Evaluating your compliance program: Do peer reviews have a role to play?

What are peer reviews in C&E?

When I first started looking at compliance and ethics (C&E) in higher education I came across discussion of peer reviews of compliance programs.  I was introduced to a book dedicated to C&E in universities and found a discussion of this topic.[1] As an editor in ethikos I arranged for us subsequently to publish an article about peer reviews to raise awareness among more people outside of higher education.[2] The first example I encountered was peer reviews among different schools that were part of the University of Texas. I have since learned that such reviews have occurred in other types of entities, such as reviews among companies in the electric industry.

These reviews typically involve teams from another entity or entities reviewing the compliance program in a company that is participating on a reciprocal basis. The reviews rotate among members of the group. These are not done technically as audits, nor do they involve any type of certification.     

What are the benefits of peer reviews?

In order to have an effective C&E program it is necessary to have some form of evaluation or assessment.  Evaluation also makes sense from a business perspective.  Why do something if it is not working? A peer review would have the potential to provide this function, plus also help assure that a company’s program was at least up to industry practice.[3] If it is done rigorously, it can help demonstrate to a skeptical prosecutor or regulator that you were acting in good faith to ensure your program was working and meeting the expected standards. 

Depending on how a peer review is structured it can be inexpensive as compared to other approaches.  For a team conducting a peer review the expected costs would just be that team’s expenses.  Ideally the peer reviews would be reciprocal, so you would also have some of your people spending their time in reviewing other companies’ programs.

The fact that reviews are reciprocal, however, underscores a major advantage of this approach.  Everyone involved has the opportunity to learn from each other.  The company being reviewed learns from those conducting the review, and those doing the review will very likely gain new ideas and perspectives from examining another company’s program.

It should be the nature of any peer review that the review team members are all experienced C&E people who know the field.  This can be an advantage over having reviews conducted by outside law firms or accounting firms that may use professionals whose experience is litigation or auditing, but who do not have the practical, on the ground experience of running a compliance program.  A professional, such as a lawyer or auditor with experience in other fields, may not even be aware of how much they do not know about C&E. For example, an experienced antitrust lawyer may know everything about the Sherman Act but not have even a clue on such core compliance issues as how incentives need to be used in order to have an effective C&E program, or how to measure a program’s effectiveness.   

Finally, while there should be some structure and ground rules to the review it can be less structured and formalistic than other forms of review. 

What are the downsides and limitations of peer reviews?

As someone whose field was antitrust, the first point that occurs to me is the risk of sharing information with competitors.  Absent a compelling reason and support or compulsion from the government, it is best to avoid peer reviews among competitors.  This avoids the risks of actual or apparent collusion, as well as concern about leaking trade secrets to a competitor.   

A second risk is exposure of confidential and privileged information.  Any review by non-employees needs to address protection of trade secrets and attorney-client confidential communications.  There are also privacy considerations in any review, including customer and employee information, such as would be found in a review of investigation or disciplinary files. 

Another issue, and one that can arise in any form of review, is credibility.  Was the review done independently and in good faith, or was everyone protecting everyone else?   How much freedom did the reviewers have?  Was there a “you scratch my back and I’ll scratch yours” aspect to the reviews or were they truly independent?

Any evaluation related to compliance always has the risk of being used against the company.  It is useful to remember the old adage, “no good deed goes unpunished.”  At least in jurisdictions like the US where litigation can be extremely invasive, any document that shows weakness can be used against the company in litigation.  While, in certain circumstances reviews may have some level of protection, the surest form of protection is to be absolutely certain that any weaknesses are promptly remedied and that this remedial action is reflected in internal documentation kept with any report provided as part of the review.  

How to conduct a peer review

It is likely still the case, as it was when I first started working in this area years ago, that some of the best guidance on peer reviews comes from experience in higher education.  Much of the following is drawn from the book, Effective Compliance Systems.[4]

As in the University of Texas example, peer reviews can be done inhouse, among different business units. This can decrease concerns about confidentiality and competition.  But it can still lead to useful identification of weaknesses and provide for shared learning among the various corporate entities. 

The scope of the review can also vary.  It can be a broad review of every aspect and every risk area in a company.  Or it can focus on specific risk areas and/or lines of business.  It can also address specific program functions, such as training or conducting investigations. 

