Photo courtesy of author.
In September 1995, the United States Sentencing Commission convened 450 executives, judges, and attorneys in Washington to take stock of a development that many in the room regarded as historic. The Commission had recently begun rewarding organizations that maintained effective compliance programs even when misconduct occurred, and the speakers described an approaching sea change in how business would police itself. More than three decades later, that revolution has not arrived. Codes of conduct, training modules, and helplines are now universal, and J.P. Morgan alone employs more people in its regulatory and risk functions than the entire New York City police force. Yet the practices held out as exemplary today look remarkably like those described in 1995, and compliance remains widely disparaged by the very people it is meant to serve, dismissed by employees as an irrelevant interruption and tolerated by executives as a costly precondition of doing business. Many leaders who sincerely value integrity will concede, at least privately, that they have little idea whether their programs work.
From Paper to Practice is my attempt to explain this stagnation and to describe what a different approach would look like. Compliance programs fail because their effectiveness continues to be measured by process inputs rather than behavioral outputs. Organizations count training completions, policy attestations, and hotline reports, and they mistake these tallies for evidence that conduct has changed. The prevailing metric for compliance training is percent completion, which is roughly equivalent to evaluating my teaching by the share of final exams I collect rather than by what students learned. The result is a field that has become largely a logistical exercise. As we teach on the first day at Harvard Business School, you manage what you measure, and a function that measures activity will produce more activity.
The alternative begins from a premise that will be familiar to readers of my earlier book, Why They Do It: Inside the Mind of the White-Collar Criminal. The failures that produce enforcement actions and reputational collapse are almost never technical. Wells Fargo did not open millions of unauthorized accounts because of a database error, and Volkswagen did not build defeat devices because of a coding mistake. These were decisions made by people whose motivations, pressures, and rationalizations diverged from what their organizations’ policies prescribed. A compliance program is therefore, at its core, an intervention in human behavior, and designing one well is an exercise in behavioral and organizational psychology rather than in drafting.
This matters because people are not switches that can be flipped to a compliant setting. An employee can sign an attestation in good faith and, several weeks later, facing a quarterly target or an opportunity that seems unlikely to be detected, do the opposite of what she promised. The gap between intended and actual conduct is not hypocrisy. It is a durable feature of how people behave under pressure. In the surveys my colleagues and I conduct at Integrity Lab, more than 90 percent of employees say they would report misconduct if they observed it. When the question is reframed to ask whether they did report misconduct they observed in the prior six months, the share typically falls below half.
A second premise follows from the history of the rules themselves. Much of what now triggers enforcement is not a hardwired moral imperative but a social construct of relatively recent vintage. Trading on inside information was an openly acknowledged perk of board service in the early twentieth century, and the United States did not begin enforcing a prohibition until the 1960s, with Japan and Germany following decades later. American companies bribed foreign officials lawfully until 1977, and such payments remained tax deductible in parts of Europe until 1999. This is why I draw a distinction that the Department of Justice itself tends to elide, switching between “compliance programs” and “ethics programs” within a single guidance document. Compliance is externally imposed. It means following rules because they exist. Ethics asks what is right. Integrity operates at a deeper level, as the internal compass that governs conduct when rules are ambiguous, when no one is watching, or when the rule has just changed. If employees refuse bribes only because of vigorous FCPA enforcement, the question of what they will do when enforcement priorities shift is not academic. An integrity culture provides resilience against precisely this kind of regulatory drift, and no volume of policy can substitute for it. Goldman Sachs had extensive controls when Tim Leissner used personal email, lied to compliance committees, and forged documents to push the 1MDB transactions through. Controls alone are ineffective against individuals with sufficient motivation to circumvent them.
The book’s second major claim is that culture will overwhelm any program built primarily on process, no matter how rigorous. Culture is not what appears in the handbook or in the chief executive’s annual message. It consists of the thousands of small decisions about what gets rewarded, what gets punished, and what gets ignored. When a salesperson watches a colleague skirt a control to hit a number and receive a promotion, while a peer who followed the rules and missed the number is coached out, that is where the operative culture is written.
Enron illustrates the point. Its code of ethics, a copy of which sits framed on my desk, ran to 64 pages, articulated integrity in clear and admirable language, and would be regarded as leading practice today. The failure was not one of drafting. Enron never built an incentive system that made those words operational in daily decisions, and a document cannot compete with the performance pressures and reward structures that actually govern conduct. Nor is Enron unusual. When scholars compared hundreds of corporate codes, they found a substantial share of sentences effectively identical across firms, which is what one expects of documents drafted to manage legal exposure rather than to guide behavior.
