Meeting the growing demand for data-driven proof of compliance effectiveness

This shift intensifies exposure for large multinationals that operate complex control environments, depend on third parties, and face divergent supervisory expectations across markets. Boards and senior management must supervise risk-focused monitoring, use metrics tied to outcomes, and maintain audit-ready records that can stand up to examination in different countries. 

Generalities will not do

Authorities are moving beyond accepting high-level policy descriptions, instead wanting to see concrete, data-driven evidence that compliance programs are effective in preventing, detecting, and remediating misconduct. This shift is reflected in recent guidance and enforcement trends in the UK, U.S., and EU, all of which emphasize measurable outcomes and robust documentation as critical to both organizational accountability and individual liability at the board and senior management level. For example:

• In the UK, refreshed Serious Fraud Office (SFO) guidance in 2025 explicitly links charging decisions, deferred prosecution agreement offers, defenses, and sentencing to an assessment of whether controls prevent, detect, and remediate misconduct in practice. “Generalities” and “high-level assertions” will not do. To examine whether operational reality meets policy intentions, prosecutors intend to draw on voluntary disclosures, compelled disclosures and interviews, and direct questioning to organizations.
• In the U.S., enforcement authorities ask whether companies are using data to assess program effectiveness, calibrate third-party risk, and inform compensation decisions. Prosecutorial discretion on monitorships expressly weighs the maturity of controls and the ability to test and update them.
• The new EU AML package shifts supervisory expectations towards evidence that programs are risk based and effective in practice. Obliged entities will need data that evidences calibration of measures to risk, and supervisors will expect to test this using records of both actions taken and decisions not to proceed. 

These guidance and enforcement trends also indicate the ‘direction of travel’ in emerging markets. For example, in the UAE, the focus has shifted over the past 5 years from developing new and improved legislation and regulations to demonstrating implementation and enforcement.  In practice, regulators in the UAE now expect to see that businesses have contemporaneous records that show how well their internal systems and controls are working.

Authorities may differ in how they apply the proof of effectiveness imperative, but the common denominator is measurable outcomes and defensible documentation. There is heightened personal and corporate exposure where evidence of outcomes is weak, fragmented, or inconsistent across jurisdictions.

What needs to be proved?

When authorities test “effectiveness”, they typically look at three things: whether risks were properly understood before the event, whether the company could and should have detected the conduct sooner, and whether the response fixed the underlying problem. Position your program evidence to answer those questions plainly. That means being able to show, with contemporaneous records, what managers saw, what they were told, what they decided, and how quickly issues were escalated and closed out.

View compliance data as potential evidence. Keep simple, legible records that show the journey from risk identification to action: who owned the risk, what monitoring was carried out, what it found, what was escalated, and what remediation followed. Preserve the raw material as well as the summary, e.g., original reports, emails that show decisions, and dated closure notes.

The aim is to let a reviewer retrace events without guesswork. In interviews, being able to point to a short chain of documents that show “we saw this on Monday, escalated on Wednesday, fixed by Friday” is far more persuasive than general statements about tone from the top.

Board oversight

Boards and senior management will be judged on the discipline of their oversight, not the volume of paper. Board packs should be focused on outcomes: what was tested, what failed, and what was done. Minutes should reflect that directors asked probing questions, required time bound remediation, and followed up. If the same issue reappears, ensure the record shows escalating intervention.

Authorities review minutes to ensure senior leaders actively addressed, not just acknowledged, risk.

Bolstering credibility of third-party oversight

Many cases involve third party misconduct. Demonstrate that monitoring is continuous (not just at onboarding) and proportionate to risk. Show that red flags (payment terms, off contract rebates, government touchpoints) triggered timely questions and, where appropriate, hard decisions to pause or exit. Keep clear files on exceptions and overrides—who approved them and why?  In an enforcement context, the credibility of third party oversight will be measured by what was done when it was inconvenient.

Investigations as evidence

Investigations are a primary source of outcome evidence. Track a small set of measures: how quickly serious allegations move from intake to outcome, the proportion of substantiated matters with a control failure root cause, the speed and completeness of remediation, and whether issues reoccur.

Link (and document) each finding to a specific fix, e.g., a policy revision or refreshed training, and record the date the fix was tested.

Using tools without overpromising

If analytics or AI tools are used, describe them in plain terms: what the tool looks at, what kinds of issues it flags, and how human reviewers verify and act on those flags. Keep a simple note of tuning decisions and any limitations. Record how often alerts are overridden and why.

Privilege and disclosure strategy

Questions on effectiveness testing can often intersect with questions about cooperation and privilege. Keep separate factual material (what happened, when, and who was involved) from evaluative commentary (what the company thinks are the implications).

If multi jurisdictional scrutiny is anticipated, map privilege rules early so that documentation and interview strategy do not inadvertently waive privilege. 

In summary, authorities want proof that controls are effective and backed by reliable and audit-ready data. Strengthening governance reporting, ensuring tests are valid, and thoroughly documenting every stage of control (from risk assessment to remediation) will help a business show effectiveness across different regions.

This article is part of the A&O Shearman Cross-border white-collar crime and investigations review 2026. Please click here for our overviews and insights in other jurisdictions.