Anti-corruption compliance: what a program that actually works looks like

Most anti-corruption programs are built around a code of conduct, annual training and a third-party due diligence questionnaire. Those elements are required. They are also the ones prosecutors find easiest to dismiss when an improper payment cleared the ledger anyway.

The US Department of Justice's Evaluation of Corporate Compliance Programs, last updated in September 2024, asks whether compliance and control staff have access to the data they need for "timely and effective monitoring and/or testing of policies, controls, and transactions". It asks how a company measures the accuracy and precision of the data analytics models it uses. Those questions sit in the same document as the ones about tone at the top.

This article covers both layers: the governance layer every program builds, and the transaction layer that produces the evidence.

What is anti-corruption compliance?

Anti-corruption compliance is the set of policies, controls, and monitoring activities an organization puts in place to prevent, detect, and remediate bribery of public officials and private counterparties, and to keep financial records that accurately reflect what was paid and to whom.

Two obligations sit underneath that definition, and they are legally distinct. The first is the prohibition itself: do not offer, promise, or give anything of value to obtain an improper advantage. The second is evidentiary: maintain books, records, and internal accounting controls good enough that an improper payment cannot be disguised as something else. Under the US Foreign Corrupt Practices Act, an issuer can be charged under the second obligation without any bribery charge at all.

Most corruption exposure arrives indirectly. The OECD's Foreign Bribery Report (2014), which analyzed 427 concluded enforcement actions, found intermediaries involved in three out of four cases: agents, distributors, and brokers in 41%, and corporate vehicles such as subsidiaries or entities beneficially owned by the official in 35%. That is why third-party due diligence dominates most programs, and also why it is insufficient on its own: the intermediary was screened before the payment, and the payment is what the regulator examines afterwards.

For the broader regulatory picture this fits into, see our overview of what compliance covers.

The main anti-corruption frameworks

Three regimes carry most of the extraterritorial weight. They differ on who they reach, who enforces them, and, critically, on whether they impose an accounting-controls duty alongside the bribery prohibition.

Sources: 15 U.S.C. §78dd-1 et seq. and §78m(b); Bribery Act 2010; Loi n° 2016-1691 du 9 décembre 2016.

ISO 37001 sits alongside these as a voluntary certification rather than a law. The standard was reissued as ISO 37001:2025 on February 3, 2025, replacing the 2016 edition, with existing certifications transitioning by February 28, 2027. Certification is not a legal defense anywhere, but it gives an auditable structure to a program and is frequently requested by counterparties in high-risk markets.

Two recent changes matter for anyone scoping a program in 2026. In the United Kingdom, the Economic Crime and Corporate Transparency Act 2023 introduced a failure to prevent fraud offense, in force since September 1, 2025 for large organizations, with a "reasonable procedures" defense structured on the same logic as Bribery Act section 7. In the United States, a February 2025 Executive Order paused new FCPA investigations, and revised DOJ guidelines issued on June 9, 2025 restarted enforcement under narrower priorities. Enforcement volume fell sharply: DOJ resolved two corporate FCPA matters in 2025 for roughly $123M combined, against nine in 2024 for roughly $1.1 billion. The statute, the accounting provisions and the ECCP were not amended.

A five-year limitations period, extendable to eight years where foreign evidence requests are involved, outlasts any single enforcement posture. Records created in 2026 will be reviewed under whatever policy applies when they surface.

The two layers of anti-corruption compliance

Almost every published anti-corruption checklist describes the same governance layer: tone at the top, code of conduct, risk mapping, third-party due diligence, training, whistleblowing channel, disciplinary regime. This layer establishes what the organization says it requires and who is accountable for saying it.

The transaction layer is what the organization can demonstrate about money that actually moved. It covers payment approval controls, segregation of duties on vendor master data, travel and expense testing, journal entry review, and the analytics that run across the full payment population to surface patterns nobody flagged in advance.

The two layers answer different questions. Ask whether the code of conduct has been acknowledged and you get a completion rate. Ask whether any payment was made to an agent in the 30 days before a public tender award and you need transaction data, a control that tests for it, and a record of the exceptions reviewed.

Regulators ask the second kind of question. FCPA §13(b)(2)(B) requires issuers to maintain internal accounting controls sufficient to give reasonable assurance that transactions are executed in accordance with management's authorization and recorded so that financial statements conform to GAAP. Sapin II Article 17 lists accounting control procedures as its fifth pillar, and the AFA's recommendations, published in the Journal officiel on January 12, 2021, set out a three-level model: first-level controls by the people entering and validating entries, second-level controls by independent staff, and third-level periodic audits mandated by the governing body.

Neither framework accepts a policy document as evidence that a control operated.

Core elements of an effective program

The most explicit statutory enumeration is the French one. Article 17 II of Sapin II lists eight measures, and it is a useful checklist even outside France because the DOJ's and the Ministry of Justice's expectations map onto it almost completely.