Two further findings from our survey work shape the book’s prescriptions. The first concerns who actually transmits culture. Conventional wisdom emphasizes tone at the top, but employees consistently rate the integrity of those closest to them most favorably and senior leadership least favorably. Middle managers, whose conduct employees observe every day, are the most powerful shapers of integrity culture, and programs that neglect them in favor of executive messaging are aiming at the wrong audience. The second concerns incentives. Employees do not infer values from codes. They infer them from stories about who succeeded, how they succeeded, and what followed. In one case I teach, a software company facing a missed quarter sent its refund-processing staff to training during the final week so that returns would go unrecorded and a portion of the reserve would flow back into earnings. The manager who devised this was rewarded with a bonus. Whatever one concludes about the accounting, the more consequential question is what every other manager learned from the episode. Incentives are the primary medium through which integrity expectations are actually communicated.
If the goal is behavioral change rather than documented activity, the practical question is how to know whether it is happening. Several elements of the book’s answer are especially relevant to counsel.
The first is a distinction that prosecutors and regulators have increasingly emphasized. A program can be well designed and still fail, and the two dimensions must be evaluated separately. Design effectiveness asks whether an initiative, if executed as intended, would actually mitigate the risk in question. Operational effectiveness asks whether it functions that way in practice, in an environment shaped by human judgment, informal norms, and competing demands. Programs weak on design are active but hollow. Programs weak on operation are what enforcement agencies now call paper programs, robust in the policy manual but absent from daily conduct, and this gap is where most enforcement matters originate.
The second element is the insistence that every initiative have an articulated behavioral goal. When I ask leaders why they maintain a hotline or a consequence framework, the usual answer is that a regulation or an industry norm requires it. That explains the initiative’s origin but not its purpose, and it provides no basis for judging whether it is working. A hotline built to satisfy a requirement will be optimized for documentation. A hotline built to surface concerns will be optimized for accessibility, trust, and investigative follow-through, the features that determine whether an employee brings a concern inside the company before taking it to a regulator or a journalist.
The third element concerns measurement itself. Programs must be assessed by outputs rather than inputs, at the level of individual initiatives as well as the program as a whole, and through leading as well as lagging indicators. Wells Fargo tracked the unauthorized accounts it discovered and the employees it terminated, and those figures showed the bank taking action while revealing nothing about the intensifying pressure that was generating the accounts. Leading indicators, such as survey responses about pressure to compromise or anomalous patterns in sales or expense data, allow intervention before harm occurs. Senior leaders often object that prevention cannot be measured because what was prevented never happened, but economists have been estimating deterrence effects for decades, and the same logic applies inside a company. The book also distinguishes data from evidence. Investigation files illuminate a particular incident, but only information collected systematically across units and over time supports inferences about whether an initiative works. It also requires attention to internal and external validity, since a training program that succeeds among detail-oriented lawyers may fail among a sales force under quota pressure. Industry benchmarking, which most firms treat as a proxy for effectiveness, largely compares inputs and can obscure the possibility that an entire sector is doing something ineffective with great diligence.
Several chapters translate these principles into specific domains. On measuring culture, the book describes how to design surveys that ask what employees have done rather than what they would do, and how to read variation within a company rather than relying on peer comparisons. On risk management, it argues that enterprise risk processes have become cataloging exercises and proposes distinguishing measurable risk, which can be controlled and hedged, from uncertainty, which requires preparedness, while also confronting the gap between the risk appetite leadership espouses and the one its incentives reveal. On speaking up, it treats psychological safety as a series of concentric circles beginning with a colleague or manager and ending with the hotline, with regulators and the press lying outside the organization entirely. The Securities and Exchange Commission’s own data show that more than 80 percent of whistleblower award recipients raised their concerns internally first. Employees generally go outside because the inside did not respond. On consequence management, the book examines the language gap created by “zero tolerance,” which counsel understands as a commitment to investigate and employees understand as a promise of termination, and it draws on the organizational justice literature to explain why inconsistent discipline corrodes reporting and normalizes misconduct. Weaponizing disciplinary systems to remove employees in jurisdictions with strong employment protections, or quietly negotiating the exit of a valuable offender, produces a cynicism that survey data render unmistakable.
Two structural arguments run through the book and bear directly on how legal departments are organized. The first concerns scope. Many organizations practice what I call compliance with a small c, confining the function to discrete domains such as corruption, conflicts, and sanctions while product quality sits in operations and harassment sits in human resources. Yet the cultural forces that produce accounting fraud are the same forces that produce safety violations and quality failures, and fragmentation across silos blinds the organization to common root causes. Compliance with a capital C encompasses the full range of conduct that threatens regulatory standing and reputation, and it demands uniform investigative standards and consequence processes across domains even where ownership differs, because employees experience integrity through patterns rather than organizational charts.
