Code of conduct

Written policies, procedures, and controls

Board and senior management accountability

Compliance committee / governance structure

Screening for integrity/competence in key roles

Avoid placing bad actors in substantial authority positions

Role-based training (employees, managers, high-risk teams)

Clear messaging and accessible guidance

Ongoing monitoring

Periodic audits and testing

Compliance metrics and reporting

Consistent incentives and disciplinary measures

Fair investigations and documented outcomes

Incident response and remediation

Root-cause analysis

Program updates to prevent recurrence

Gifts, hospitality, travel controls

Third-party payments and red flags

Books and records / internal accounting controls

Customer/partner due diligence (as applicable)

Sanctions screening and suspicious activity escalation

Transaction monitoring (where relevant)

Data mapping and lawful basis

Access controls, retention, and breach response

Vendor data processing requirements

Guidance on competitor interactions

Pricing, bid practices, information exchanges

Trade association participation controls

Product classification and end-use/end-user checks

Restricted party screening

Licensing and recordkeeping

Regulatory compliance obligations

Incident reporting and corrective actions

Training and site inspections

Anonymous options where permitted

Multiple access points (phone, web, email, in-person)

Non-retaliation commitments

Clear intake, triage, and escalation criteria

Documentation, confidentiality, and follow-up

Trend analysis and reporting

Enterprise and local risk reviews

Inherent vs. residual risk; risk appetite

Prioritization of high-risk processes and geographies

Preventive and detective controls

Segregation of duties and approvals

Financial controls supporting compliance (e.g., payments, expenses)

Control testing plans and remediation validation

Risk-based tiers (agents, distributors, vendors, JV partners)

Beneficial ownership, reputation, sanctions screening

Qualification and capability review

Compliance clauses, audit rights, certifications

Payment terms aligned to legitimate services

Periodic refresh, watchlist monitoring, performance review

Periodic effectiveness reviews and benchmarking

Lessons learned from incidents and audits

Policy and training refresh cycles

Technology enablement (case management, screening, analytics)

Tone at the top and middle

Employee feedback and speaking-up culture metrics