Data is one of the most powerful tools available to ethics and compliance (E&C) professionals, especially when it comes to meeting the U.S. Department of Justice’s (DOJ) expectations for effective compliance programs. DOJ emphasizes that organizations should actively use data to monitor program performance, identify emerging risks, and respond proactively to potential misconduct. By applying robust data analytics, E&C teams can move beyond reactive problem-solving and adopt a more predictive, prevention-focused approach. This shift not only strengthens program responsiveness but also demonstrates a clear commitment to continuous improvement. 

Types of data and core sources 

Most E&C programs already collect valuable information, whether intentionally or as a byproduct of ongoing operations. This data typically falls into two categories — qualitative and quantitative — and each offers unique insights. Used together, they create a more complete, nuanced picture of program effectiveness and organizational culture. 
 

Qualitative data 

Qualitative data is descriptive and less structured, capturing the context, opinions, and perceptions that explain the “why” or “how” behind observed behaviors or trends. While qualitative data cannot be measured numerically in its raw form, it can be analyzed for common themes, patterns, or sentiments and then translated into quantifiable measures. 

Quantitative data 

Quantitative data is structured, measurable, and inherently suited for statistical analysis. It can be tracked over time to identify trends, measure change, and evaluate program effectiveness. Because quantitative data offers clear, comparable benchmarks, it can reveal shifts in behavior, levels of engagement, and the impact of specific program initiatives. When combined with qualitative insights, these metrics allow for deeper analysis and more targeted action. 

The following table outlines common data sources within an E&C program, highlighting examples of both quantitative and qualitative metrics that can be captured. Together, these metrics provide a foundation for deeper analysis and actionable insights.

E&C Program Data Sources and Metrics 

 

Actionable insights by data source

While the above table highlights the types of data E&C programs can capture, the true value comes from interpreting these metrics and applying them in meaningful ways. By examining both the numbers and the underlying themes,organizations can uncover patterns, anticipate risks, and strengthen their compliance culture. 

Case management system (CMS) 

CMS data reveals much more than case volume. Trend analysis can identify emerging risks, shifts in reporting behavior, or increases in certain case types that align with new or updated policies or organizational events. For example, if a new conflict-of-interest resource is shared and related inquiries rise, it may suggest both healthy engagement and the need for clarification. Pairing CMS data with training or employee feedback validates whether spikes reflect awareness, confusion, or ethical cultural concerns. 

Training Data 

Training metrics provide insight into both compliance and engagement. Completion rates and timeliness show program reach, while assessment scores, knowledge retention scores, and elective participation rates reflect interest and understanding. Feedback from focus groups or surveys adds important context about clarity and relevance. When thoughtfully collected and analyzed, training data can serve as more than a measure of course completions; it can be a strategic lens into the overall maturity of compliance programs. Integrated with other sources such as CMS data and employee feedback, it can help evaluate policy understanding, risk identification, reporting and escalation behaviors, and engagement with compliance resources. This holistic view shows not only whether employees are meeting requirements but also where improvements are needed to strengthen effectiveness and reduce risk. 
The way training is administered also influences the type and quality of insights available. For instance, comparing data from annual cycles versus rolling, individualized due dates may reveal different patterns of engagement and knowledge retention. Working with subject matter experts helps refine content areas where pre- and post-test data show knowledge gaps, while collaboration with third-party platforms can expand reporting capabilities, offer benchmarking, or highlight emerging risks through aggregated industry data. 

Ambassador programs 

Ambassador activity demonstrates the reach of peer-to-peer compliance engagement. Tracking interactions, resource distribution, and employee participation highlights program impact, while ambassador feedback surfaces recurring questions or cultural nuances. These insights help refine resources, align messaging, and equip ambassadors to address common concerns effectively. 

Employee interactions and meetings 

Conversations across meetings, working groups, and casual interactions often reveal concerns not captured elsewhere. Documenting recurring themes can inform targeted policy updates, new resources, or adjustments in communication. Regular engagement with leaders adds further depth: discussing key risk areas, emerging trends, and challenges they observe, while also sharing back trends you’ve identified, creates a two-way exchange that builds trust, fosters collaboration, and ensures consistency in messaging and response. By combining employee-level insights with leadership perspectives, E&C teams can develop a more comprehensive, data-informed picture of organizational culture and risk. 
Insights from these conversations can also be translated into practical resources to further embed ethics into daily work. Creating toolkits, “meetings in a box,” case studies with discussion questions, or even interactive games can encourage teams to hold ethical conversations during regular meetings or events. Pairing these resources with incentives or recognition helps sustain engagement and normalizes ethical decision-making as part of everyday operations. 