The second concerns reporting lines. Housing compliance within the legal department is the prevailing structure, with real advantages in expertise, privilege, and established escalation, but it creates a predictable tension. A general counsel’s mandate is to minimize liability, mount the strongest defense when problems arise, and protect privilege. An integrity function must proactively search for problems, document weaknesses, and act on signals that are not yet justiciable. A legal function has strong incentives to hesitate before conducting a culture survey that could surface liability, or analyzing expense patterns that might implicate a senior executive. This is not a disagreement about ends, since both routes aim to protect the enterprise from regulatory and reputational harm, but about method, and the outcome-based route requires capabilities that traditional legal training does not supply, including data analytics, operational insight into how work is actually done, and behavioral science. The most effective organizations give the integrity function direct access to the board, independent reporting lines, and a formal mandate to obtain data across business functions, and they revisit these design choices on a regular cycle rather than in the aftermath of a failure.
Finally, the book addresses the obvious question of why anyone should invest in integrity at a moment when enforcement of the FCPA has softened, fraud resources have been reallocated, and compliance is increasingly characterized as overhead. The historical record across eight centuries of financial crises suggests an answer. When oversight weakens, underlying risks do not disappear. They accumulate until they surface, and the firms that dismantled their infrastructure during the permissive period suffer most when scrutiny returns. More importantly, the receding of external pressure creates an opportunity to evaluate integrity on its own merits rather than as an obligation imposed from outside. Organizations with strong integrity cultures free their leadership to focus on strategy rather than enforcement response, retain better people, and build systems that hold up under stress. The 1995 symposium was right that a revolution in compliance was possible. It was wrong about what would bring it about. The revolution will not come from more process. It will come from treating compliance as every other function is treated, by defining what it is meant to change, measuring whether it does, and letting the data rather than the attestation records decide.
Eugene Soltes is a Professor of Business Administration at Harvard Business School. This post is a summary of his recent book (Paper to Practice: Why Compliance Programs Fail and How to Build Programs That Work. Wiley, 2026).
The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).
Photo courtesy of author.
In September 1995, the United States Sentencing Commission convened 450 executives, judges, and attorneys in Washington to take stock of a development that many in the room regarded as historic. The Commission had recently begun rewarding organizations that maintained effective compliance programs even when misconduct occurred, and the speakers described an approaching sea change in how business would police itself. More than three decades later, that revolution has not arrived. Codes of conduct, training modules, and helplines are now universal, and J.P. Morgan alone employs more people in its regulatory and risk functions than the entire New York City police force. Yet the practices held out as exemplary today look remarkably like those described in 1995, and compliance remains widely disparaged by the very people it is meant to serve, dismissed by employees as an irrelevant interruption and tolerated by executives as a costly precondition of doing business. Many leaders who sincerely value integrity will concede, at least privately, that they have little idea whether their programs work.
From Paper to Practice is my attempt to explain this stagnation and to describe what a different approach would look like. Compliance programs fail because their effectiveness continues to be measured by process inputs rather than behavioral outputs. Organizations count training completions, policy attestations, and hotline reports, and they mistake these tallies for evidence that conduct has changed. The prevailing metric for compliance training is percent completion, which is roughly equivalent to evaluating my teaching by the share of final exams I collect rather than by what students learned. The result is a field that has become largely a logistical exercise. As we teach on the first day at Harvard Business School, you manage what you measure, and a function that measures activity will produce more activity.
The alternative begins from a premise that will be familiar to readers of my earlier book, Why They Do It: Inside the Mind of the White-Collar Criminal. The failures that produce enforcement actions and reputational collapse are almost never technical. Wells Fargo did not open millions of unauthorized accounts because of a database error, and Volkswagen did not build defeat devices because of a coding mistake. These were decisions made by people whose motivations, pressures, and rationalizations diverged from what their organizations’ policies prescribed. A compliance program is therefore, at its core, an intervention in human behavior, and designing one well is an exercise in behavioral and organizational psychology rather than in drafting.
This matters because people are not switches that can be flipped to a compliant setting. An employee can sign an attestation in good faith and, several weeks later, facing a quarterly target or an opportunity that seems unlikely to be detected, do the opposite of what she promised. The gap between intended and actual conduct is not hypocrisy. It is a durable feature of how people behave under pressure. In the surveys my colleagues and I conduct at Integrity Lab, more than 90 percent of employees say they would report misconduct if they observed it. When the question is reframed to ask whether they did report misconduct they observed in the prior six months, the share typically falls below half.
