After compliance officers had sifted through the updated Department of Justice’s Evaluation of Corporate Compliance Program’s guidance, the most popular question we received was, “I understand that I need to have data, but where do I find it?”

In the DOJ’s new guidance (published earlier this month), an entire paragraph was added on data analytics and data analysis.  Specifically, the new guidance tells prosecutors to ask a company under investigation, “Do compliance and control personnel have sufficient direct or indirect access to relevant data sources of data to allow for timely and effective monitoring and/or testing of policies, controls and transactions?”  The requirement to obtain and analyze data isn’t just in the new guidance.  It’s become a theme at the DOJ.  Matt Kelly of Radical Compliance notes, “In several speeches over the last year or so, the Justice Department has talked about the importance of data analytics when looking for misconduct.” 

We know we need data, but where can we get it?  There may be more data available than first meets the eye.  Where do you start?  Consider the following ideas for data collection from the compliance, legal, HR, audit, finance, IT, and procurement departments. You can also download this handy checklist to help you find the data you need.   


The obvious place to start is with compliance-related systems.  Do you have any of the following?

For each program you have, call your vendor representative and ask about the data analytics that can be gathered from the system(s).  You may think you know everything about running reports, but software companies are continually updating the ability to parse data into usable information.  Ever since the original DOJ Guidance on evaluating compliance programs focused so intensely on proving the effectiveness of the compliance program, technology vendors have stepped up to develop advanced metrics within their software.  Find out everything you can from the systems you already have.

You can also obtain your own data using:

While compliance-related systems are a good place to start, other data will give you a much greater understanding of the state of the company.  You can begin your search for more data with the Legal Department.


Many Legal Departments have contract management software that will help you find information.  Some contract management software can do keyword searches.  Other software can separate contracts using tags for important terms, or by contract amount.  You may be able to find out the:

Ask the legal team for training on, and access to, the contract management system’s reporting function.  There will be a wealth of information at your fingertips.

Human Resources

In most companies, the Human Resources department houses a treasure trove of data.  Systems like PeopleSoft, Sage SMRS, ADP, and Workday have sophisticated reporting tools to help you gather information that can be used to improve the compliance program.  But even if your HR department only has paper data, you can still find great information.  This may include:

These types of statistics can give you a strong sense of how the company is managing people, and where compliance challenges may overlap with the greater employee management plan.


Audit’s function is to test and monitor controls.  Although Audit typically focuses on financial con
trols, many audit departments have implemented a review of compliance-related controls as well.  You may be able to find out the:

If you can, obtain permission to review audit reports as they are filed.  This will help you to identify trends that may affect compliance policies and help you to know where training would be useful.


Finance may have useful information, especially if your company doesn’t have a specialty procurement or supplier department.  You may be able to find out the:

Finance is the bottom line when it comes to money, and that includes reimbursements and invoice review.  Reviewing finance records can help you see monetary trends and spot anomalies that might indicate compliance-related issues.

Information Technology

A large part of the IT Department’s job is to collect, review, and maintain data.  You can leverage the data they have in many ways.  For instance, you can ask for:


Procurement is the gateway through which suppliers, vendors, and other third-parties pass before getting to the finance department.  It separates the wheat from the chaff.  It also has great statistics and data.  You may be able to find out:

The collection of data points will enable you to effectively review your program.  Perhaps more importantly, by engaging with the other functions, you will raise awareness of the compliance program.  You will also get a more holistic picture of the state of your culture and awareness of compliance controls. 

Professor and Author Chip Heath says, “Once we know something, we find it hard to imagine what it was like not to know it.”  By gathering and analyzing data from multiple areas of the business, you will not only please the prosecutors, but also make your program thrive.

Download our Handy Checklist of over 60 Data Points to collect HERE.