Role SOP and operating playbook
Corporate Compliance & Ethics Role SOP and Operating Playbook
This operating playbook shows how a corporate compliance practitioner can capture a risk signal or concern, identify the responsible decision maker, preserve a controlled record, coordinate review, track action and close with evidence. Employers must set their own approval routes, systems and escalation thresholds.
Explore the Corporate Compliance & Ethics certificate- Resource
- Role SOP and operating playbook
- Evidence
- United States
- Reviewed
- October 15, 2026
- Format
- Reusable professional guide
An adaptable corporate compliance and ethics operating playbook with trigger-to-close workflow, authority and handoff rules, records, cadence and a worked example.
Evidence scope: U.S. corporate compliance and ethics role; structured purposive 104-posting vacancy study and independent 2026 agency-current-change article
Role Starter Pack · Professional Certificate in Corporate Compliance & Ethics Management
Evidence scope: U.S. corporate compliance and ethics roles, reviewed 15 October 2026
Use: An evidence-derived operating model to adapt to one employer's actual authority, risk profile, policies and approved systems.
Direct answer: what does the role do?
A compliance practitioner turns a question, risk signal, disclosure or report into a controlled record: identify the issue, protect people and information, establish the applicable rule and decision owner, gather proportionate facts, recommend a response, track the authorized action, test whether it worked and close with a traceable rationale. The practitioner may coordinate this chain without being the person who gives legal advice, directs an investigation, imposes discipline, accepts risk or speaks for the board.
Use this playbook for corporate ethics and compliance operations, including policy questions, risk assessments, third-party integrity reviews, monitoring exceptions, speak-up reports and corrective actions. It is a model for local adaptation, not a statement that every employer uses the same procedure. A topic such as FCPA, the UK Bribery Act, sanctions, AML, privacy or sector regulation enters the workflow only after the organization identifies a relevant jurisdiction, activity and qualified decision-maker.
Set local authority before work begins
The bracketed fields below are controlled by the employer. The program owner should complete them in the approved SOP and keep the current version in the policy repository. Do not make up a threshold or use a training example as an operational authorization.
| Local field to complete | What must be specified |
|---|---|
[LOCAL: program owner and reporting line] |
Named person or team, independence safeguards, substitute when conflicted, and access to senior leadership or a committee where authorized. |
[LOCAL: intake channels and case system] |
Approved reporting routes, restricted-access system, record ID convention, anonymous-report process and need-to-know access roles. |
[LOCAL: immediate escalation triggers and timeframes] |
Safety, retaliation, evidence loss, senior-leader allegations, possible sanctions hits, regulator contact, material financial exposure and other urgent signals; who receives each alert and by when. |
[LOCAL: investigation and preservation authority] |
Who may issue a preservation instruction, choose or appoint an investigator, approve interviews, direct outside counsel and determine privilege handling. |
[LOCAL: decision and risk-acceptance authority] |
Who may approve or pause a transaction, release a third party, approve an exception, accept residual risk and authorize a corrective action. |
[LOCAL: legal applicability map] |
Applicable jurisdictions, activities and specialist owners for anti-bribery, trade/sanctions, financial-crime/AML, privacy, employment, healthcare, supply-chain or other sector rules; review route when scope is uncertain. |
[LOCAL: systems, retention and privacy rules] |
Approved policy, training, screening, risk, evidence and reporting systems; data minimization, retention, legal hold, deletion and cross-border access rules. |
[LOCAL: reporting and review cadence] |
Case review, risk refresh, control test, training review, third-party refresh and executive/board-report dates and formats. |
[LOCAL: closure and reopening authority] |
Required evidence, retest criteria, anti-retaliation follow-up, closure approval and events that reopen the record. |
Who does what
| Participant | Normal contribution | Boundary to confirm locally |
|---|---|---|
| Compliance practitioner | Opens and classifies a record; asks for missing facts; documents risk, options and evidence; coordinates handoffs; checks due actions. | May recommend but does not assume final legal, investigation, discipline or risk-acceptance authority. |
| Business/process or third-party owner | Explains the activity, provides source records, implements an approved control and owns its operation. | Cannot approve an exception outside [LOCAL: decision authority]. |
| Legal counsel and relevant specialist | Determines legal scope, preservation, regulatory contact and advice for the applicable issue. HR, privacy, security, trade or financial-crime specialists join when their remit is implicated. | A specialist's participation must be documented; no generic compliance label substitutes for expertise. |
| Authorized investigator and HR | Plans and conducts a fair inquiry, manages interviews and evidence, evaluates facts; HR handles employment responses under local rules. | Intake staff do not automatically become investigators or disciplinary decision-makers. |
| Senior leader, committee or board | Receives an appropriately scoped trend or material issue report and makes decisions within its assigned authority. | A submitted report is not a board approval; retain the actual decision record. |
The workflow can be supported by a policy/version repository, learning system, restricted case-management system, risk and action register, approved third-party screening and diligence sources, evidence repository, and spreadsheet or dashboard tool. Configure each as [LOCAL: approved tool, access roles, audit trail and retention]. A product name or automated alert does not replace an accountable reviewer.
