Online professional certificate
Professional Certificate in Corporate Compliance & Ethics Management
A complete practical guide to anti-bribery (FCPA), third-party due diligence, whistleblower systems, and audit readiness.
- Format
- Online, self-paced
- Study time
- Up to 1 month
- Curriculum
- 20 applied lessons
- Language
- English
Practical capability
Design compliance programs, conduct internal investigations, assess regulatory risks, and master corporate governance.
Build reviewable controls, fair reporting routes and clear decisions across the compliance program.
Map authority, escalation, policy ownership and the control evidence leaders need.
Score risk, document treatment and route FCPA, sanctions and AML questions to qualified owners.
Build risk-based review files, contract-control checklists and refresh plans.
Design trustworthy intake, preserve evidence and plan fair fact finding.
Teach decisions through short workplace cases and check how learners apply guidance.
Test controls, track corrective action, index evidence and brief leaders on program effectiveness.
Who this course is for
Build practical compliance and ethics capability for your role.
For emerging practitioners and adjacent teams who need a structured way to assess issues, preserve records and route decisions.
The operating cycle
Move from a concern to a documented response.
Use a practical trigger-to-close sequence grounded in the compliance role and its normal decision handoffs.
Curriculum
Four modules. Twenty applied lessons.
Designing an Effective Compliance Architecture
A compliance concern reaches the wrong manager, a policy has no owner, and a risk score sits in a spreadsheet without a decision. In this module, you will learn how to connect reporting lines, written standards, risk assessment and follow-up so that a concern can be handled by the right person. You will build five practical records: an authority and escalation map, a program element-to-control map, a code and policy clause with owner/review record, a risk register and scored risk matrix, and a risk treatment and decision note. Each one helps you show what is known, what remains uncertain, who can decide, and what should happen next.
01Map Compliance Authority and Escalation
Create an authority and escalation map that names the intake, preservation, investigation, advice, remediation and decision owners and shows an independent route for the conflicted matter.
Five practical steps
- Identify the concern, urgency and information that must be preserved
- List each role that may receive, investigate, advise, approve or oversee the matter
- Mark actual delegated authority and any conflict or reporting-line gap
- Select an independent escalation route that fits the organization's approved governance
- Specify the minimum information and access needed at each handoff; test the map with the senior-person concern and record who makes each decision
Primary deliverable: Authority and escalation map
02Translate Program Elements into Working Controls
Build a program element-to-control map that connects each relevant program requirement to a local process, owner, evidence of operation, known gap and next review question.
Five practical steps
- Define the organization's activities and material misconduct risks before using a framework
- Read the seven §8B2.1(b) requirements as a contextual program framework
- List current standards, oversight, training, reporting, monitoring, incentives and response processes
- Assign each process a local owner and identify evidence that it actually operates
- Use DOJ design, resourcing and practice questions to probe important gaps; record uncertainties and recommend a proportionate follow-up for authorized review
Primary deliverable: Program element-to-control map
03Draft and Govern a Code of Conduct
Draft one practical gifts-and-conflicts clause with employee action, reporting and exception routes, then record its owner, approval status and review trigger.
Five practical steps
- Identify the decision the employee must make and the facts they must report
- Review the employer's existing code, policy hierarchy and applicable specialist advice
- Write a clear clause using action verbs and a route for questions or disclosure
- Define who approves exceptions and what record must be kept
- Check the draft against realistic gifts or conflicts situations and privacy limits; send the clause to the authorized policy and legal owners and log version and review trigger
Primary deliverable: Code and policy clause with owner/review record
04Build a Compliance Risk Matrix
Create a scored risk register and matrix that distinguishes corruption, sanctions, conflicts, fraud and privacy questions, documents source facts and names the risk and control owners.
Five practical steps
- Define activities, parties, jurisdictions and time horizon before listing risks
- Write discrete risk scenarios as an event, cause and possible consequence
- Separate known facts from assumptions and specialist applicability questions
- Choose transparent impact and likelihood criteria appropriate to the organization
- Score inherent exposure, record existing controls and explain remaining uncertainty; review the ranking with business and specialist owners and record the next decision needed
Primary deliverable: Risk register and scored risk matrix
05Choose and Document Risk Treatment
Write a risk treatment and decision note that states options, evidence, recommendation, decision authority, action owner and a measurable follow-up test.
