Compliance risk reporting, explained.

What compliance risk reporting is: one honest account, each quarter, of where misconduct risk moved

One quarterly report, from quarter close to the committee meeting

1. The quarter closesMarkets finish their risk workshops, and control tests, audits and plans are updated. In the example, this happens on September 30.
2. Eight sources are gatheredScores, tests, hotline, audit, monitoring, investigations, plans and the third-party register come together, each in its own format.
3. Reports become issues, and the moves get explainedReports about the same matter are merged, each score change is traced to a cause, and every sentence and figure is written and checked. This step is what this guide is about.
4. Market leads and the CCO reviewEach market lead checks its section. The CCO reads the whole report, asks for changes and signs.
5. The committee meetsThe report goes out, leaders ask their questions, and actions go into next quarter's plan. In the example, the meeting is on October 15.

The people, companies and figures in this example are fictional.

Why a hotline count is a poor measure of risk, and three more surprises

Inherent risk, residual risk, report, issue: four words this work runs on

Fourteen terms are defined in the one-page summary.

Five questions a compliance committee report must answer, and the eight sources behind them

In shortA good quarterly report answers five questions: what moved, which issues drove it, how the fixes are going, where to focus, and what data is missing. No single system answers any of them. Each answer has to join at least two sources, and those sources rarely share a common code for market, party or quarter.

The five questions are simple to say. The hard part is joining the sources. To say why a score rose, you need the score, the control test behind it and the third-party register that shows the overdue reviews. To say which issues drove it, you need all four reporting channels matched to one another. To say whether a fix will help, you need the plan's status and the scoring rule.

OIG's guidance says a compliance risk assessment should "pull information about risks from a variety of external and internal sources", and that the compliance officer's reports should cover concerns received and investigations conducted.4

The eight compliance data sources: who owns each, and what it counts

What DOJ, OIG, the EU and Brazil expect of a compliance risk report, and what changed in 2025 and 2026

In shortNo law sets out a quarterly compliance report. The expectation comes from what prosecutors at the US Department of Justice (DOJ) and the sentencing rules give credit for: a periodic risk assessment, reporting to the board, and data the compliance team can reach. The biggest recent changes are a narrower US approach to foreign bribery, one US corporate enforcement policy, and a new EU anti-corruption directive that national laws must carry by June 2028.

Foreign bribery cases fell in 2025 while False Claims Act recoveries hit a record: how to read both

In shortA committee that reads only one chart will get the wrong idea. FCPA actions dropped to eight in 2025, with none from the Securities and Exchange Commission (SEC). False Claims Act recoveries, the money the US government wins back from fraud against its programs, reached more than $6.8 billion, with more than $5.7 billion from health care, and whistleblowers filed a record 1,297 suits. The legal risk moved to other laws and other countries.

The pause and the guidelines changed the odds of a US foreign bribery case. The statute still stands, and the conduct remains illegal. Gibson Dunn counts no SEC FCPA action at all during 2025.5 Yet the rest of the world moved the other way: the EU directive raises maximum corporate fines,10 the UK offense took effect in September 2025,7 and Brazil's fines run to 20% of gross revenue.14 A global company has to read these together.

More than $5.7 billion of the fiscal 2025 total of over $6.8 billion came from health care.19 Those figures cover all kinds of health care fraud, with kickbacks only a part. A specific example shows the commercial link: in April 2025 Gilead agreed to pay $202 million to settle civil claims over speaker programs. OIG's notice says Gilead admitted paying high prescribers "hundreds of thousands of dollars" in speaker fees, and cites luxury restaurants as venues.20

The record number of whistleblower suits is a reason to care about speed inside the company. Under DOJ's 2026 policy, when a whistleblower reports both inside the company and to DOJ, the company can still qualify for a declination, meaning DOJ closes the matter without charges, if it self-reports "as soon as reasonably practicable but no later than 120 days" after receiving the internal report and meets the policy's other requirements.8

The clock runs from the internal report. A quarter is about 90 days, so a hotline report that sits unconnected in one channel until the quarterly report uses up most of that window.

