In a best practices compliance program, a policy explains the rules. Training can introduce the risks. But the employee confronting an unfamiliar request still needs to know what to do now, before making the commitment that changes everything. The question may arrive while a customer is waiting, a payment is pending, or a team is preparing to launch a product. At that moment, “please consult the policy” may identify a resource without resolving the decision. Compliance should equip people before they improvise, not merely evaluate their improvisation afterward.
Your corporate compliance function should routinely advise employees on all issues compliance related. But when was the last time you had this ‘advice function’ evaluated as part of the compliance program. Training should help an employee recognize that a question exists. Guidance should help resolve it in the actual circumstances.
A mature design therefore asks where important decisions occur, who needs help, and how quickly your compliance function can respond. A small company may use a straightforward contact arrangement with clear backups. A larger organization may need specialist routing across functions and time zones; to ensure full and complete coverage. Neither should depend entirely on employees knowing the right person personally.
Make the route visible in the workflow where the question arises. An approval screen, travel process, vendor request, or data-sharing step can direct the user to appropriate assistance without requiring a search through the entire intranet.
The Corporate Translation: A Question Before the Commitment
Consider a hypothetical business development team preparing an important demonstration. An external platform could make the presentation more compelling. A team member suggests uploading records from an existing customer so the demonstration reflects real business conditions. The deadline is tomorrow. The platform has not been reviewed for that use.
One employee remembers the company’s data-handling training but is unsure whether a limited demonstration falls within the existing rules. The employee needs an answer before the upload, not a general reminder the following week. A useful response identifies the immediate boundary, the facts requiring review, and a workable alternative. For example, the adviser may explain that the proposed upload must pause under company policy while the team uses approved synthetic demonstration data.
The commercial objective continues through an authorized route. The unresolved platform assessment remains a separate task with an owner. That is preventive compliance: reducing uncertainty while there is still an opportunity to choose a better course.
Distinguish Advice, Approval, and Reporting
Employees should not have to understand the company’s organizational structure before asking for help. But the company must distinguish what happens after the question arrives. Compliance advice and counseling explains expectations and possible courses of action. Approval authorizes a defined activity within delegated authority. Reporting communicates a concern that may require assessment or investigation. One conversation can involve all three. It should not silently substitute one for another.
In the demonstration example, explaining the synthetic-data option does not approve the external platform for unrestricted use. A security assessment may inform the decision without completing a contractual review. A disclosure that records have already been uploaded requires a response different from a prospective question. State the status clearly. Identify what is authorized, what is prohibited under the applicable requirements, what remains unresolved, and who owns the next decision. Do not describe every advice request as a suspected violation. At the same time, do not leave credible allegations in an informal advice queue because the original employee selected the wrong category.
Ask for the Facts That Change the Answer
A useful intake process gathers enough information to understand the decision without making the request unnecessarily difficult. Ask what the employee proposes to do, which parties are involved, what has already happened, and when the next irreversible step occurs. Identify the relevant information, payment, benefit, representation, or commitment.
Then ask what could change the answer. In our hypothetical, that may include the type of records, existing permissions, platform terms, intended audience, and whether the information would remain stored afterward. Allow the employee to say that a fact is unknown. An intake form should not force a confident answer where none exists.
A compliance professional should avoid collecting unrelated personal information or demanding a full investigation before providing preliminary guidance. Begin with a safe interim direction where appropriate, then assign the additional review. But a compliance professional should also test the claimed deadline. Some deadlines reflect genuine operational needs. Others reflect a late request or an assumption that nobody can change the schedule.
Make the Response Usable
Your employee needs a response that can be acted on, not merely admired for its precision. Explain the concern in business terms. Identify the action that may proceed and the action that must wait. State any conditions, the responsible decision-maker, and what new facts would require reconsideration. In our hypothetical, a practical response might confirm an approved demonstration method, identify the owner of the external-platform review, and explain that permission for the demonstration does not authorize later customer-data uploads.
Preserve the reasoning proportionately. A brief written answer may be enough for a straightforward question. A consequential decision may require a fuller record and formal approval. Do not use conditional language that nobody owns. “Proceed once all requirements are satisfied” is incomplete unless someone knows which requirements apply and who verifies completion. Yes, you knew I would slip in Document Document Document at some point.
