What Is a Manager’s Role in Corporate Compliance?

A manager’s role in corporate compliance is not to become a compliance officer. It is to help employees recognize when an ordinary business situation becomes a compliance decision, create an environment where people are willing to ask questions, and ensure concerns reach the right person when the team cannot resolve them.

Compliance owns the program, the policies, the reporting systems, investigations, and legal interpretation. Managers operate where those things meet the actual work.

That distinction matters because most compliance programs are still built as a delivery system. Employees receive policies, complete required training, pass an assessment, and return to work. But the difficult decisions rarely arrive while someone is taking the course. They arrive months later, buried inside a deadline, a customer request, a vendor relationship, a side project, an expense report, an AI shortcut, or a conversation with a colleague. That is where the manager becomes important.

Compliance Does Not End When Training Is Completed

Annual compliance training does real work. It introduces policies, sets expectations, and builds a common foundation. But completing training is not the same as being ready to use it.

Research on training transfer reinforces the distinction. A meta-analysis by Hughes, Zajac, Woods, and Salas found that peer, supervisor, and organizational support were all positively related to whether people applied training on the job. Together, those work-environment factors accounted for 32% of training transfer in their model, with peer support contributing the largest share. Peer and supervisor support also showed the strongest relationships with longer-term sustainment.

That shifts the compliance question. Instead of asking Did employees complete the training? an organization also has to ask what happens afterward, when someone has to make a real decision? That is the moment coworkers and managers enter the system.

What Is the Manager’s Role in Compliance?

The manager sits between corporate policy and everyday work. That does not mean interpreting regulations or making legal judgments. It means creating the conditions in which employees can recognize uncertainty, talk about it, and escalate it properly.

That is a much smaller role than many managers assume. It is also a more valuable one.

1. Help employees recognize the decision

Compliance failures rarely start with someone deciding to break a rule. They start when a situation does not appear to be a compliance issue at all.

A vendor sends an invitation during an RFP. A six-week freelance contract looks unrelated to the day job. Someone pastes company information into an AI tool to save an hour. A manager says Don’t worry about it. Each one feels ordinary.

So the first skill employees need is not another memorized rule. It is recognizing that there is a decision here, and it deserves a pause. Managers reinforce that in the normal flow of work, it rarely takes a lecture — “that might be worth checking first,” “who needs to approve this?” “Do we know the reporting route?” “Is there something we can’t see from here?” The manager is helping someone recognize the decision, not necessarily supplying the answer.

2. Give people a place to practice before it is real

Most employees receive compliance information alone. But workplace decisions are socially influenced. People watch what colleagues think and notice what their manager takes seriously, and they hear the rationalizations — it’s only temporary, the client asked for it, my manager already said it was fine, everyone uses AI for this, it’s my own time.

Those arguments matter because the wrong choice in a compliance situation is usually not absurd. It is reasonable enough to be tempting. That is why a short team discussion does something a course cannot. Present a realistic decision, ask people to commit to what they would advise a colleague to do, and then discuss the reasoning.

The point is not to catch anyone getting an answer wrong. It is to find out why a reasonable person might make the wrong call — which never shows up in a completion report or a multiple-choice score. It becomes visible when people talk.

3. Make it easier to raise questions and concerns

Managers matter here for a blunt reason: they are the channel employees actually use.

Ethisphere’s analysis of more than 4.5 million employee survey responses across 300-plus organizations found that among employees who did report misconduct, more than half went to their manager. The leading reasons given by those who saw possible misconduct and said nothing were fear of retaliation and a belief that no corrective action would be taken.

The gap between managers who discuss this and managers who do is not subtle. When a manager frequently discusses ethics and compliance, 98% of employees say they feel comfortable approaching them, compared to 50% when the manager never does. Confidence that non-retaliation protections would be enforced runs 88% against 49%. Belief that a concern would be fully investigated: 91% against 51%. And only 35% of employees say they have a manager who holds those conversations.

Leicht, C., “What Employees Aren’t Telling You (And Why)”, Ethisphere Magazine, 29 May 2026.

Those numbers deserve care. They are strong associations, not proof that manager conversations caused the difference — and they cannot tell a compliance officer what employees inside one particular organization believe. Research tells you where to look. Your own people tell you where the gap actually is.

What a manager does in the first five minutes after someone raises a concern is a separate skill from knowing the policy — and it is where a well-meant response can go wrong. How managers should handle a compliance concern without creating retaliation →

The Manager Does Not Need Every Answer

This is where organizations create the wrong expectation. A manager hears “you have a role in compliance” and concludes I now need to answer every compliance question my team asks. That is neither realistic nor desirable.

For most decisions, the right managerial response is “I don’t know. Let’s find out who does.” A functioning program makes that next step obvious. Who receives an outside-employment disclosure? Who answers a conflict-of-interest question? Where does someone report suspected retaliation? How fast should they expect an answer? Who approves a particular use of AI?

If a manager and the team cannot name the route, that is useful information — and it is usually evidence of a guidance gap rather than an employee failure.

Managers Are Usually Willing. They’re Rarely Equipped.

Organizations routinely ask managers to reinforce compliance without giving them the means to do so. Talk about ethics with your team. Remind everyone to speak up. Reinforce the Code of Conduct.