Commercial compliance risk areas in pharma and medtech: speakers, distributors, tenders, grants, hospitality, loaned equipment

In shortThis guide's example tracks six risk areas, and published rule sets name most of them. Each has a recognizable pattern of misconduct, its own evidence and its own rules. Your own taxonomy may split or merge them.

Distributors deserve their own attention in medtech. When a device maker sells through a distributor, money can leave through the margin, with no payment to an official showing on the manufacturer's books. That is why a 22% margin against a 15% contract is worth a line in the report.

DOJ's guidance asks whether a company knows the business reason for the third party, whether the contract describes the services, whether the work is done, and whether pay matches the work. It also asks about ongoing monitoring, "through updated due diligence, training, audits, and/or annual compliance certifications".1

How a residual risk score works: inherent risk times a control factor, worked through for Brazil

In shortRate likelihood and impact from 1 to 5 and multiply to get inherent risk. Multiply again by a factor for how well controls work to get residual risk. A score can jump without any new misconduct, because a failed control test moves the factor. No regulator publishes these numbers, so the method is yours to set and defend.

OIG points compliance committees to the enterprise risk framework from COSO (the Committee of Sponsoring Organizations of the Treadway Commission) and its 2020 compliance guide for method.4 Risk matrices of this kind are widely used in enterprise risk management.23 Here is the version in the guide's example, a fictional medical device maker.

Look at what moved in Q3. Inherent risk did not change: the same distributors sell in the same market. The control rating fell from Adequate to Weak, because 7 of 19 distributor due-diligence reviews were overdue at quarter end, against 1 of 19 in Q2. So the honest sentence is that the company's protection got weaker. It says nothing yet about whether anyone paid a bribe. A reader who confuses those two ideas will misread the whole report.

Public tenders follow the same pattern. Inherent risk is 4 × 4 = 16. Adequate gives 9.6, shown as 10. Weak gives 15.2, shown as 15. Those rounded numbers feed the average, and that average decides the market's label. In this example, a market is rated High from 13.0, so Brazil crosses the line exactly.

Hotline de-duplication: how 121 reports across four channels become 83 issues, and what a match window does

In shortThe same matter often reaches a company through several channels. Counted per channel, a market looks worse and the real driver hides. Merge on party, place, kind of allegation and a time window. Every merge rule makes two kinds of mistake, so measure both and let a person confirm the weak matches.

Start with volume. NAVEX reports a median of 1.57 reports per 100 employees in 2024, among the 4,077 organizations in its data that received at least 10 reports that year.2 For a company of 12,000 people, that works out at about 188 reports a year (our arithmetic, for illustration), before internal audit findings and monitoring alerts are added. NAVEX's 2026 edition says report volume is up 40% since 2020 among organizations that track all intake sources.24 Its medians sit behind a registration wall, so we quote the 2025 figures.

Now take the example's quarter. Hotline, internal audit, monitoring and investigations sent 121 reports. Matching them gave 83 distinct issues, so 38 reports, or 31%, repeated an issue another channel had already raised. Monitoring produced the most repeats, because an alert often fires on a payment someone else has already flagged.

Party, place, allegation and a window: how report matching works

A usable matching rule looks for the same party (by tax ID or registered name, since callers misspell names), the same place, the same kind of allegation, and dates inside a set window. In the example, the window is 45 days, and the four reports about one distributor span August 9 to September 12: 34 days.

Choosing the window changes the count. Shorter windows split matters that unfold slowly. Longer ones can pull two separate matters together.

Two kinds of matching error, and how to score them

These are the measures DOJ names. It asks how a company is "measuring the accuracy, precision, or recall of any data analytics models it is using".1 A person should confirm any match below a set similarity, and every merge should be reversible and logged, because the audit trail matters as much as the count.