Five practical steps
- Read the scored scenario and confirm its factual and specialist uncertainties
- Describe feasible options, including mitigation, pause, escalation or acceptance where delegated
- Compare each option with the risk, business purpose and existing controls
- Recommend an option and identify who has authority to decide it
- Record the actual decision separately from the practitioner's recommendation; assign control action, owner, due date, closure evidence and a follow-up test
Primary deliverable: Risk treatment and decision note
Business Conduct, Anti-Bribery & Third-Party Risk
A gift, an unfamiliar broker fee or a new supplier can create a practical decision before anyone knows whether a rule has been broken. You will learn to gather the right facts, separate a risk signal from a finding, and send each decision to the person authorized to make it. Across five connected situations, you will document gifts and conflicts, review anti-bribery questions, route sanctions and financial-crime signals, build a proportionate third-party file, and plan contract controls and ongoing checks. Each record will show its evidence, owner, open questions and next review trigger.
06Handle Conflicts, Gifts and Hospitality Decisions
Complete a disclosure and hospitality decision form that records the relationship and benefit, policy version, missing facts, proposed recusal or mitigation, authorized review, decision conditions and follow-up date.
Five practical steps
- Capture the request, parties, benefit, timing and business purpose in a restricted record
- Ask only for relationship, value and decision-influence facts needed by the local policy
- Locate the current Code, gifts rule, threshold and exception route; flag any legal-scope question for counsel
- Separate actual, potential and perceived conflict facts from untested assumptions
- Recommend recusal, refusal, further review or another local-policy option to the designated approver; record the authorized decision, notice to affected owners and a check that conditions were followed
Primary deliverable: Disclosure and hospitality decision form
07Spot Anti-Bribery Risk and Route FCPA and UK Questions
Write an anti-bribery transaction review note with parties, services, payment path, source records, red flags, control options, unresolved FCPA/UK scope questions and a named counsel/approver handoff.
Five practical steps
- Map the activity, jurisdictions, parties, intermediary role and proposed payment path
- Collect the contract, invoice, service evidence, approval history and government-touchpoint facts
- Separate verified facts from red flags and list what remains unknown
- Frame FCPA and UK Bribery Act nexus questions for qualified counsel without declaring applicability or breach
- Recommend proportionate controls such as clarification, additional diligence or a locally authorized pause; record the specialist advice, authorized payment or hold decision, conditions and monitoring trigger
Primary deliverable: Anti-bribery transaction review note
08Triage Sanctions Signals and AML Applicability
Complete a sanctions or AML referral record that captures parties and identifiers, screening timing and source, potential-match uncertainty, activity/sector scope, specialist owner, authorized interim action and response trail.
Five practical steps
- Map the business event, jurisdictions, parties and timing of the proposed action
- Collect available names, aliases, ownership and other reliable identifiers with their sources
- Run or review only the employer-approved screening step and preserve the result as a lead, not a final match
- Escalate a possible match or incomplete identifier set under the local hold/release rule
- Ask the financial-crime specialist whether a covered activity and applicable AML/CIP rule exist; do not equate vendor KYB with bank CIP; record the specialist disposition, authorized transaction decision, response completeness and future rescreen trigger
Primary deliverable: Sanctions or AML referral record
09Build a Risk-Based Third-Party Due Diligence File
Produce a third-party diligence file with identity and beneficial-ownership questions, purpose, geography, government touchpoints, payment pattern, evidence, local risk tier, gaps, mitigation, approval route and event-based refresh.
Five practical steps
- Define the relationship, real service, proposed market and business owner
- Collect entity identity, ownership/control and authorized-contact information from approved sources; map government touchpoints, intermediaries, compensation, unusual urgency and relevant jurisdictions
- Perform risk-proportionate reputation, screening and document checks; distinguish an alert from a resolved finding
- Assign a local-policy tier with reasons, assumptions and missing evidence rather than a decorative score
- Recommend mitigation or more information and route approval, pause or rejection to the authorized owner; set ownership and event triggers for rescreening, fee review, changed ownership and ongoing relationship monitoring
Primary deliverable: Third-party diligence file
10Set Contract Controls and Refresh Third-Party Reviews
Create a counterparty clause checklist and monitoring plan that links each proposed contract control to a stated risk, names counsel and business approvers, defines evidence and review owners, and sets changes that trigger a new decision.
Five practical steps
- Carry forward the specific unresolved risks and approvals from the diligence file
- Map each risk to a proposed information, cooperation, audit, subcontracting, payment or exit control
- Mark clause wording as draft and obtain counsel's jurisdiction and contract review before any binding term is used
- Assign business and compliance owners for data collection, invoice/party monitoring and escalation
- Set risk-based periodic and event triggers for new ownership, fee, market, subcontractor, adverse fact or supply-chain claim; test one changed-relationship event, record the authorized response and update the file and plan
Primary deliverable: Counterparty clause checklist and monitoring plan
Speak-Up Systems and Fair Internal Investigations
An employee reports that a manager may have approved an improper supplier benefit and fears being identified. The first response can protect the person and preserve useful evidence, or it can spread the allegation and compromise a fair review. This module follows the concern from a safe reporting route through intake, fact finding and an authorized response. You will build five connected workplace records: a reporting-channel and triage design, an intake and triage note, an investigation plan and evidence index, an interview outline and fact chronology, and an investigation findings report and action handoff. Each task asks what you can do, what you must record and when Legal, HR, an investigator or a decision owner must take over.
