• Identify its core beliefs, which need to include a commitment to complying with the letter
and spirit of the law and ethical conduct.
• Understand the strengths and weaknesses of its culture and organizational capacities.
• Scan its business environment, presumably on an enterprise-wide basis, to determine what
pressures the organization faces, especially the risk of criminal conduct and violating other
applicable laws, and more broadly, to gather benchmarking data to compare to industry standards
and best practices.
• Determine, relative to its goals and objectives and baseline data of its prior performance,
what outcomes should be expected of the program.
• Identify targets and measurable indicators of expected program outcomes.
• Design, implement, and enforce a program that will “exercise due diligence to
prevent, detect, and report criminal conduct and otherwise promote an organizational
culture that encourages ethical conduct and a commitment to compliance with all applicable law.”
• Regularly evaluate its program to determine if it is effective, and capture what the
organization learns along the way.