The Policy Nobody Read

COMPLIANCE

Written by: Devensa Advisory

Compliance programs built on attestation alone can show a signature. They cannot show whether the policy was understood. Source: LRN Corporation, 2025 Global Study on Ethics and Compliance Program Maturity

Nearly every organization can produce a spreadsheet showing 100 percent of employees attested to the code of conduct. Almost none can show that employees understood it. LRN’s 2025 Global Study on Ethics and Compliance Program Maturity found that only 44 percent of organizations even assess training comprehension¹, meaning a majority cannot answer the more basic question of whether the sign-off reflects anything beyond a completed click.

Attestation Is Not the Same Thing as Effective

The U.S. Department of Justice draws this distinction directly. Its Evaluation of Corporate Compliance Programs guidance, most recently updated in September 2024, structures every prosecutorial review around three questions: is the compliance program well designed, is it being applied earnestly and in good faith, and does it actually work in practice. The guidance explicitly warns against what it calls a paper program, one that exists in writing and in attestation logs but does not function when it matters.

A compliance program reduced to a policy library and a sign-off tracker is the paper program the DOJ’s guidance is written to catch. It looks complete from the outside. It has a document for every requirement. What it does not have is evidence that the document changed a decision or that an employee who read it would have acted differently than one who had not.

Where the Gap Actually Lives

The gap sits in the middle of the organization, not at the top. LRN’s 2025 research found that while 85 percent of executives report discussing the code of conduct with their teams, only about half of frontline employees say they actually hear about it from their direct managers². That communication breakdown at the middle-management level is where a well-written code of conduct stops reaching the people making day-to-day decisions on the ground.

The same research found that only 31 percent of organizations formally evaluate ethical behavior through performance reviews, and just 15 percent report having a genuinely strong tone in the middle of the organization³, the layer of management between the executives who write the values and the employees who are supposed to live them. Measurement is thin in the same places: only 29 percent of organizations use analytics tools to evaluate how well their ethics and compliance program is actually performing.

85% of executives report discussing the code of conduct with their teams, but only about half of frontline employees say they hear about it from their direct managers. Source: LRN Corporation, 2025 Code of Conduct Report

What Prosecutors and Regulators Are Actually Looking For

The DOJ’s guidance does not ask whether a company has a code of conduct. Nearly every company under investigation already does. It asks whether the company can demonstrate the program was adequately resourced, whether middle management reinforced it, and whether the organization can point to instances where the compliance function actually changed a business decision or caught a problem before it became a violation. An attestation rate answers none of those questions. It answers only whether an employee clicked a box, which is precisely why the guidance treats a paper program as a liability rather than a defense.

A vCCO builds the layer the attestation rate cannot show. As a fractional executive delivered on an hours-pooled retainer, the vCCO designs the manager-level reinforcement the code of conduct needs to actually reach the frontline, builds the measurement the DOJ’s guidance is looking for, and can speak to how the program performed in practice, not just what the policy library contains.

Grounding the Program in a Real Standard

The DOJ’s Own Framework

The Evaluation of Corporate Compliance Programs guidance is, in effect, the framework most U.S. compliance programs are already being measured against, whether or not the organization has ever faced an investigation. Its structure, well designed, applied in good faith, and functioning in practice, maps directly onto the difference between a policy library and an operating program.

SOC 2 Trust Services Criteria

For organizations building compliance around information and data handling specifically, the SOC 2 Trust Services Criteria add an external, auditable standard that goes beyond internal attestation, requiring evidence that controls actually operate as designed over a period of time, not just that they were documented.

The TruMaturity™ Assessment scores Compliance as one of six governance domains against the CMMI maturity scale, from Initial through Optimized. A program built entirely on documented policies and attestation tracking, with no evidence of manager reinforcement or measured comprehension, typically scores toward the lower end of that scale, because the assessment is built to test for exactly the gap the DOJ’s own guidance is designed to find.

What Separates a Paper Program from a Working One

• Manager-level reinforcement built into the training cycle, not left to the code of conduct document alone.
• Comprehension checks, not just sign-off tracking, on the policies that carry the most risk.
• Ethical behavior included as a factor in performance evaluation, not treated as separate from performance.
• A defined, auditable path for how a reported concern is investigated and resolved.
• Board-level reporting on program effectiveness, not just on attestation completion rates.

Closing the Gap Between the Document and the Desk

1. Separate attestation metrics from effectiveness metrics in every report the compliance function produces, so the two stop being treated as interchangeable.
2. Build a manager-specific training track, since the communication breakdown consistently shows up at the middle-management layer, not at the executive or frontline level alone.
3. Add comprehension checks to the highest-risk policies first. Not every policy needs one, but the ones tied to your organization’s actual regulatory exposure do.
4. Bring ethical conduct into performance reviews explicitly, so the code of conduct has a consequence beyond the attestation log.
5. Ask, for your three most material policies, whether you could produce evidence beyond a sign-off rate that they changed a decision in the last year.

Frequently Asked Questions

What does the DOJ mean by a paper compliance program?

A paper program is one that exists in documentation and attestation records but does not function in practice. The DOJ’s Evaluation of Corporate Compliance Programs guidance explicitly instructs prosecutors to look past the existence of policies and assess whether the program is adequately resourced, reinforced by management, and demonstrably effective.

Is a high policy attestation rate a meaningful compliance metric?

It is a meaningful completion metric, not an effectiveness metric. It shows employees clicked through required acknowledgment steps. It does not show comprehension, and LRN’s 2025 research found only 44 percent of organizations even measure whether training was understood, separate from whether it was completed.

Why does middle management matter so much to compliance program effectiveness?

Middle managers are the primary channel through which employees actually hear about ethical expectations day to day. LRN’s research found a persistent gap here: most executives report discussing the code of conduct with their teams, but only about half of frontline employees say the same about their direct managers.

What should a compliance function measure instead of just attestation rates?

Comprehension on high-risk policies, manager-level reinforcement activity, whether ethical conduct factors into performance reviews, and outcomes from the reporting and investigation process. Only a minority of organizations currently use analytics tools to evaluate program performance this way.

How does a smaller organization build manager-level reinforcement without a large compliance team?

It starts with a short, recurring manager briefing tied to the highest-risk policies, rather than an attempt to replicate a large enterprise program at a smaller scale. What would your organization’s own three highest-risk policies show if you checked for comprehension instead of just sign-off?

Sources

1. LRN Corporation, 2025 Global Study on Ethics and Compliance Program Maturity — https://www.businesswire.com/news/home/20250508935008/en/LRN-Research-Exposes-Gaps-in-Ethical-Culture-Enforcement-and-Risk-Management

2. LRN Corporation, 2025 Code of Conduct Report — https://www.businesswire.com/news/home/20250903013623/en/LRN-Research-Finds-Codes-of-Conduct-More-Usable-Though-Failing-to-Keep-Pace-with-Emerging-Risks

3. U.S. Department of Justice, Evaluation of Corporate Compliance Programs (updated September 2024), summary via OA Law — https://oalaw.com/blog/health-law/usdoj-evaluation-of-corporate-compliance-programs/

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.