11Design a Trusted Speak-Up Channel
Given a local organization chart and channel rules, specify access, intake options, confidentiality wording, non-retaliation follow-up and independent routing for a manager-related concern.
Five practical steps
- Identify who may report, which issue types the channel receives and which existing routes remain available
- Map phone, web, manager and other approved intake routes; state how a report reaches an independent owner when the usual manager is implicated
- Define access roles, data minimization, record retention and the difference between anonymous and confidential reporting under the local rules
- Draft plain-language acknowledgement and non-retaliation wording that does not deter lawful external reporting
- Set urgent triggers for safety, retaliation, evidence loss and senior-person conflicts with named receiving owners; test the design with the case report and revise a weak route or misleading promise
Primary deliverable: Reporting-channel and triage design
12Triage a Report and Protect the Evidence
Create a neutral intake and triage note that preserves the original report, ranks urgency, identifies missing facts and routes evidence-preservation and conflict decisions to authorized owners.
Five practical steps
- Capture the report's original wording, received date, channel and safe contact preference without rewriting it as a conclusion
- Check immediate safety, retaliation, evidence-loss, active transaction and senior-person conflict triggers
- Restrict access and refer preservation instructions to the locally authorized person
- Separate known facts, allegation, missing information and questions for clarification
- Name the conflict-safe triage owner, investigator allocation route and response deadline under the local SOP; record the acknowledgement, escalation, handoff and next review point without announcing an outcome
Primary deliverable: Intake and triage note
13Plan a Fair Internal Investigation
Draft a proportionate investigation plan and evidence index that state the question, authorized investigator, preservation route, evidence sources, access controls, interview sequence and unresolved legal or HR decisions.
Five practical steps
- Convert the triage note into testable questions and define what is outside the inquiry
- Confirm the authorized investigator, counsel/HR roles, conflicts and approval of the plan
- Identify records that may change or disappear and request preservation through the correct owner
- List documentary and digital sources with custodian, date range, access basis and handling record
- Sequence interviews to reduce contamination and include the subject's fair opportunity to respond under local rules; set milestones, secure storage, escalation triggers and a review of alternative explanations
Primary deliverable: Investigation plan and evidence index
14Interview Neutrally and Analyze the Facts
Under an authorized plan, prepare neutral questions, record source-attributed answers and organize corroborated facts, conflicting accounts and unknowns without deciding discipline.
Five practical steps
- Confirm interview authorization, participant role, safeguarding needs and the information the interviewer may share
- Set a neutral purpose and open questions before moving to specific dates, decisions and documents
- Ask for the person's own sequence, sources and alternative explanations without coaching an answer
- Record answers accurately, distinguish direct observation from hearsay and mark follow-up evidence requests
- Place each material account beside documentary evidence and note corroboration, conflict and uncertainty; prepare a fair subject-response opportunity for the authorized investigator and update the chronology without a premature finding
Primary deliverable: Interview outline and fact chronology
15Write Findings and Track the Response
Write a source-traceable findings report that separates allegation, supported findings, limitations and recommendations, then routes discipline and corrective-action decisions to authorized owners and defines closure evidence.
Five practical steps
- Restate the allegation and investigation scope without adopting the reporter's conclusion
- Summarize the evidence for and against each material proposition with source references
- State a supported finding, unresolved issue or no-finding conclusion with the applicable evidence standard set locally
- Describe root-cause hypotheses and practical controls separately from the finding
- Route employment, legal, policy and risk-acceptance decisions to their authorized owners; record what was approved; track action owner, due date, evidence, retest and retaliation follow-up before an authorized closure or reopening decision
Primary deliverable: Investigation findings report and action handoff
Build an Ethical Culture and Demonstrate Program Effectiveness
A compliance program needs people to recognize an issue and know where to take it. In this module, you will turn approved policies into short workplace cases, then use reliable measures and control tests to see where guidance is working and where it needs attention. You will practise explaining findings to reviewers and leaders without hiding gaps or overstating certainty. By the end, you will be able to prepare an evidence response and a concise briefing that asks the right person for a decision.
16Teach Ethical Decisions with Short Workplace Cases
Design a short, role-based ethics case that teaches one decision and checks whether staff can apply it.