Those requests sound reasonable until a manager sits down to prepare and runs into the real questions: what topic, what situation, what is the correct answer, what if they ask something I cannot answer, and how do I keep this from turning into a forty-five-minute lecture?

That is an infrastructure problem, not a motivation problem. If you want managers to participate in compliance, give them something they can actually run. Manager and HR training scenarios →

How to Run a Decision Discussion That Produces Something

Whatever material you use, the same five moves separate a discussion that changes judgment from one that fills fifteen minutes.

Start with the decision, not the rule. Put a realistic situation in front of the team and ask what they would advise a colleague to do — before anyone has been told what the policy says. Have them commit privately first, because once the room starts talking, people influence each other. That first commitment gives you a cleaner view of how people actually read the situation.

Let the wrong choices make their best case. Do not announce the answer. Ask who will argue for each option. A well-built compliance decision does not offer two absurd choices and one obvious one — the alternatives should carry the rationalizations people genuinely use. Understanding those is part of understanding the risk.

Consider adding a turn. After the first decision, introduce something that changes the social pressure or the framing without changing any underlying fact — a reassurance, a deadline, a senior person’s casual remark. Then ask the same question again. Did anyone move, and why? The movement is the finding — it shows whether permission-shaped language shifted the decision when nothing about the actual obligation changed.

Reveal the right call last. Only after people have committed and argued should you explain the recommended response — and explain why the other options felt reasonable. The goal is not to remember C. It is recognizing what made A tempting, so you spot that reasoning when it is your own.

Bring it back to your team’s work. Close by connecting the situation to the room: where could this show up in what we do? and if this happened tonight, who would you contact, and how long would it actually take to get an answer? This is where a scenario becomes operational. People often know the principle and discover that nobody can name the route — or that the route takes longer than the decision allows. Those are findings the organization can act on.

Those five moves are what an Xcelus Decision Brief™ — Employee Edition packages into a ready-to-run fifteen minutes: a short slide deck, a manager’s guide with the dialogue and timing worked out, and an Insights Log that captures anonymous decision data, unanswered questions and process gaps to send back to Compliance, Legal or HR. Start with a ready-made brief on a common compliance topic, or have one built around a decision your people actually face. See the Employee Edition catalog →

And when the pressure comes from above rather than from a policy, the same discussion belongs one level up. Leadership pressure scenarios →

Close the Loop Back to Compliance

A good discussion should not evaporate when the meeting ends.

Traditional compliance training moves information one way: From compliance to employees. A manager-led discussion can make it a loop — the team surfaces what it could not answer, and that goes back to the people who can fix it.

Record it at team level, not individual: how the votes split, whether anyone moved and why, questions nobody could answer, uncertainty about reporting or approval routes, and anything needing clarification from Compliance, Legal or HR. No names are required, and a wrong vote does not mean employees failed. Often, it reveals that the organization never made the right action clear enough.

What the DOJ Evaluation of Corporate Compliance Programs Asks About Managers

The Department of Justice’s current Criminal Division Evaluation of Corporate Compliance Programs remains the September 2024 revision. DOJ’s corporate enforcement page still listed it as the operative version in September 2026, despite separate enforcement policy changes in 2025 and 2026.

It matters here because it asks prosecutors to look past whether a company technically has policies, training and a hotline. The ECCP asks whether supervisory employees received different or supplementary training. It asks how a company has assessed whether employees know when to seek advice and whether they would be willing to do so. It asks whether the company tests whether employees feel comfortable using the hotline, whether the company uses practices that tend to chill reporting, and how it assesses employees’ willingness to report misconduct.

It also notes that some companies give employees practical advice or case studies addressing real-life scenarios, and that others have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues.

None of that prescribes any particular format. It does mean that the questions regulators ask are increasingly about what employees understand and do in practice, rather than whether content was assigned.

What Compliance and HR Leaders Can Do

Define the role narrowly enough that managers can actually perform it. They should know what to notice, what to discuss, what never to investigate themselves, and exactly where to route a question or a concern.

Give them prepared material. Telling two hundred managers to “have an ethics conversation this month” does not produce two hundred useful conversations. Give them the situation, the choices, a guide with the dialogue and timing, your own policy language, the escalation route, and the closing question.

Build a way for information to come back. If ten managers discover that employees cannot name the conflict-of-interest disclosure route, that is program data. If teams repeatedly believe disclosure means asking permission, that is a communication problem worth examining. If people understand the policy but the organization cannot give them a realistic turnaround time, that is a process issue. The point is not more employee scores. It is about finding the gap while there is still time to close it.

The Bottom Line

Managers should not replace the compliance function. They should connect it to the work.

They are close enough to watch ordinary situations turn into difficult decisions. They are usually the person someone approaches when something does not feel right. And they can create short opportunities to practice that reasoning before the consequences are real.

The compliance team still owns the program. But managers are what make it stop being something employees complete and start being something teams use.

That is the manager’s role in corporate compliance: help people recognize the decision, make room to talk it through, know when to escalate — and make sure what the team discovers gets back to the people who can act on it.

We made the same argument in conversation on the podcast: Managers Are the Compliance Linchpin →

Frequently Asked Questions