What Should a Small Business Compliance Program Include?

A small business compliance program does not need a compliance department. It needs a named owner, written rules for your real risks, training people remember, a safe way to raise problems, and a habit of fixing what you find. Those are the same pieces federal prosecutors and regulators look for in a large company. The difference is scale: a 40-person firm can cover them with a handful of policies, one accountable manager, and short annual training.

Why bother before anything goes wrong? Because a working program changes outcomes when something does. It catches problems earlier, it is evidence of good faith if an agency comes calling, and it answers the compliance questions that customers, lenders, and investors now put in their questionnaires. Our legal compliance and risk management practice builds these programs for companies that have outgrown informal rules.

The elements federal guidelines expect

The most cited framework is the U.S. Sentencing Guidelines standard for an effective compliance and ethics program (Section 8B2.1). It formally applies when an organization is sentenced for a federal crime, but regulators and large customers borrow it as a general benchmark. In plain terms it expects:

• Written standards and procedures designed to prevent and detect misconduct.
• Leadership that knows the program and oversees it, with a specific person responsible for running it day to day.
• Reasonable care not to put people with a history of misconduct in positions of authority.
• Training and communication suited to each person’s role.
• Monitoring and auditing, plus a way to report concerns without fear of retaliation, including anonymously.
• Consistent enforcement, with discipline for violations and recognition for doing the right thing.
• A response plan when misconduct is found, including changes to prevent a repeat.

The guidelines also call for periodic risk assessment, so the program tracks the risks you actually have. When the Department of Justice evaluates a company’s program, it asks three questions: Is it well designed? Does it have the authority and resources to work? Does it work in practice? A small business can answer yes to all three without a large budget.

Sizing a compliance program to your risk

Start from a risk assessment, not a template. A code of conduct written for a public company will talk about insider trading and foreign bribery while ignoring what can actually hurt you, such as overtime calculations, expired licenses, or customer data handling. If you have not mapped your risks yet, our post on how a legal risk assessment works walks through that first step. Then match each element to your size.

Owner

Pick one person with enough authority to get answers from every department. In a small company this is often the COO, the CFO, or the general counsel. Give that person a direct line to the CEO or board, because a compliance owner who reports to the person they may need to question is not independent.

Written policies

Keep them short and specific. A typical set for a growing business covers a code of conduct, anti-harassment and anti-discrimination, wage and hour practices, data privacy and security, conflicts of interest, gifts and expenses, and record retention. Add industry policies where they apply: anti-kickback rules in health care, export controls for certain technology, or procurement integrity for government contractors.

Training

Short, role-specific training beats a long annual video. Managers need to know how to handle a complaint. Sales staff need to know what they can promise in writing. Finance staff need to recognize payment fraud.

Reporting channel

Give employees a way to raise concerns outside their chain of command, such as a dedicated email address monitored by the compliance owner or an outside hotline service. State plainly that retaliation is prohibited, and mean it. Many retaliation claims come from how a manager reacted to a complaint, not from the original issue.

Investigation and discipline

Decide in advance who looks into a report, when outside counsel gets involved, and how results are documented. Apply discipline the same way regardless of seniority. Inconsistent discipline is one of the first things a plaintiff’s lawyer or regulator looks for.

Review

Revisit the program at least once a year and whenever the business changes. Update policies when the law changes, not just when someone remembers.

Where small business compliance programs usually fail

The pattern is familiar. A company adopts a policy set during a financing round or a large customer’s vendor review, files it away, and never trains anyone on it. Two years later a manager does the opposite of what the policy says, and the policy becomes evidence that the company knew the right answer and ignored it.

The second failure is the reporting channel that goes nowhere. If employees report problems and nothing visible happens, they stop reporting internally and start reporting to agencies or lawyers.

The third is oversight that exists only on paper. Owners or the board should receive a short compliance update on a regular schedule: reports received, investigations closed, training completed, policies changed. Our corporate governance and internal policies team often helps build that reporting into board materials.

How counsel fits in

You can build a program in-house. Counsel adds the most value in three places: designing the risk assessment so the findings are privileged where possible, drafting policies that match current law in each state where you have employees, and handling investigations when a report suggests real legal liability. When something does go wrong, the program’s response plan should point to the steps in our guide on what to do after you discover a compliance violation.

If you are building your first compliance program or rebuilding one that never left the shelf, our attorneys can help you size it to your real risks. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our compliance program and legal risk page or schedule a consultation.