Five practical steps
- Choose one role and recurring decision
- Confirm the approved policy and authority
- Write a plausible short dilemma
- Show feedback for each material choice
- Test comprehension and assign follow-up
Primary deliverable: Microlearning scenario and audience plan
17Build a Compliance Dashboard People Can Act On
Define a small set of measures with reliable sources, limitations, review owners and response rules. State the daily, weekly, monthly and event-driven review rhythm that would make the measures useful.
Five practical steps
- Write the decision question
- Select a measure tied to work
- Define numerator, denominator and exclusions
- Check source quality and refresh
- Assign reviewer, threshold and action
Primary deliverable: Compliance dashboard specification
18Test a Control and Verify Corrective Action
Plan and perform a bounded control test, record a gap, assign a corrective action and verify its result.
Five practical steps
- State the control question
- Define population and test approach
- Inspect source records
- Record exception and likely cause
- Assign action and independently retest
Primary deliverable: Control test and corrective-action record
19Prepare an Audit-Ready Evidence Response
Assemble a scoped evidence index, identify missing records and route an external response through the authorized owner.
Five practical steps
- Clarify the request and deadline
- Confirm response authority and access
- Inventory dated source records
- Reconcile gaps and conflicting versions
- Prepare the reviewed response package for authorized submission; record the owner's delivery
Primary deliverable: Audit evidence index and response plan
20Brief Leaders on Ethics Program Effectiveness
Write a concise leadership brief that separates facts, uncertainty and control evidence, then record the authorized improvement decision and follow-up.
Five practical steps
- Identify the decision leaders face
- Select material source-checked signals
- Separate facts, allegations and unknowns
- State options and accountable owners
- Record the authorized improvement decision, decision date, owner and next review
Primary deliverable: Leadership briefing and improvement decision log
Applied capstone
Advise on a high-risk partner concern.
Use the relevant course methods to prepare one coherent response for the authorized program lead.
The situation
A fictional U.S. consumer-products company is about to renew a foreign distributor. Procurement has a fee request with an unclear service description, a speak-up report alleges pressure to bypass review, and the last third-party file is outdated. You have a contract excerpt, invoice, policy excerpt, earlier diligence summary, report wording and a control-test note.
Your task
Prepare one compliance response brief for the authorized program lead. State verified facts and unknowns, triage urgent preservation and retaliation concerns, identify proportionate diligence and investigation handoffs, recommend control and follow-up actions, and name the owner who can decide whether to proceed.
The people behind MTF
Meet MTF faculty and the learner community.
Explore the professional backgrounds of MTF faculty and learn more about the international community studying with the Institute.
Enrollment
Enroll in Professional Certificate in Corporate Compliance & Ethics Management
One-time course price: €10, including applicable taxes. Payment is processed securely by Stripe. No card details are stored on the MTF Institute website.
You will receive an email with access to the course. If you have any difficulties, please write to welcome@gtf.pt.
Questions and details
Frequently asked questions
Open the sections that matter to you, including delivery format, AI-supported practice and the evidence used to design the curriculum.
Who is this compliance and ethics course for?
It is designed for aspiring compliance officers and specialists, risk and audit professionals, investigation and legal operations staff, and HR or ethics partners. The methods help learners turn policy, risk and reporting inputs into reviewable records and accountable handoffs.
How does the course work?
The course is online and self-paced, with four modules, 20 applied lessons and one capstone. Each lesson uses a supplied case and a practical artifact. Study time is up to one month at a flexible pace.
How is AI used in the practical work?
Model-agnostic exercises can help organize supplied facts and critique a draft artifact. Learners check each claim against the case record, protect restricted information and retain human ownership of findings, approvals and external responses.
What evidence supports the curriculum?
The curriculum draws on a structured purposive sample of 104 current U.S. employer-hosted compliance and ethics requisitions and a separate review of current agency signals. Read the vacancy study, 2026 developments article and open research record. The sample describes observed role requirements rather than every employer or every jurisdiction.
What practical work will I complete?
Across the lessons you build an authority map, risk register, anti-bribery review note, third-party diligence file, reporting-channel design, investigation plan, control-test record and leadership brief. The capstone produces one Compliance response brief for a high-risk partner concern.
How are legal and investigation decisions handled?
You practise issue spotting, source checks, neutral fact records and documented handoffs. The case identifies the authorized investigator, counsel, HR or program owner for decisions that require their authority. This keeps the practical record useful and the decision trail clear.
What certificate and access will I receive?
After enrollment, learners receive access to the MTF learning platform. Completing the course provides an MTF Institute professional course-completion certificate for Professional Certificate in Corporate Compliance & Ethics Management.