Tone at the top is what leadership's behavior signals about whether the rules actually apply to everyone. Executives set it by what they do under pressure, and employees read it far more closely than they read the code of conduct. The DOJ's compliance-program guidance doesn't use the phrase, and it asks the same thing a different way: did senior leaders' conduct encourage compliance, or quietly signal that the rules were negotiable?

Where does the idea come from?

Internal control and auditing literature, and you can't pin the phrase itself to a first use. People usually trace the concept to the Treadway Commission's 1987 report on fraudulent financial reporting, which pushed the idea that the control environment starts with the people at the top.

The phrase does turn up in COSO's Internal Control Integrated Framework. Describing the Control Environment component, COSO's framework states that "the board of directors and senior management establish the tone at the top regarding the importance of internal control." COSO doesn't define it as a term, though. Its formal element is Principle 1: "The organization demonstrates a commitment to integrity and ethical values." If you need a citable anchor for a board memo, use Principle 1 rather than the phrase.

The Sentencing Guidelines get at the same thing structurally. Section 8B2.1(b)(2) says the governing authority "shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight," and it puts overall program responsibility with high-level personnel. That's tone at the top written as an allocation of duties.

What does good tone at the top look like in practice?

It shows up in decisions where the ethical answer costs something.

  • A leader kills a deal that clears legal review but fails the smell test, and says out loud why.
  • A senior person breaks a policy and gets the same consequence a junior person would. People find out.
  • An executive escalates their own mistake before anyone else finds it.
  • Leadership funds the compliance team when the budget is tight rather than when it's flush.
  • Someone raises a concern in a town hall and gets thanked instead of managed.

Employees calibrate on the exceptions. One quiet carve-out for a high performer teaches more about the real rules than a year of training does, which is why policy attestation records and clean audit trails only get you so far on their own.

Why is tone at the middle the harder problem?

Because your average employee has almost no contact with the C-suite and a great deal of contact with their manager. The CEO sets the stated values. The direct manager decides whether those values survive contact with a quarterly target.

This is where most programs quietly fail, and it's worth being specific about the failure mode. A middle manager sits in a squeeze the executive team doesn't feel: they carry a number, they own the relationships that produce it, and they rarely get told what to do when the number and the policy collide. So they improvise. They approve the expense and don't ask what it was for. They tell a report to "just handle it" rather than route a complaint to HR. They don't repeat the compliance message because they're not sure leadership meant it. None of that is malice. It's a manager with no script.

Three things move it, and none of them is another all-hands video.

  • Give managers the script. Train them on the two or three decisions they actually face, with the words to say. Most manager training teaches policy content. The gap is behavioral: what do you say when a report tells you something you'd rather not have heard?
  • Measure at the manager level. Hotline volume, fear of retaliation scores, and speak-up confidence all vary enormously team to team inside one company. Roll them up to the company average and you erase exactly the signal you needed.
  • Make escalation safe for the manager, not only for the reporter. A manager who escalates a problem on their own team should come out of it looking competent. If escalation reads as an admission of failure, managers will bury things with the best of intentions.

The DOJ saw this coming. Its guidance puts the middle in the section title, and it asks directly: "Have managers tolerated greater compliance risks in pursuit of new business or greater revenues?" Most write-ups on this topic quote the senior half and skip the middle half entirely.

How does the DOJ evaluate leadership commitment?

The Justice Department's Evaluation of Corporate Compliance Programs, updated September 2024, has a section called "Commitment by Senior and Middle Management" with subsections headed "Conduct at the Top," "Shared Commitment," and "Oversight." Under "Conduct at the Top," the ECCP asks: "How have senior leaders, through their words and actions, encouraged or discouraged compliance, including the type of misconduct involved in the investigation? What concrete actions have they taken to demonstrate leadership in the company's compliance and remediation efforts? How have they modelled ethical behavior to subordinates?" The "Shared Commitment" subsection turns the same question on senior leaders and middle-management stakeholders together.

Notice what isn't there: the phrase "tone at the top." The ECCP doesn't use it. If you're writing a board paper or a self-assessment against the ECCP, mirror the department's own language and you'll map to their framework instead of translating into it.

How do you measure something this soft?

Behaviorally, and at the level where the behavior happens.

Track hotline and case volume by business unit and by manager, and treat a unit with zero reports as a question rather than a win. Run pulse questions that ask about observed conduct instead of stated values: has your manager ever asked you to do something you thought was wrong, and did you feel able to say no. Watch whether discipline lands consistently across seniority bands, which is the one metric an executive team can't talk its way past. Read exit interview themes for the phrase "everyone knew." And look at whether leaders show up in the training data as learners, since a code of conduct completion report with gaps at the top is its own finding.

None of these is a score. Together they tell you whether the stated rules and the operating rules are the same rules.

FAQ

Does the DOJ use the phrase "tone at the top"?

No. The Evaluation of Corporate Compliance Programs uses "Commitment by Senior and Middle Management" as its section heading and "Conduct at the Top" as a subsection, and it covers the middle alongside the top.

What's the difference between tone at the top and tone at the middle?

Tone at the top is what executives signal. Tone at the middle is what direct managers signal, and it's what most employees actually experience day to day. A strong top and a weak middle produces a program that looks healthy on paper and fails in practice.

Who invented the term "tone at the top"?

Nobody can point to a documented first use. The concept traces to internal control and auditing literature, with the Treadway Commission's 1987 report as the usual ancestor, and the phrase appears in COSO's Internal Control Integrated Framework without being defined there.