Trigger-to-close workflow
Use the steps in order for an individual matter. A routine question may pass quickly through several steps; a sensitive allegation may require separate restricted tracks and specialist direction. Keep the original trigger and subsequent decisions distinct.
- Capture the trigger. Create a unique record with the time received, channel, reporter/contact preference if voluntarily provided, affected business process, transaction or third party, and the original words of a concern where available. Tag the type: policy question, risk/control finding, third-party or transaction review, disclosure, allegation, regulatory change, audit request or other. Store personal or sensitive material only in the approved restricted system
[LOCAL: intake/case system]. - Triage immediate harm and preservation. Ask whether people, records, funds or an active transaction may be at risk. Check
[LOCAL: immediate escalation triggers and timeframes]. Route possible retaliation, safety concerns, threatened evidence, senior-person conflicts, potential prohibited-party activity, urgent regulator requests or substantial exposure promptly to the designated owner. Preserve existing records through[LOCAL: investigation and preservation authority]; do not conduct an unauthorized search or promise absolute anonymity. An urgent escalation can precede a completed risk score. - Set the scope and owner. State the question the record must answer and what remains unknown. Name the business/process owner and decision authority. Check
[LOCAL: legal applicability map]before attaching an FCPA, UK, sanctions, AML or other legal label. Distinguish an untested signal from an allegation, a supported finding and a legal conclusion. If the named owner is involved in the issue, use[LOCAL: conflict/substitute route]and restrict access. - Gather only the facts needed for a proportionate decision. Request dated, source-linked material: policy version and control owner; contract, service description, counterparty identity and relevant ownership information; payment or approval path; training or monitoring record; allegation and evidence sources; or the dated regulatory text. Record what was sought, received, missing and disputed. Apply
[LOCAL: privacy, retention and evidence-access rules]. A screen result or dashboard flag is a lead to review, not a conclusion. - Assess and route. For a risk/control matter, record the activity, plausible event, likelihood and impact rationale, existing controls, uncertainty and proposed treatment in
[LOCAL: risk matrix]. For a third party, document why its role, geography, government touchpoints, ownership, compensation and transaction pattern justify the chosen diligence tier and refresh trigger. For a report of misconduct, the authorized person sets an investigation plan with scope, preservation, interview sequence and fairness safeguards. For a regulatory change, log the issuer, date, jurisdiction, legal status, effective date, affected process and specialist applicability decision. Keep these routes separate even when they share a record ID. - Present a decision, not an assumed approval. Write a short recommendation stating facts, unknowns, options, control or response, residual risk, owner and deadline. Refer it to
[LOCAL: decision authority]. Record who decided, when, on what evidence, any conditions and the approval or refusal. A practitioner can recommend a pause or enhanced review; only an authorized person implements a hold, release, exception, disclosure or risk acceptance under local rules. - Implement and hand off. Assign each approved action to a named owner with a due date and verifiable output. Possible work includes policy revision and rollout, targeted training, counsel-approved third-party contract clauses or payment controls, further diligence, a fair investigation, privacy/security containment, a control test, or a regulator response led by counsel. Share only the information each owner needs. If one track stays open, do not label the entire matter resolved merely because another track finished.
- Verify the response. Request evidence that the action occurred and test whether it addresses the original risk or failure. Review source-data quality, overdue actions, repeat findings, training comprehension where relevant and retaliation follow-up under
[LOCAL: follow-up rule]. Document any failed retest, new evidence or changed circumstances and return the matter to the correct earlier step. - Close or reopen with a traceable record. The authorized closer checks the allegation/finding distinction, decision log, action ownership, evidence index, retest result, unresolved limitations and any required specialist or HR sign-off. Record the closure rationale and date under
[LOCAL: closure authority]. A new transaction, changed counterparty, repeat exception, fresh allegation or ineffective control invokes[LOCAL: reopening trigger].