Writing about allegations, reporter identity and missing data in a board compliance report

In shortA committee report can damage people if it states an allegation as a fact, and it can expose a reporter if it says too much. It can also mislead by filling a gap with a guess. Three rules cover most of it: call an allegation an allegation, keep the reporter's identity in the hotline record, and write "none" or "not available" whenever that is what the data says.

That number is why wording matters. If 46 in 100 reports are substantiated at the median, then a typical report is less likely than not to be proved when it is written up. Its status in the report has to say so, and the sentence should change only when an investigation reaches a finding.

The example's Brazilian matter: 34 days and four channels, still an allegation

How to write it: phrases that hold up, and phrases that do not

Both rules shape what any shared analysis may see. Ask counsel how legal privilege applies to investigation material before it reaches a committee paper.

Common compliance reporting errors, and what ignored distributor red flags have cost device makers

In shortHand assembly invites a set of errors in a compliance report: double counting, stale data, figures nobody can trace. The more serious failure comes later, when a warning is logged and nobody connects it. Published cases show medical device makers paying for distributor conduct in Brazil, and one paying again because it kept using a distributor it knew about.

Eight errors in a hand-built compliance report

Medtech cases where distributor warnings went unheeded

The move from yearly snapshots to continuous compliance monitoring, and how far teams have come

In shortPayment data runs to millions of records, and US prosecutors now ask about analytics. Few teams call themselves advanced. We found no reliable public market size for compliance reporting software, so we show published volumes of payment data and reports.

DOJ's question about whether a risk assessment is a "snapshot" or based on "continuous access to operational data" points the way.1 So does its question about resources: is there "an imbalance between the technology and resources used by the company to identify and capture market opportunities" and those used to detect risk?1 A sales team with live dashboards and a compliance team with quarterly exports is the picture that question describes.

OIG makes the same point from the smaller end: even a spreadsheet can spot outliers, and larger entities "should run more sophisticated data analytics".4

AI in compliance risk reporting: what DOJ asks, which GxP rules do not reach it, and where a person must decide

In shortSoftware can read eight sources, suggest merges and draft sentences. The rule that matters most is that it must never produce a number on its own: every figure should come from a stored query. DOJ asks directly how you govern AI in your compliance program. FDA's AI draft, GxP and draft Annex 22 mostly do not reach this work, and we say why below.

A language model is good at drafting and poor at arithmetic it has not been given. In a report like this, the failure that matters is a plausible, well-written number that no system produced. The clean design separates the two jobs. A query fetches each figure, read-only. The writer only places the result in a sentence. A check then stops the draft if any number has no query behind it. An empty result stays empty, since a model that is asked to fill a blank will often fill it.

How compliance teams build the quarterly report today: who does what, and where nine days go

In shortIn the guide's example, a compliance analytics lead and two analysts assemble the report, with market leads, investigators and audit contributing and the CCO signing. Exporting, matching and explaining take most of the days in the example. Writing itself takes little. We found no survey of how many teams still assemble it by hand; the analytics figures in section 10 suggest many do.

Who touches a compliance risk report, from the chief compliance officer to internal audit

From data close to a signed report, step by step

Where the nine days go in a hand-built compliance report

Spreadsheets, managed services or software: four ways teams build the report

Q3 2026: Brazil's rise from 11.0 to 13.0, explained, traced and signed nine days before the committee meets

In shortThis is the example from the top of the page, inside the product. Six agents read eight sources, merge 121 reports into 83 issues and draft the report. Lena Ortiz, the chief compliance officer, reads the movement, opens the query behind a figure, re-runs it and signs. Nothing is estimated, and every allegation stays an allegation.

1

The home screen shows where risk moved, as lines

Lena's home screen opens on the movement. Each risk area is a line from Q2 to Q3 on the 1 to 25 residual scale, with the High band from 13.0 shaded. Distributors climb from 12 to 19 and public tenders from 10 to 15, both in red, while the other four stay flat. The narrative sits beside the lines, one sentence at a time.

