission rates.
• The algorithm risk ranks payment requests based on the presence of these and other red-flag indicators and routes the highest-ranked requests each day to the company’s procurement department for review and approval.

Internal audit

• Given the importance of third-party payment controls to the company’s overall compliance programme, the company conducts regular audits across this area and uses audit findings, in part, to refine its monitoring algorithms.
• During audits, internal audit performs sample-based testing to evaluate control effectiveness. Within its sample, internal audit generally includes payment requests escalated to and approved by procurement.

Investigation

• During a standard audit, following a series of data analytics and transaction testing, internal audit identified a series of payments to a third-party consultant based in Latin America that exhibited several corruption-related red flags, including vague service descriptions, unusually high commission rates and unclear proof of service. Several of these payment requests were escalated to procurement based on the company’s monitoring algorithm. Based on these findings, management decided to engage outside counsel and forensic accounting experts to investigate the issue further.
• The company’s investigation determined that, although the monitoring tool appropriately escalated payment requests for review and approval by procurement, the procurement manager approved several requests despite the presence of compliance red flags and the absence of required supporting documents.
• Further analysis revealed that (1) the consultant was onboarded and approved by the procurement manager three weeks after the procurement manager was hired, (2) the count and value of payments to the consultant exceeded those of the next-highest consultant in the region by more than double and (3) the procurement manager previously lived and worked in the neighbourhood where the consultant is based.
• When confronted with evidence, the procurement manager admitted to orchestrating a kickback scheme that involved processing inflated invoices for services not actually rendered and then splitting the proceeds with the vendor – a former business associate.

Root-cause analysis

• Following the admission, the company tasked the forensic accounting firm with identifying the underlying factors that enabled the misconduct to occur. The analysis looked beyond the specific transactions at issue and considered, among other things, the company’s policies, procedures and controls relating to vendor selection and onboarding, due diligence and invoice review and approval.
• The analysis found various control gaps, including insufficient segregation of duties and oversight in the vendor selection process, inadequate monitoring of potential conflicts of interest, inconsistent due diligence, inadequate verification of services before payment and insufficient independence in the escalated-review workflow.

Remediation

• Based on the root-cause assessment, the company designed and implemented several remedial measures designed to strengthen its compliance programme and reduce the risk of recurrence. These included new approval requirements for higher-risk vendor onboarding, including conflicts of interest analysis, enhancements to due diligence procedures, additional payment-approval requirements for higher-risk third parties, enhanced monitoring analytics, targeted anti-corruption training for personnel and continued periodic independent testing of third-party payment controls. Notably, the company also terminated the procurement manager, blacklisted the consultant and adjusted its workflow to escalate higher-risk payments to the compliance department rather than the procurement department.
• The company incorporated findings from its investigation and root-cause analysis into its enterprise and anti-corruption risk assessment processes. This prompted a recalibration of the company’s vendor-related corruption risks in Latin America, leading to additional internal audits over the area and the assignment of an additional full-time member of the compliance team responsible for monitoring corruption risks across the company’s Latin American operations.

Endnotes

^[1] US Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024), p. 2.

^[2] id., p. 17.

^[3] United States Sentencing Commission, “2008 Federal Sentencing Guidelines Manual”, Section 8B2.1, Effective Compliance and Ethics Program.

^[4] US Department of Health and Human Services, Office of Inspector General (OIG), “General Compliance Program Guidance”, November 2023, p. 32.

^[5]Corporate Integrity Agreement between the Office of Inspector General of the Department of Health and Human Services and Kinex Medical Company, LLC (2 March 2026), p. 5.

^[6] Ministry of Justice, “The Bribery Act 2010: Guidance”, p. 31.

^[7] Parquet National Financier and Agence Française Anticorruption, “Guidelines on the implementation of the judicial public interest agreement (CJIP)” (16 Jan 2023), p. 17.

^[8] Committee of Sponsoring Organisations of the Treadway Commission, “Compliance Risk Management: Applying the COSO ERM Framework”, p. 13.

^[9] Organisation for Economic Co-operation and Development Council, “Good Practice Guidance on Internal Controls, Ethics, and Compliance” (adopted 18 February 2010), Annex II.

^[10] The Institute of Internal Auditors’ “three lines of defence” governance framework (“Three Lines Model: Assurance and Advice in Support of Effective Governance”) defines who within the organisation is responsible for managing risks and maintaining effective controls. The first line consists of management and operational functions that own and manage risks; the second line consists of risk management, compliance and similar oversight functions that provide guidance on risks and conduct monitoring activities; and the third line consists of internal audit that provides independent assurance over the effectiveness of risk management and controls.