Compliance
Compliance program: what it is, what it includes and how AI fits in
A plain guide to what a compliance program contains, taken from two US government documents as read on 8 November 2026.
A compliance program is the set of written rules, named people, training, reporting channels, monitoring and corrective steps an organization uses to prevent and catch breaches of the law and of its own policies. Government guidance describes what regulators look for, not one required template. This page explains the parts using two US government documents read on 8 November 2026.
plain answer
Compliance program: what is it?
A compliance program is how an organization shows, in writing and in practice, that it tries to follow the rules that apply to it and to catch problems early. The US Department of Justice does not treat it as a document. Its guide for prosecutors (updated September 2024) says prosecutors ask three fundamental questions: is the program well designed, is it applied earnestly and in good faith with enough resources and authority, and does it work in practice.
The same guide says the Criminal Division does not use a rigid formula and makes an individualized decision that considers the company's size, industry and regulatory setting. The Department of Health and Human Services Office of Inspector General (OIG) calls its own guidance voluntary and not binding. So there is no single template, and your counsel decides what applies to you.
Sources: US Department of Justice, Evaluation of Corporate Compliance Programs (updated September 2024), and HHS OIG, General Compliance Program Guidance (November 2023), both read 8 November 2026.
plain answer
What are the elements of a compliance program?
HHS OIG, writing for the health care community, lists seven elements: written policies and procedures; compliance leadership and oversight; training and education; effective lines of communication with the compliance officer and disclosure programs; enforcing standards through consequences and incentives; risk assessment, auditing and monitoring; and responding to detected offenses and developing corrective action. OIG says leadership should commit to all seven.
The DOJ guide organizes its questions differently. It covers risk assessment, policies and procedures, training and communications, a confidential reporting structure and investigation process, third party management, and mergers and acquisitions, then management commitment, autonomy and resources, and incentives, then continuous improvement, testing and investigation of misconduct. The two lists overlap heavily.
Sources: HHS OIG, General Compliance Program Guidance, section III (November 2023), and DOJ, Evaluation of Corporate Compliance Programs, both read 8 November 2026.
plain answer
How do you build a compliance program?
Both documents point to the same starting place: know your risks. The DOJ guide asks whether a company has done a risk assessment, whether it is current and whether it is reviewed periodically. OIG places risk assessment, auditing and monitoring among its seven elements and says a formal compliance risk assessment process has become more important in recent years.
From there the documents describe people and routines: a code of conduct and written policies, a compliance officer and a committee with board oversight, training matched to the risks, a way for staff to report concerns, consequences and incentives, and a process to investigate and fix what you find. OIG includes a section on adapting a program for small and large entities. This page is not legal advice.
Sources: DOJ, Evaluation of Corporate Compliance Programs, part I.A, and HHS OIG, General Compliance Program Guidance, sections III and IV, both read 8 November 2026.
plain answer
How does AI fit into a compliance program?
The September 2024 version of the DOJ guide asks about new technology, naming artificial intelligence. Prosecutors may ask how a company assesses the impact of AI on its ability to follow the law, whether AI risk is part of its wider risk management, what controls monitor AI used in the business or in the compliance program, what human decision-making baseline is used to assess it, and how staff are trained to use it.
We recommend a list of the AI tools in use, a named owner for each, a review before changes go live and records you can show. This page reports what DOJ asks. It does not say what any regulator will accept, and it does not say your program is adequate.
Source: DOJ, Evaluation of Corporate Compliance Programs, part I.A and part III.A (updated September 2024), read 8 November 2026.
kriv role
What Kriv does
Kriv AI helps regulated organizations set up the AI part of a compliance program: a list of every AI system and its owner, a review level for each, a check before changes go live, the records an auditor may ask for, and a plain report for leadership. We work alongside your compliance, legal and technology teams, and your own counsel decides what the law requires of you.
Kriv is not a law firm, does not write your whole compliance program and does not certify that any program meets a standard. Kriv AI has achieved the Select partner tier in the Claude Partner Network Services Track.
plain answer
What this page could not confirm
This page uses two documents. The HHS OIG guidance is written for health care and the DOJ guide is written for prosecutors judging corporate criminal cases, so neither is a rulebook for every organization. We did not read the US Sentencing Guidelines text, other agencies' guidance or any state law. Check current versions of both documents before you act.
Related resources
Continue exploring
Straight answers
Frequently asked questions about Compliance program: what it is, what it includes and how AI fits in
What are the 7 elements of a compliance program?
HHS OIG lists written policies and procedures, compliance leadership and oversight, training and education, effective lines of communication and disclosure programs, enforcing standards, risk assessment, auditing and monitoring, and responding to detected offenses with corrective action (General Compliance Program Guidance, November 2023, read 8 November 2026).
Is a compliance program required by law?
OIG calls its guidance voluntary and not binding, and DOJ says it weighs a program when deciding how to treat a company (both read 8 November 2026). Whether a specific law requires one for your organization depends on your industry. Ask your counsel.
Who is responsible for a compliance program?
OIG says an entity's leadership should commit to all seven elements and describes a compliance officer, a compliance committee and board oversight. DOJ asks whether the program has authority and resources. Settle your own structure with your counsel.
How often should a compliance program be reviewed?
OIG recommends that compliance risk assessments be done at least annually, that policies and procedures be reviewed at least annually and that staff receive training at least annually (General Compliance Program Guidance, November 2023, read 8 November 2026). DOJ gives no fixed interval but asks whether risk assessments are current and subject to periodic review. OIG's guidance is voluntary and written for health care, so set your own schedule with your counsel.
Does Kriv build compliance programs?
Kriv AI helps with the AI part: an inventory of AI systems, review levels, change checks, evidence and leadership reporting. It does not write your whole compliance program or certify one.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call