Decision and handoff guide
| Signal | Practitioner action | Handoff or decision owner | Record to retain |
|---|---|---|---|
| Unclear rule or policy exception | Identify policy version, facts and operational option. | Policy owner/counsel and [LOCAL: exception approver]. |
Question, interpretation source, approval and conditions. |
| Higher-risk third party, unusual fee or possible prohibited-party match | Capture identifiers, activity, payment path and screening timing; recommend proportionate review or pause. | Business owner plus anti-bribery, trade or other specialist if applicable; [LOCAL: transaction approver]. |
Diligence file, potential-match disposition, decision and refresh trigger. |
| Speak-up report or conflict disclosure | Restrict access, triage safety/retaliation, preserve the original report; avoid leading questions. | [LOCAL: investigator/HR/counsel allocation]. |
Intake and routing log; later findings in a separately controlled case file. |
| Control failure or overdue corrective action | Verify the gap and action evidence; escalate delay. | Control owner, risk owner and [LOCAL: escalation approver]. |
Test file, root-cause hypothesis, action tracker, retest. |
| New regulator communication, alert or request | Capture source/date and classify its status before proposing a change. | Counsel/regulatory specialist and authorized response owner. | Applicability note, source copy, request/response completeness check. |
Operating rhythm
This rhythm is a planning model. The approved employer cadence in [LOCAL: reporting and review cadence] controls actual deadlines; vacancy advertisements often do not specify a frequency.
| When | Practitioner routine | Reviewable output |
|---|---|---|
| Daily or on receipt | Review new questions, transactions, reports and alerts; check urgent triggers; assign record ID and owner; preserve and route sensitive material. | Dated intake, triage and handoff record. |
| Weekly or at the local case review | Check open investigations with authorized owners, third-party exceptions, action ageing, training exceptions and due controls. Challenge missing evidence and escalate stalled matters. | Updated case/action queue and decision log. |
| Monthly or at the local program review | Sample selected controls, reconcile dashboard source data, review risk changes, test corrective-action closure and prepare a concise management picture. | Test record, exception summary, KPI definitions and dated management report. |
| At a material event | Reassess after an acquisition, new intermediary/fee, allegation, sanctions indicator, change in law, audit or regulator request, or significant control failure. | Scope/applicability note, updated risk tier, specialist referral and approved response. |
| At the policy/training cycle | Review owner and version of the Code/policy, select the affected audience, use a short scenario, track completion and test understanding or use. | Approved version/rollout record, training assignment, completion and learning check. |
Records, quality checks and measures
Keep an evidence index rather than a loose folder. A reviewer should be able to reconstruct the trigger, the facts available at the time, the decision authority, the action and the later test. Use only [LOCAL: approved systems and retention/access rules].
| Record | Minimum useful fields | Quality check |
|---|---|---|
| Intake and decision log | ID, date/channel, neutral issue statement, owner, urgency, evidence references, decision request, authority, decision and conditions. | Original report preserved; access appropriate; no allegation rewritten as finding. |
| Risk and control register | Activity, risk event, likelihood/impact basis, current control, residual risk, owner, treatment, review trigger. | Assumptions and source dates visible; score does not conceal uncertainty. |
| Third-party or transaction file | Identity/ownership questions, business purpose, geography, service/fee, screening/diligence sources, approved contract clauses, tier, approval and refresh trigger. | Name/identifier quality, timing and unresolved adverse facts reviewed. |
| Investigation file | Authorized plan, preservation, interview/evidence log, competing explanations, findings, limitations, recommended action and sign-offs. | Neutral language; chain of custody and restricted access; no discipline presumed. |
| Action, monitoring and training file | Control test, exception, root cause, named action owner, due date, evidence, retest, policy/training version and audience. | Completed action is backed by evidence and an effectiveness check. |
| Leadership report | Source-linked trend, material issue, denominator, uncertainties, status and requested decision. | Aggregated or redacted to the authorized audience; no unsupported outcome claim. |
Choose measures to answer a management question, and set thresholds only through [LOCAL: KPI definitions and targets]. Useful examples include the share of new matters triaged within the local deadline; open cases past review date; corrective actions overdue; actions passing independent retest; third-party files awaiting refresh; and training completions plus a scenario-based understanding check. For each measure, record numerator, denominator, source system, owner, refresh date and exclusions. A lower number of reports is not by itself evidence of a healthier speak-up culture. Report limitations and possible data gaps beside the chart.
Before closure, check: facts versus assumptions; authority and approval; source and access quality; action evidence; retest; remaining exposure and next trigger. If any element is missing, state the gap and route it—do not convert an incomplete file into a clean status for a dashboard.
Exceptions that change the normal route
- Anonymous or incomplete report: accept it where the channel permits; seek safe clarifying facts without conditioning review on identification. Do not promise absolute anonymity or confidentiality beyond
[LOCAL: channel terms]. - Retaliation, safety or senior-leader conflict: move to
[LOCAL: urgent independent escalation], separate the implicated manager from access and preserve the reporting person's lawful options, including external reporting where applicable. - Potential sanctions match or unusual intermediary payment: retain all available identifiers and transaction timing; route to the qualified specialist before an authorized transaction decision. Do not clear or block a real party solely from this model.