A second premise follows from the history of the rules themselves. Much of what now triggers enforcement is not a hardwired moral imperative but a social construct of relatively recent vintage. Trading on inside information was an openly acknowledged perk of board service in the early twentieth century, and the United States did not begin enforcing a prohibition until the 1960s, with Japan and Germany following decades later. American companies bribed foreign officials lawfully until 1977, and such payments remained tax deductible in parts of Europe until 1999. This is why I draw a distinction that the Department of Justice itself tends to elide, switching between “compliance programs” and “ethics programs” within a single guidance document. Compliance is externally imposed. It means following rules because they exist. Ethics asks what is right. Integrity operates at a deeper level, as the internal compass that governs conduct when rules are ambiguous, when no one is watching, or when the rule has just changed. If employees refuse bribes only because of vigorous FCPA enforcement, the question of what they will do when enforcement priorities shift is not academic. An integrity culture provides resilience against precisely this kind of regulatory drift, and no volume of policy can substitute for it. Goldman Sachs had extensive controls when Tim Leissner used personal email, lied to compliance committees, and forged documents to push the 1MDB transactions through. Controls alone are ineffective against individuals with sufficient motivation to circumvent them.
The book’s second major claim is that culture will overwhelm any program built primarily on process, no matter how rigorous. Culture is not what appears in the handbook or in the chief executive’s annual message. It consists of the thousands of small decisions about what gets rewarded, what gets punished, and what gets ignored. When a salesperson watches a colleague skirt a control to hit a number and receive a promotion, while a peer who followed the rules and missed the number is coached out, that is where the operative culture is written.
Enron illustrates the point. Its code of ethics, a copy of which sits framed on my desk, ran to 64 pages, articulated integrity in clear and admirable language, and would be regarded as leading practice today. The failure was not one of drafting. Enron never built an incentive system that made those words operational in daily decisions, and a document cannot compete with the performance pressures and reward structures that actually govern conduct. Nor is Enron unusual. When scholars compared hundreds of corporate codes, they found a substantial share of sentences effectively identical across firms, which is what one expects of documents drafted to manage legal exposure rather than to guide behavior.
Two further findings from our survey work shape the book’s prescriptions. The first concerns who actually transmits culture. Conventional wisdom emphasizes tone at the top, but employees consistently rate the integrity of those closest to them most favorably and senior leadership least favorably. Middle managers, whose conduct employees observe every day, are the most powerful shapers of integrity culture, and programs that neglect them in favor of executive messaging are aiming at the wrong audience. The second concerns incentives. Employees do not infer values from codes. They infer them from stories about who succeeded, how they succeeded, and what followed. In one case I teach, a software company facing a missed quarter sent its refund-processing staff to training during the final week so that returns would go unrecorded and a portion of the reserve would flow back into earnings. The manager who devised this was rewarded with a bonus. Whatever one concludes about the accounting, the more consequential question is what every other manager learned from the episode. Incentives are the primary medium through which integrity expectations are actually communicated.
If the goal is behavioral change rather than documented activity, the practical question is how to know whether it is happening. Several elements of the book’s answer are especially relevant to counsel.
The first is a distinction that prosecutors and regulators have increasingly emphasized. A program can be well designed and still fail, and the two dimensions must be evaluated separately. Design effectiveness asks whether an initiative, if executed as intended, would actually mitigate the risk in question. Operational effectiveness asks whether it functions that way in practice, in an environment shaped by human judgment, informal norms, and competing demands. Programs weak on design are active but hollow. Programs weak on operation are what enforcement agencies now call paper programs, robust in the policy manual but absent from daily conduct, and this gap is where most enforcement matters originate.
The second element is the insistence that every initiative have an articulated behavioral goal. When I ask leaders why they maintain a hotline or a consequence framework, the usual answer is that a regulation or an industry norm requires it. That explains the initiative’s origin but not its purpose, and it provides no basis for judging whether it is working. A hotline built to satisfy a requirement will be optimized for documentation. A hotline built to surface concerns will be optimized for accessibility, trust, and investigative follow-through, the features that determine whether an employee brings a concern inside the company before taking it to a regulator or a journalist.
