The seven elements of an effective compliance program come from the US Federal Sentencing Guidelines, which set out what a company needs in place for its program to earn credit at sentencing: written standards, board and executive oversight, care in delegating authority, training and communication, monitoring plus a reporting system, consistent enforcement, and a real response when something goes wrong. Nothing requires you to build one. The credit is what's on offer if you do.

Where do the seven elements come from?

The source is section 8B2.1 of the US Federal Sentencing Guidelines Manual, titled "Effective Compliance and Ethics Program."

Now the part most pages skip. The Guidelines never use the phrase "seven elements." It's industry shorthand for the seven numbered paragraphs in subsection (b). That's also why you'll see sources count eight, nine, or more: they're folding in subsection (a), which requires an organization to "exercise due diligence to prevent and detect criminal conduct" and to "otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law," or subsection (c), which covers periodic risk assessment. Both sit outside the numbered list.

One more framing point, because it changes how you use the section. Read subsection (a)'s own words: an organization has an effective compliance and ethics program "for purposes of subsection (f) of §8C2.5 (Culpability Score) and subsection (b)(1) of §8D1.4 (Recommended Conditions of Probation ― Organizations)." The section defines what counts as effective for culpability scoring and probation conditions. Call it the standard the Sentencing Commission applies, and you'll be right. Call it what the law requires, and a regulator or an auditor will correct you.

What are the seven elements, one by one?

  1. Standards and procedures, 8B2.1(b)(1). "The organization shall establish standards and procedures to prevent and detect criminal conduct." This is where your code of conduct and your policy library live.
  2. Governing authority and operational oversight, 8B2.1(b)(2). The governing authority "shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight." High-level personnel hold overall responsibility. Specific individuals get day-to-day operational responsibility and "shall report periodically to high-level personnel and, as appropriate, to the governing authority."
  3. Screening for substantial authority, 8B2.1(b)(3). "Reasonable efforts not to include within the substantial authority personnel of the organization any individual whom the organization knew, or should have known through the exercise of due diligence, has engaged in illegal activities or other conduct inconsistent with an effective compliance and ethics program."
  4. Training and communication, 8B2.1(b)(4). Reasonable steps "to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program," by conducting effective training programs and otherwise disseminating information appropriate to people's respective roles and responsibilities.
  5. Monitoring, auditing, and reporting, 8B2.1(b)(5). Monitoring and auditing to detect criminal conduct, periodic evaluation of the program's effectiveness, and a system the organization must "have and publicize," which may include mechanisms allowing anonymity or confidentiality, whereby employees and agents may report or seek guidance "without fear of retaliation."
  6. Incentives and discipline, 8B2.1(b)(6). The program "shall be promoted and enforced consistently throughout the organization" through appropriate incentives and through "appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct."
  7. Response and modification, 8B2.1(b)(7). "After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization's compliance and ethics program."

Why isn't risk assessment one of them?

Because it sits at subsection (c), one level up from the list. The text reads: "In implementing subsection (b), the organization shall periodically assess the risk of criminal conduct and shall take appropriate steps to design, implement, or modify each requirement set forth in subsection (b) to reduce the risk of criminal conduct identified through this process."

Read that structurally and it reframes the whole section. Risk assessment isn't a peer of the seven. It's the input that tells you how to build and tune all seven. Your compliance risk assessment decides which standards you write, who gets trained on what, which third parties you look at twice, and where you put your monitoring.

Plenty of write-ups file risk assessment as element one or element eight. If you're preparing a board deck or an audit response, getting the structure right is a small, cheap credibility win.

How does the DOJ's ECCP build on the seven?

The Justice Department's Evaluation of Corporate Compliance Programs, updated September 2024, is what prosecutors use when they assess a program in a live investigation. It organizes around three questions: is the program well designed, is the program "being applied earnestly and in good faith? In other words, is the program adequately resourced and empowered to function effectively?", and does it work in practice?

The ECCP covers the same ground as 8B2.1 and asks for evidence rather than architecture. Part I.A, Risk Assessment, is organized under headings including "Risk Management Process," "Risk-Tailored Resource Allocation," and "Updates and Revisions," and it asks whether "the periodic review [is] limited to a 'snapshot' in time or based upon continuous access to operational data and information across functions." Part I.E gives third party management its own section. Part II.A, "Commitment by Senior and Middle Management," asks how leaders have behaved, which is the tone at the top question in different words.

Think of 8B2.1 as the skeleton and the ECCP as the evidence file a prosecutor opens when something goes wrong.

What gaps do auditors find most often?

Four show up again and again, and each maps to a specific subsection.

  • Oversight on paper only. Subsection (b)(2) asks for adequate resources, appropriate authority, and direct access to the governing authority. A compliance lead who reports three layers down and sees the audit committee once a year fails that test no matter what the org chart says.
  • Training that doesn't reach agents. Subsection (b)(4) reaches the organization's agents where appropriate. Most training rosters stop at badged employees.
  • A reporting system nobody publicizes. Subsection (b)(5) uses the word "publicize." Standing up a hotline isn't the same as making sure people know it exists and trust it.
  • Discipline that bends for high performers. Subsection (b)(6) asks for consistent enforcement. Inconsistency here undoes everything upstream faster than any policy gap.

FAQ

Are the seven elements legally required?

No. Subsection (a) defines an effective program "for purposes of subsection (f) of §8C2.5 (Culpability Score) and subsection (b)(1) of §8D1.4 (Recommended Conditions of Probation ― Organizations)." It sets what counts as effective for culpability scoring and probation conditions.

Is risk assessment one of the seven elements?

No. It's a separate requirement at 8B2.1(c), and it drives the design of all seven. This is the single most common error you'll find on other glossary pages.

Why do some sources list eight or nine elements?

They're counting subsection (a) on due diligence and organizational culture, or subsection (c) on risk assessment, alongside the seven numbered paragraphs in subsection (b). The Guidelines themselves never give a count.