- Possible crime, employment issue or sensitive personal data: use counsel, HR, privacy or security under
[LOCAL: specialist and preservation route]; restrict dissemination and avoid a parallel unauthorized investigation. - System outage or missing source record: use
[LOCAL: approved fallback and reconciliation process], capture an audit trail and do not infer an approval from silence or a failed tool response. - Regulatory request or legal change: counsel decides scope and response; record the issuer's actual text, date and status. An alert, FAQ, enforcement case and binding rule are different inputs.
Reusable SOP template and model
Reusable SOP template and model
Copy this blank model into the employer's controlled document system and complete every bracketed item before operational use. Keep the numbered trigger-to-close sequence above, but adapt its branches and owners to the real organization.
| Field | Fill for the local process |
|---|---|
| Process and version | [LOCAL: process name, owner, approver, effective date, review date] |
| Trigger and scope | [LOCAL: in-scope event types, geography, affected entities and exclusions] |
| Intake and urgent route | [LOCAL: approved channels, ID, triage deadline, emergency escalation] |
| Authority map | [LOCAL: investigator, counsel/HR/specialists, approver, substitute for conflicts] |
| Inputs and systems | [LOCAL: required facts, approved case/risk/screening systems, data access] |
| Assessment and decision | [LOCAL: risk tiers, applicability check, review threshold, decision record] |
| Handoff and action | [LOCAL: receiving owner, minimum shared data, due date, action evidence] |
| Test and close | [LOCAL: effectiveness test, closure sign-off, retention, reopen trigger] |
| Reporting | [LOCAL: KPI definition, audience, cadence, privacy treatment] |
Fictional example for learning purposes.
Worked example: a broker-fee concern
Harborline Components, a U.S. industrial company, receives a proposed invoice from an overseas customs broker for an “expedited inspection fee.” An employee reports through the company's ethics channel that the description does not match the contract. Harborline's policy requires the compliance practitioner to open a case the same business day, route possible government-touchpoint payments to counsel and the anti-bribery lead, and obtain procurement's written approval before a fee is released.
| Stage | Completed record and handoff |
|---|---|
| Intake and triage | The case record preserves the employee's original wording, invoice copy, submission time and channel. The practitioner restricts access, checks for immediate evidence-loss and retaliation concerns, and tells the reporter how to add facts without promising anonymity beyond the channel terms. |
| Scope and facts | The question is whether the proposed fee has a documented service and authorized payment purpose. Procurement supplies the broker agreement, purchase order and service description; Finance supplies the payment status; the broker is asked through the approved business contact for an itemized explanation. The file notes that the invoice has not been paid and that the reason for the fee remains unverified. |
| Applicability and authority | A possible government touchpoint is routed to counsel and Harborline's anti-bribery lead for the applicable-law question. The practitioner does not pronounce an FCPA or UK Bribery Act violation. Procurement's authorized approver, after specialist review, pauses the proposed fee under Harborline's policy; the practitioner records the decision and its time. AML and sanctions programs are not assumed to apply because an invoice is unusual. |
| Investigation and decision | The authorized investigator separately reviews the report, interviews relevant staff under a documented plan and preserves the supporting messages. The resulting finding is a substantiated control/documentation failure: the proposed fee lacks contemporaneous service support. The available evidence does not establish a payment to an official. Counsel and the investigator approve this wording; HR handles any employment question through its own process. |
| Action and verification | Procurement rejects the unsupported fee and updates its broker-payment check to require itemized purpose, contract match and documented approval. Compliance trains the affected payment reviewers. Thirty days later, the control reviewer samples 12 subsequent broker invoices: all 12 have an itemized purpose, contract match and procurement approval recorded before payment. The compliance manager reviews the test file, confirms the original fee was never paid and that no retaliation concern was reported at follow-up, notes that this small sample cannot prove every future payment will comply, and authorizes case closure under Harborline's policy. The practitioner records that decision and the reopening triggers. |
The closed file contains the intake log, preserved invoice and contract references, specialist-routing note, pause decision, investigator's approved findings, corrective-action owner, training record, 12-of-12 retest result, manager's closure decision and remaining sample limit. It does not assert a bribery finding or a disciplinary outcome. A later change in the broker's ownership, service or fees is a reopening trigger for a new review.
Evidence behind the model
This operating sequence is derived from the U.S. corporate compliance and ethics vacancy study and read alongside the separate 2026 agency-signal review. The vacancy study describes a structured purposive sample of 104 U.S. employer requisitions; it does not establish a universal employer workflow. The agency article distinguishes directives, case resolutions, clarifications and sector-specific obligations. Use the local authority and applicability fields above to decide what transfers to a real workplace.
Quick reference
Use the resource in five moves
- Read the role purpose and expected outputs.
- Compare the model with the local role and authority boundaries.
- Select only statements supported by real evidence.
- Adapt the reusable fields without inventing experience or approvals.
- Review the result with the accountable person before operational use.