The row of small tiles at the bottom switches to any of the 12 markets, or to all of them.

2

Closing the quarter: sources in, duplicates merged, lines moved

The nightly refresh loaded the eight sources on October 5 at 10:00 pm. On the morning of October 6, the Query agent runs 214 read-only queries, the De-duplication agent resolves 121 reports into 83 issues, and the Risk movement analyst works out what moved. The Narrative writer and the Figure check follow.

The run is visible at the top of the screen, step by step, so nobody has to take it on trust.

3

"7 of 19": the query behind the sentence, re-run

The writer explains the steepest move: 7 of 19 distributor due-diligence reviews were overdue at quarter end, against 1 of 19 in Q2, and the control is now rated Weak. Lena clicks 7 of 19. The query opens under the narrative: its source, 19 rows, and the time it ran. She presses Re-run, and it returns the same value.

Dana Okafor, the internal audit lead, can do the same, read-only.

4

No investigations closed, so the report says none

The last sentence for Brazil reads "Investigations closed in Brazil this quarter: None." Its query over the investigations case log returned 0 rows, and the screen labels it an empty result, reported.

Colombia's September monitoring feed was not received, so that figure is written as not available. Nothing is averaged, carried over or estimated, and that rule is locked in Settings.

5

121 reports, 83 distinct issues

Hotline, internal audit, monitoring and investigations sent 121 reports in Q3. Matched on party, place and kind of allegation within a 45-day window, they are 83 distinct issues: 38 duplicates merged, 31%. Six are under investigation, owned by Omar Haddad. In Brazil, 23 reports resolve to 14 issues.

6

One distributor, four channels, counted once

Issue ISS-BR-031 joins an anonymous hotline report, a monitoring alert for three credit notes totaling R$ 184,000, an audit finding of a 22% margin against 15%, and an open investigation. The match has a similarity of 0.94, and Rafael Souza, the market lead for Brazil, confirmed it on October 2.

The report's sentence calls it an allegation, and an investigation is open. The issue's working title on this screen is shorter and reads more firmly than that, so review how your own titles are worded. The agents see the allegation only, because the reporter's details stay with investigations.

7

Five sections for the Compliance Committee

The report is written in five sections: what moved the risk, which issues drove it, mitigation status, where to focus and data notes. In short: average residual risk across 12 markets moved from 8.8 to 8.9, it rose in 5 of 12, and Brazil is the only market rated High. Of 42 open mitigation plans, 6 are overdue.

The check on the right reads 32 of 32 figures traced to a live query, with 2 empty results reported as such.

8

The rest of the report: plans, focus and a data note

Brazil's 15% distributor margin cap (MP-BR-09) is 6 days late. Where to focus says that completing the renewals would take the area from 19 to 12, marked as a projection from the scoring rules. That projection assumes the control rating returns to Adequate. Your own reviewers should test the assumption, since the sample workshop record says the margin control also failed.

The data note says Colombia's figure is not available, and that nothing was estimated or carried over from August.

9

She signs, with the meaning of her signature

Lena approves with the meaning "I approve this report for the Compliance Committee" and her password. Her name, the date and time and the meaning are recorded with the report. Approval locks this version as 1.0, and any later change makes a new version.

The report goes to the committee nine days before the October 15 meeting.

The solution's design target is 36 minutes from data close to a drafted narrative, by hand about nine days. The sample dashboard shows those figures for its fictional quarters. Demonstrated at a global medtech manufacturer across three reporting periods. Measure your own.

The risk map, market analysis, issue list, dashboard and settings, screen by screen

In shortOne market is the story. These screens show the rest: the view across all 12 markets, the heatmap, five guided analyses for one market, the other risk areas in the issue list, the dashboard, and the settings that hold your own policy.

