Ethics program evaluation is the process of testing whether an organization’s ethics and compliance program changes how people actually behave, not just whether policies exist and training was completed. A sound evaluation looks at design, implementation, and results, and it compares the program against what regulators and employees experience.
Many programs pass a paper audit and still fail in practice. The code of conduct is current, completion rates are near 100%, and the hotline is posted in the break room, yet employees still feel pressure to cut corners and stay quiet when they see a problem. Evaluation is how you find that gap before an incident does.
The three questions every evaluation should answer
The U.S. Department of Justice uses its Evaluation of Corporate Compliance Programs (updated September 2024) to judge companies, and its structure is a useful model for internal reviews. It centers on three questions:
- Is the program well designed? Does it address the organization’s real risks, with clear policies, training, reporting channels, and oversight of third parties?
- Is it adequately resourced and empowered? Do the people running it have authority, independence, and budget?
- Does it work in practice? Does the company test and improve the program, investigate and fix misconduct, and measure its culture?
Most internal evaluations spend almost all their time on the first question. The third is where programs succeed or fail.
What to evaluate, element by element
| Program element | Paper test | Practice test |
|---|---|---|
| Code of conduct and policies | Current, accessible, approved | Employees can describe how the code applies to decisions in their own role |
| Training | Completion rates | Tailored to high-risk roles; evidence that behavior changed afterward |
| Reporting channels | Hotline exists and is publicized | Employees use it, trust it, and do not face retaliation |
| Investigations | Written procedure | Timely, consistent outcomes regardless of the person’s seniority |
| Leadership commitment | Statements from executives | Employees at all levels believe senior and middle managers are committed |
| Incentives and discipline | Policy links conduct to performance reviews | People who hit targets by cutting corners are not rewarded |
| Culture measurement | Annual survey is run | Results are broken down by team and lead to specific actions |
Measuring training effectiveness, not completion
The DOJ guidance asks directly how a company has measured the effectiveness of its training and whether training changes employee behavior. Completion rates cannot answer either question. A practical approach borrows from the Kirkpatrick model, which evaluates training at four levels: reaction, learning, behavior on the job, and organizational results.
- Learning: Scenario questions tied to real risks in each role, not generic quizzes.
- Behavior: Changes in how often concerns are raised early, how managers respond, and whether gray-area questions reach the ethics office before decisions are made.
- Results: Trends in substantiated misconduct, repeat issues, and culture survey scores over time.
Reporting and retaliation: the most telling data
The Ethics and Compliance Initiative’s 2023 Global Business Ethics Survey found that 65% of employees had observed misconduct, 72% of those reported it, and 46% of reporters experienced retaliation. A program can generate reports and still teach people that reporting is costly. Evaluate both sides: how many concerns come in, and what happens to the people who raise them.
ECI also found that organizations with high-quality programs showed a 546% increase in culture strength over those with the lowest program quality, which is why culture data belongs inside any program evaluation. See how to measure ethical culture for the survey items and metrics.
The layer most evaluations miss: everyday agreements
Ethics programs focus on prohibited conduct. But a large share of ethical breakdowns start smaller: a deadline promised that everyone knew was unrealistic, a commitment to follow up on a concern that never happened, a target accepted without any discussion of how it could be met honestly. DorWay sees organizations as Networks of Agreements™, and from that view, these broken everyday agreements are the soil misconduct grows in.
Add a few questions to your evaluation:
- When targets are set, is there a real conversation about whether they can be met within the rules?
- When a manager promises to act on a concern, is that commitment tracked and closed?
- Can people renegotiate a commitment they cannot keep without penalty? That is the core of accountability.
Clear team agreements and leaders who keep them do more for an ethics program than another policy update. Where individual leaders need support, targeted ethics coaching can help.
How often to evaluate
Run a light review every year, tied to your risk assessment and culture survey, and a deeper evaluation every two to three years or after a significant incident, acquisition, or leadership change. Document what you found and what you changed. Regulators look for evidence that the program improves over time.
FAQ
How do you evaluate an ethics and compliance program?
Test design, resourcing, and effectiveness in practice. Review policies and training, but give the most weight to evidence of behavior: reporting rates, treatment of reporters, consistency of discipline, and culture survey results by team.
What are the key metrics for an ethics program?
Useful metrics include reports per 100 employees, substantiation rates, time to close investigations, retaliation reports, culture survey scores, and behavior change after training. Completion rates alone show activity, not impact.
What does the DOJ look for in a compliance program?
Its guidance asks whether the program is well designed, adequately resourced and empowered, and working in practice, including whether the company measures training effectiveness and its culture of compliance.
How often should an ethics program be evaluated?
A light annual review plus a deeper evaluation every few years, or after a major incident or organizational change, is a common practice.