1. A code of conduct defining and illustrating prohibited conduct, annexed to the internal rules.
2. An internal whistleblowing mechanism.
3. A corruption risk map, documented by activity, geography, and business process, and regularly updated.
4. Procedures for assessing clients, first-tier suppliers, and intermediaries against that risk map.
5. Internal or external accounting control procedures designed to ensure books and records are not used to conceal corruption.
6. Training for the executives and staff most exposed.
7. A disciplinary regime applicable to breaches of the code of conduct.
8. An internal control and evaluation system covering the measures themselves.

The UK Ministry of Justice's 2011 guidance frames the same territory as six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication including training, and monitoring and review. The Home Office guidance issued on November 6, 2024 for the new failure to prevent fraud offense uses an almost identical six-principle structure.

Item 8 and the sixth MoJ principle are the ones most often treated as an afterthought. Both require the organization to test its own controls and record the result, which is a different exercise from running the controls.

What the DOJ actually looks for

The ECCP is organized around three questions: whether the program is well designed, whether it is applied earnestly and adequately resourced, and whether it works in practice. The third is where evidence gets examined.

Under the resourcing question, a dedicated topic covers data resources and access. It asks whether compliance and control personnel have sufficient direct or indirect access to relevant data sources for timely monitoring and testing of policies, controls, and transactions, whether any impediments delay that access, and whether the company is using data analytics tools to measure the effectiveness of program components. It also asks how the company manages the quality of its data sources.

The same section asks whether there is an imbalance between the technology a company deploys to capture market opportunities and the technology it deploys to detect and mitigate risk. A finance function running real-time revenue analytics alongside quarterly manual compliance sampling answers that question, and not favorably.

Under the third question, control testing is addressed directly: what testing of controls, collection and analysis of compliance data, and interviews of employees and third parties the company undertakes, how results are reported, and how action items are tracked. The risk assessment section asks whether periodic review is limited to a snapshot in time or based on continuous access to operational data across functions.

These are questions a prosecutor will ask, and the answer will be whatever the organization can evidence from its systems.

Anti-corruption red flags in financial data

Corruption schemes leave traces in ordinary accounting data. The DOJ and SEC's FCPA Resource Guide (second edition, 2020) and the AFA's guide to anti-corruption accounting controls both identify recurring patterns. The AFA specifically recommends keyword testing on entry descriptions in accounts such as fees and commissions.

P2P covers procure-to-pay, T&E travel and expense, and R2R record-to-report. Each red flag is a hypothesis rather than a finding. A round-amount payment to a long-standing logistics provider is usually a retainer. The same payment to a newly created agent in a jurisdiction where a tender is pending is worth an hour of somebody's time. For the broader detection logic, see transaction anomaly detection and fraud prevention.

How to test whether your controls are working

Testing corruption controls on a sample has a structural problem. A sample does give statistical assurance; what it misses is the rare event, because fraud is not evenly distributed across the tested population. Bribery payments are deliberately structured to look ordinary, and a sample sized for material misstatement will almost never contain one. The ACFE's Occupational Fraud 2024: A Report to the Nations, based on 1,921 cases across 138 countries, found that 48% of cases involved some form of corruption, with a median loss of $200,000 and a median duration of 12 months before detection. Twelve months is several audit cycles.

Three things make transaction testing usable for corruption risk.

Full-population coverage. Every payment, expense claim and vendor record in scope is tested against every rule, not a judgmental selection. This is the only way a rare-event control produces meaningful negative assurance.

Continuous execution. Controls run on each data extraction rather than at quarter end. The gap between a payment and its review is where the AFA's second-level control either exists or does not.

A documented exception trail. Each flagged transaction needs a recorded disposition: reviewed, explained, escalated, or remediated. This is what answers the ECCP's question on how results are reported and action items tracked.

This is the layer Supervizor operates on. The platform connects to ERP and expense systems, standardizes the data, and runs 350+ pre-built controls across procure-to-pay, order-to-cash, record-to-report, treasury, tax, travel and expense, and IT general controls, testing the full transaction population on each extraction rather than a sample. Several of those controls map directly to the red flags above: duplicate and round-amount payments, supplier bank detail changes, vendor master data anomalies, and expense claims tested against the company's own policy document.

Two notes on scope. FCPA accounting-provision controls overlap substantially with those tested under SOX, so the work can often be shared. And a program built for Sapin II's fifth pillar produces most of the evidence a DOJ reviewer asks for, since both ask whether controls over payments operated and were tested.

Further reading: continuous controls monitoring, FCPA compliance software, and Sapin II in detail.

Conclusion

The DOJ's September 2024 ECCP asks how a company measures the accuracy and precision of its data analytics models. That question appears in the same document as the one about tone at the top, and it did not change when enforcement priorities did in 2025. An anti-corruption program that cannot show which payments were tested, on what rule, and what happened to each exception is answering only half of what it will be asked.