Select a screen to open it larger. The company, distributors, hospitals, people and figures are fictional. The queries, audit passages and scoring factors are the product's sample content, to be replaced with your own.

Six agents query, merge and draft; market leads confirm and the chief compliance officer signs

In shortEach agent has one job and limits it does not cross. They read the sources read-only, and none can change a score, an issue or a plan, approve anything or see who made a hotline report. People confirm the weak merges, review their own market and sign.

The six compliance reporting agents, and what each must never do

Who decides what in a compliance risk report: the four-eyes rule across five roles

The four-eyes rule means whoever drafts never approves: agents draft, people confirm and sign, and every query, merge and signature is on the activity trail, kept apart from people's actions. Every merge is reversible and logged. These are controls that support your own compliance program, and the regulatory and legal judgment stays yours. Botminds is SOC 2 Type II audited and manages information security to ISO 27001.

Lena, Maya, Rafael, Omar and Dana: the people in the screens

From eight compliance sources to a signed report: what the solution reads and writes

Systems a compliance reporting rollout connects to

The solution scales across markets, sources and quarters, inside the roles and access rules you set, with a full audit trail and export. For each system, ask whether it offers an API, a file feed or only screens, and who owns it.

What a hand-built compliance report costs you: analyst days, late warnings and figures you cannot defend

In shortThe hours are the smallest part. Three people for nine days comes to about $24,000 a report at an illustrative $110 an hour. The larger exposure is a warning that sat unconnected, or a number that fell apart when a director asked. Published penalties frame that exposure, and they say nothing about your own odds, so start from what you can measure.

Timing one quarterly report and tracing ten figures to find your baseline

The missed connection, the lost credit, and other costs a reporting calculator misses

What automating the quarterly report returns: analyst days, market lead hours and duplicate chasing against the tool's cost

In shortPut in your own numbers. Every default marked illustrative is an assumption to replace. On the defaults, hours alone cover a yearly cost of $100,000 from about six markets, by a modest margin, so the case rests on traceable figures and earlier connections. For a small program, a better spreadsheet and a written method may serve you well.

Analyst days, traceable figures, earlier links: where compliance reporting can pay back

Reports a year, people on the build and markets: your compliance reporting numbers

A company reporting 12 markets clears a $100,000 cost by about $24,000 on these defaults. A company reporting four markets once a year, with a clean register and one analyst, has little to gain from software, and a written method and a shared spreadsheet will serve it better.

How ready your compliance team is: markets, data keys, a written scoring method, traceable figures and sign-off

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

A low score means writing the scoring method before anything else

What to ask compliance reporting software about traced figures, merges, reporter identity and empty results

In shortAsk every vendor the same questions, us included. The answers show where each number comes from, how merges are tested, who sees what, and how you would measure the tool on your own past quarters.

We found no published independent test of any vendor's accuracy on compliance report drafting or hotline matching as of November 2026. A replay on your own past quarters is the fairest comparison, and it also measures your current process.

Replay two past quarters against your own hand count, then decide on four numbers

In shortWrite down your scoring method, count one market by hand, replay work you have already finished, and run one live quarter in parallel. None of these steps commits you to a vendor, and the method and the hand count improve your next report either way.

1. Trace ten figures and time one report, so you know how long a director's question takes today.
2. Write the scoring method on one page, with factors and thresholds, and have your committee approve it.
3. Match one market by hand for two past quarters: the reports, the issues and your reasons. This is your test set.
4. Replay those quarters, then run one live quarter in parallel, with your usual report still going to the committee.
5. Decide with four numbers: figures traced, merge precision, merge recall and wording errors, along with the hours saved.

Figures traced, merge precision and recall, wording: how to score a compliance reporting pilot

Compliance risk reporting questions answered: board reports, residual risk, hotline benchmarks, DOJ and AI

In shortQuestions compliance officers and buyers search for, each answered on its own.