Employee feedback 

Feedback mechanisms are among the most versatile ways to gain insight into culture and program effectiveness. Quantitative survey results provide benchmarks over time, while open-ended responses and focus group discussions capture the nuance behind employee attitudes and behaviors. These insights can reveal where employees are confident, where they lack clarity, and how program messages are resonating. When analyzed alongside data from training, CMS, and communication engagement, employee feedback becomes a powerful tool for shaping targeted interventions and reinforcing key messages. 

Engagement on communication channels 

Channel metrics reveal where employees are most likely to interact with E&C content. Identifying underutilized platforms ensures resources are placed effectively, while employee feedback confirms whether content is clear and useful. Combining both data types allows for optimization of communications and improved program reach. 

Site visits and observations 

In-person site visits offer a significant opportunity to observe ethical culture, ethics, and compliance in action and provide an evidence-based picture of effectiveness on the ground. Attendance and participation data can reflect overall engagement, while direct observation of processes, behaviors, and documentation can help identify gaps in compliance with company policies or external regulations (such as Occupational Safety and Health Administration safety standards or HIPAA requirements). These visits also allow E&C professionals to verify whether training is translating into practice, assess whether employees are following reporting procedures, and spot potential risks before they escalate. When combined with site-specific CMS data or employee feedback, site visits become a powerful diagnostic tool, helping tailor communications, target additional training, and strengthen controls where they are most needed. 

Ethics/compliance events 

Events such as onboarding orientations, Ethics Week, or leadership summits provide opportunities to measure engagement and gather feedback. Participation rates, combined with perceptions of value and relevance, inform how well events connect with employees. These insights help refine future planning and ensure events reinforce program priorities in meaningful ways. 

Timeline of E&C events and program changes 

Maintaining a timeline of program events provides substantial context for interpreting data trends. A spike in case inquiries, for example, may appear troubling until you connect it to the implementation of a new policy or resource that prompted crucial questions. Similarly, increases in training completions, hotline reports, or intranet traffic often align with Ethics Week, leadership briefings, or other enterprise initiatives. By documenting and analyzing the timing of these changes alongside core program metrics, E&C teams can separate true risk signals from awareness-driven activity. This approach also allows you to evaluate the effectiveness of specific initiatives, such as whether a policy update improved clarity or whether a campaign sparked sustained engagement, while ensuring leadership decisions are informed by both outcomes and context. 

Integrating data into enterprise risk management (ERM) 

One of the most essential actions E&C teams can take with program data is to feed it into the organization’s broader ERM process. DOJ emphasizes that compliance programs should continually assess risk, gather and analyze information, and update practices accordingly. Whether integrated into a formal ERM framework or managed through a more streamlined risk assessment process, incorporating E&C data ensures E&C risks are considered alongside other enterprise risks. The level of sophistication may vary, but the goal remains the same: using program insights to inform enterprise-level decisions and drive action. Leveraging program data for risk management is made possible by collaborating with cross-functional partners, who provide access, expertise, and context. 

[In-person site] visits also allow E&C professionals to verify whether training is translating into practice, assess whether employees are following reporting procedures, and spot potential risks before they escalate. 

Partners in data collection and utilization 

No E&C program can capture meaningful insights in isolation. To build a comprehensive, data-informed approach, it is imperative to collaborate with organizational partners who hold expertise, context, and access to critical data streams. These partnerships ensure that E&C professionals can access the right information and apply it effectively across the organization. 

Learning and development (L&D) can supply detailed training data, including assignment and completion dates, timeliness, and learner knowledge retention scores. Beyond the numbers, L&D professionals provide insight into how employees engage with training design elements. They can recommend techniques such as gamification, video or written scenarios, and audio narration to support diverse learning styles and increase engagement. Their expertise ensures training
data is not only collected but also contextualized to improve learning effectiveness.