Give Advisers Authority and Reliable Backup
A corporate compliance function needs authority, access, and resources to influence decisions before risk is accepted. Timely advice is one way to make that independence operational. A compliance professional should know when it can answer directly and when another function must decide. Give advisers escalation routes for unresolved legal, technical, operational, and commercial questions.
Provide backup for absence and specialist coverage. A program that relies on one expert answering every urgent message recreates the key-person risk. Define what happens when business and compliance disagree. Preserve the competing assessments and route them to the authorized decision-maker. Do not allow repeated requests to different advisers to produce an undocumented approval search.
Maintain an appropriate record of previous advice so that the next adviser can see the relevant history. Restrict sensitive information and involve counsel when legal privilege or other protections may be relevant; do not promise protections that the process cannot guarantee. Employees should be able to trust the service without being told that every conversation is secret or every answer is final.
Measure Helpfulness, Not Just Response Speed
A fast acknowledgment is useful. It is not the same as a resolved question. Measure the time to an actionable response, the time to final resolution, and the reasons for delay. Separate time spent waiting for missing information from time lost because the request had no owner.
Review whether employees understood the answer and followed the approved path. Sample a small number of completed requests and compare the guidance with the subsequent transaction or activity. Also look for unnecessary complexity. If routine questions repeatedly require several functions to restate the same policy, clarify the process rather than celebrating the volume of collaboration.
The 2024 Evaluation of Corporate Compliance Programs asks whether employees know when to seek compliance advice, how to do so and if they show willingness to do so. Availability alone does not answer either question. Use feedback carefully. Satisfaction is relevant, but a correct refusal may disappoint the requester. Conversely, a popular answer may be insufficiently supported. Assess the quality of the reasoning, the clarity of the next step, and the result. Speed belongs in that assessment, but should not dominate it.
Managers Determine Whether Asking Feels Practical
Imagine an employee using the advice service correctly, only to hear from his or her manager that the question should never have been raised. The channel exists. The local message defeats it. A culture of speak up only exists if there is a corresponding culture of listen up.
Managers should demonstrate how to ask early, provide necessary facts, and respond constructively when the answer changes the plan. Include those behaviors in manager training, leadership expectations and evaluate them through actual examples. Give teams protected time for review. A manager cannot repeatedly create last-minute commitments and then treat the resulting control discussion as evidence that compliance is slow.
Equally, compliance should examine its own delays. An inaccessible or inconsistent service should not place the burden of its design failures on the employee. Train managers to receive uncertainty without demanding an immediate conclusion. “Let us establish the facts before we commit” is a useful leadership response. Where concerns involve the manager, provide another route. Advice should not require the permission of the person whose instruction is being questioned.
Turn Repeated Questions into Better Design
An advice log can reveal where policies, training, and workflows leave employees uncertain. Repeated questions about one approval may indicate vague or imprecise instructions or even a policy which is not clear. Questions arriving after commitments may indicate that the control sits too late in the process. Different answers to the same facts may indicate that advisers need alignment. Treat those patterns as hypotheses to investigate, not conclusions to impose.
NIST SP 800-50 Revision 1 approaches cybersecurity and privacy learning through audience needs, behavior change, evaluation, and improvement. Applying that learning-cycle logic to compliance guidance can help connect recurring questions with targeted program changes. For the demonstration team, a useful improvement might be an approved dataset library and a clear route for reviewing external tools. That would address the underlying business need rather than simply repeat the prohibition. Test the revision with the people performing the work. Can they find the approved materials? Do the materials meet the legitimate purpose? Do they know when a different use needs review?
The Compliance Takeaway
The bottom line for a compliance professional is to recognize the situation, explain the issue, provide usable help, and do so before the critical encounter. For companies, that means making advice available where decisions happen. It means clear ownership, appropriate expertise, reliable escalation, and answers that distinguish permission from unresolved questions.
The business should not need a heroic employee to find the one person who understands the issue. Nor should compliance require a crisis before it becomes accessible.
Return to the demonstration. The employee asked before uploading the records. The adviser identified a responsible alternative. The team continued its work without treating the deadline as permission to ignore the concern. That is the result to design for.
The best time to explain the antidote is before someone needs to recover from the exposure.