Peer reviews could originate in industry or geographic compliance practices groups. For example, if businesses in an industry practices group do not compete, such as those that are inherently geographically limited, they might conduct reviews of each other’s programs. However, using compliance practices groups not limited to one industry, such as those based on a specific metropolitan area, would likely be easier in terms of avoiding competitive concerns. Local groups also have the practical advantage of avoiding travel expenses. 

Effective Compliance Systems spells out a practical checklist for conducting a peer review:

1. Select a team leader and at least 3 team members
2. Develop a contract with the peer review team

• Provide the team with background information

1. Appoint an institutional liaison for the peer review team
2. Have an action plan

Within that structure there is obviously enormous room for variations in approach and additional detail. It would seem logical in all cases to have an agreement covering how and when the review would be conducted.  As noted above, a key consideration would be limiting access to confidential information to protect trade secrets, attorney-client confidential information and information protected by privacy laws.    

Alternatives for program reviews and keeping up with industry practices

Peer reviews are just one option for reviewing and evaluating programs. A common alternative is to hire outside professionals for program evaluation.  This might well be considered best practice in this area.  Using outside counsel may also provide a basis to assert attorney-client privilege, if the review provides legal advice. 

Of course, outside professional firms can be expensive.  It is also appropriate to ensure the firm is independent and unbiased. Reviews by a firm’s regular outside counsel might raise questions along these lines, especially if counsel had previously played any role in the compliance program.  Retaining a firm that has not done and does not currently do other work for the company and is known to specialize in compliance and ethics can maximize credibility.

Another, more structured alternative, is to have a program officially certified through a review conducted under a relevant International Standards Organization (ISO) compliance program standard. For example, an antibribery program review seeking official certification might be conducted under ISO 37001. General compliance program reviews could be conducted under ISO 37301. Unlike a company simply selecting any outside firm and telling them what they want reviewed and how they want the review done, the ISO process has standards for what should be in a compliance program, and how a review is conducted and a program certified. While a company decides what entity will conduct the certification review, the reviewer must be on the list of those approved by a national ISO affiliate.[5] As is true for obtaining outside professional reviews, this process can be expensive

One new development on the horizon is potentially developing in Mexico, where it is reported that the competition authority plans to offer reviews and certification of competition law compliance programs.[6]  It remains to be seen how in depth this may be, and whether companies will voluntarily invite a government agency to look into what they are doing. 

I personally believe there is no substitute for having a third party conduct an unbiased assessment of one’s C&E program. However, there are certainly partial methods to obtain input about your program and information on practices in other companies.  For example, informal exchanges at conferences and compliance practices groups can at least provide feedback on various program steps and approaches.  I remember one presentation at a Defense Industry Initiative program where a company had developed a training exercise using a cartoon character. My personal feedback was that it was definitely attention-getting, but that I remembered nothing about the compliance message. Openness has been a hallmark of the C&E community, and we should all be open to sharing information about what we do and seeking input and critiques from others.  

Recommendation.

A peer review is one of those tools companies should consider.  It is a flexible option that could provide useful insight.  The one firm recommendation that is easy to make here, however, is this:  whatever tool and approach you use, it is an absolute necessity to assess and evaluate what you do in your C&E program. 

[1] D. Crawford, A. Chaffin & S. Scarborough, Effective Compliance Systems: A Practical Guide for Educational Organizations xix, 110-12 (Institute of Internal Auditors Research Foundation; 2001)(hereinafter “Effective Compliance Systems”).

[2] D. Crawford, “Using Peer Reviews To Assess Your Compliance Program,” 18 ethikos 12 (Mar/Apr 2005).

[3] See J. Murphy, “Is your compliance program consistent with industry best practice?” https://ideasandanswers.com/is-your-compliance-program-consistent-with-industry-best-practice/

[4] Effective Compliance Systems 110-12

[5] For an extensive analysis of ISO 37001 and the review process, see J. Murphy, “The ISO 37001 anti-corruption compliance program standard: What’s good, what’s bad, and why it matters,” https://ideasandanswers.com/the-iso-37001-anti-corruption-compliance-program-standard/

[6] See Amilcar Peredo & Gustavo Gonzalez Del Castillo, Certification of Compliance Programs in Mexico: Lessons from the Americas (Aug. 4, 2026), Competition Policy International,  https://www.pymnts.com/cpi-posts/certification-of-compliance-programs-in-mexico-lessons-from-the-americas/