Examples of connecting data points in E&C programs 

Privacy and security teams often maintain incident reports, simulation results, and records of data loss, breaches, or policy violations. These insights can reveal high-risk areas or recurring behaviors that training should target. At the same time, these partners ensure E&C data collection complies with privacy regulations and internal security protocols. In many organizations, security also tracks employee access to sensitive information, clearance statuses, and system permissions, which can be valuable data for identifying vulnerabilities and shaping tailored interventions. 

HR manages data streams that reveal patterns, gaps, and opportunities influencing ethical culture and regulatory adherence. This may include misconduct report trends, exit interview insights, and engagement survey results. Depending on the organization’s structure, HR may also track the assignment and completion of compliance training. These data sources highlight both cultural risks and operational gaps, helping E&C focus its efforts where they matter most. 

IT provides a technical lens on how employees interact with E&C resources, including metrics like click rates, resource downloads, intranet page views, and video watch times. IT teams, or data experts, in your organization may also assist with integrating these metrics into dashboards or analytics platforms, making it easier to monitor trends over time and connect them with other compliance datasets. 

Additional partners, such as a central data office, communications, legal, or platform- and content-specific subject matter experts, can add further depth. These groups may provide strategic, legal, or technical guidance to help identify risks and refine training, communications, and resources based on emerging insights. Senior leaders may also serve as key partners by validating patterns observed across data sources, helping interpret organizational context, and reinforcing compliance messaging at the leadership level. Their perspectives enhance data utilization by ensuring insights are applied in ways that align with business priorities and resonate across the enterprise. 

Combining and analyzing data 

Collecting data is only the first step. True value comes from analyzing it holistically. Bringing data together across sources allows E&C teams to identify patterns, benchmark over time, and compare performance across business units, departments, or geographies. Tools such as Excel, Tableau, and other visualization platforms can make these patterns easier to see. For organizations or individuals seeking to build stronger visualization skills, accessible courses through platforms such as Coursera can provide a helpful foundation. At the same time, AI tools are increasingly enhancing this process by transforming raw data into dynamic dashboards and visual graphs, making it easier to organize, interpret, and act on insights. 

Analysis should always be done in context. Individual data points can be misleading if viewed in isolation, while continuous collection and holistic interpretation provide a clearer view of evolving trends. Triangulating across different sources (such as CMS data, training metrics, and employee feedback) creates a more reliable picture of program effectiveness and risk. The figures on page 16 illustrate how connecting data points can uncover insights that would otherwise remain hidden. 

Another valuable tool for analysis is maintaining a timeline of key E&C events, such as policy updates, training launches, or compliance campaigns. Overlaying this timeline with program metrics helps distinguish between true risk signals and awareness-driven activity, while also providing a way to measure the impact of specific initiatives over time. Taken together, these practices reinforce the central message of this article: data is most powerful when used in context, interpreted holistically, and translated into meaningful action. This sets the stage for a truly dynamic and responsive compliance program, aligned with DOJ expectations and organizational needs. 

Conclusion 

Leveraging data is essential to building and sustaining a robust compliance program in alignment with DOJ expectations. The ongoing analysis of engagement patterns, training outcomes, and other data sources discussed in this article provides a foundation for measurable impact. When viewed holistically, these insights reveal trends in behavior, cultural attitudes, and risk awareness that fuel accountability, proactive risk management, and continuous learning. By adopting a data-driven approach, compliance programs remain dynamic and responsive, equipping organizations to make well-informed decisions that strengthen both ethical culture and business performance. 
 

Takeaways 

• Data enables ethics and compliance (E&C) teams to shift from reactive to proactive risk management. 
• Combining qualitative and quantitative data provides a fuller picture of organizational culture and program effectiveness. 
• Cross-functional collaboration is vital for collecting and contextualizing meaningful compliance data. 
• Integrating E&C data into enterprise risk management ensures ethics risks are considered in broader organizational decisions. 
• Data-driven compliance programs align with the U.S. Department of Justice’s expectations and support ethical culture and business performance. 

 

 

View all articles        Read the next article

 

Earn CEUs for this article. Log in with your username and password to take the quiz.