The third element concerns measurement itself. Programs must be assessed by outputs rather than inputs, at the level of individual initiatives as well as the program as a whole, and through leading as well as lagging indicators. Wells Fargo tracked the unauthorized accounts it discovered and the employees it terminated, and those figures showed the bank taking action while revealing nothing about the intensifying pressure that was generating the accounts. Leading indicators, such as survey responses about pressure to compromise or anomalous patterns in sales or expense data, allow intervention before harm occurs. Senior leaders often object that prevention cannot be measured because what was prevented never happened, but economists have been estimating deterrence effects for decades, and the same logic applies inside a company. The book also distinguishes data from evidence. Investigation files illuminate a particular incident, but only information collected systematically across units and over time supports inferences about whether an initiative works. It also requires attention to internal and external validity, since a training program that succeeds among detail-oriented lawyers may fail among a sales force under quota pressure. Industry benchmarking, which most firms treat as a proxy for effectiveness, largely compares inputs and can obscure the possibility that an entire sector is doing something ineffective with great diligence.
Several chapters translate these principles into specific domains. On measuring culture, the book describes how to design surveys that ask what employees have done rather than what they would do, and how to read variation within a company rather than relying on peer comparisons. On risk management, it argues that enterprise risk processes have become cataloging exercises and proposes distinguishing measurable risk, which can be controlled and hedged, from uncertainty, which requires preparedness, while also confronting the gap between the risk appetite leadership espouses and the one its incentives reveal. On speaking up, it treats psychological safety as a series of concentric circles beginning with a colleague or manager and ending with the hotline, with regulators and the press lying outside the organization entirely. The Securities and Exchange Commission’s own data show that more than 80 percent of whistleblower award recipients raised their concerns internally first. Employees generally go outside because the inside did not respond. On consequence management, the book examines the language gap created by “zero tolerance,” which counsel understands as a commitment to investigate and employees understand as a promise of termination, and it draws on the organizational justice literature to explain why inconsistent discipline corrodes reporting and normalizes misconduct. Weaponizing disciplinary systems to remove employees in jurisdictions with strong employment protections, or quietly negotiating the exit of a valuable offender, produces a cynicism that survey data render unmistakable.
Two structural arguments run through the book and bear directly on how legal departments are organized. The first concerns scope. Many organizations practice what I call compliance with a small c, confining the function to discrete domains such as corruption, conflicts, and sanctions while product quality sits in operations and harassment sits in human resources. Yet the cultural forces that produce accounting fraud are the same forces that produce safety violations and quality failures, and fragmentation across silos blinds the organization to common root causes. Compliance with a capital C encompasses the full range of conduct that threatens regulatory standing and reputation, and it demands uniform investigative standards and consequence processes across domains even where ownership differs, because employees experience integrity through patterns rather than organizational charts.
The second concerns reporting lines. Housing compliance within the legal department is the prevailing structure, with real advantages in expertise, privilege, and established escalation, but it creates a predictable tension. A general counsel’s mandate is to minimize liability, mount the strongest defense when problems arise, and protect privilege. An integrity function must proactively search for problems, document weaknesses, and act on signals that are not yet justiciable. A legal function has strong incentives to hesitate before conducting a culture survey that could surface liability, or analyzing expense patterns that might implicate a senior executive. This is not a disagreement about ends, since both routes aim to protect the enterprise from regulatory and reputational harm, but about method, and the outcome-based route requires capabilities that traditional legal training does not supply, including data analytics, operational insight into how work is actually done, and behavioral science. The most effective organizations give the integrity function direct access to the board, independent reporting lines, and a formal mandate to obtain data across business functions, and they revisit these design choices on a regular cycle rather than in the aftermath of a failure.
Finally, the book addresses the obvious question of why anyone should invest in integrity at a moment when enforcement of the FCPA has softened, fraud resources have been reallocated, and compliance is increasingly characterized as overhead. The historical record across eight centuries of financial crises suggests an answer. When oversight weakens, underlying risks do not disappear. They accumulate until they surface, and the firms that dismantled their infrastructure during the permissive period suffer most when scrutiny returns. More importantly, the receding of external pressure creates an opportunity to evaluate integrity on its own merits rather than as an obligation imposed from outside. Organizations with strong integrity cultures free their leadership to focus on strategy rather than enforcement response, retain better people, and build systems that hold up under stress. The 1995 symposium was right that a revolution in compliance was possible. It was wrong about what would bring it about. The revolution will not come from more process. It will come from treating compliance as every other function is treated, by defining what it is meant to change, measuring whether it does, and letting the data rather than the attestation records decide.
Eugene Soltes is a Professor of Business Administration at Harvard Business School. This post is a summary of his recent book (Paper to Practice: Why Compliance Programs Fail and How to Build Programs That Work. Wiley, 2026).
The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).
