Leonid Group's Claudia Custura recently joined Murray Grainger for Case IQ's first UK and EU Masterclass: The Times, Are They a'Changing? Compliance officer reporting lines and retaliation.

Murray set out the legal picture and market practice on where compliance should sit. Claudia brought the view from recruitment: what compliance professionals see when they move between organisations, and what those organisations reveal about how much they value the function.

The session drew on new research from Compliance Week with Case IQ and Radical Compliance (June 2026, 328 compliance professionals worldwide). Its headline findings were stark: 70% of respondents said they had suffered retaliation for raising concerns, 36% are afraid to raise serious concerns at work today, and 53.6% of reported retaliation drew no investigation or action at all.

The audience questions at the end went straight to the practical issues. Below, we answer three of them.

Q1. What should candidates ask at interview to understand how valued compliance really is?

Ask questions that test practice, not policy. Almost every organisation will say compliance has "a seat at the table". The useful questions are the ones that make interviewers describe what actually happens, with examples.

Reporting lines and access

Who does this role report to, and is there a direct or dotted line to the board or audit committee?
How often does the head of compliance meet the audit or risk committee chair without management in the room?
When did compliance last escalate something to the board, and what happened next?

Influence and resources

Can you give an example of a business decision that changed because of compliance input?
How is the compliance budget set, and who can cut it?
Is compliance involved in new products, markets and deals at the design stage, or asked to sign off at the end?

Speaking up and protection

How did the organisation respond the last time someone raised a serious concern internally?
Who sets the compliance officer's objectives, pay and bonus, and who could remove them from the role?
Why did the previous person in this role leave?

From a recruitment perspective, it’s how the questions are approached – rather than the content itself – which really counts. Specific, consistent answers from the hiring manager, HR and a board member are a good sign. Vague answers, visible discomfort, or different stories from different interviewers are red flags. Where possible, ask to meet the audit committee chair as part of the process. For senior roles, a willingness to arrange that meeting is itself sends a positive signal.

Q2. How can compliance build a business case for changing reporting lines to give more direct board access?

Frame it as risk management for the board, not about raising the status of compliance.

The strongest case shows directors that a direct line protects them: it gives them unfiltered information, and it is increasingly what regulators and prosecutors look for when deciding how to treat an organisation that gets things wrong.

Anchor it in external expectations. The webinar highlighted a clear direction of travel, particularly in the US:

US HHS-OIG guidance (2023) states that the compliance officer should not lead or report to legal or finance, and should report directly to the CEO or board.
The US DOJ's Evaluation of Corporate Compliance Programs asks prosecutors to probe compliance's autonomy, stature and direct access to the board.
Amendment 824 to Chapter 8 of the US Federal Sentencing Guidelines (effective November 2023) means an organisation can still earn compliance-programme credit when a senior executive is implicated. One of the four conditions is that those running compliance report directly to the governing authority or a sub-group such as the audit committee.

For UK and European organisations, these are useful reference points rather than direct obligations, unless they have US exposure. Map them against your own sector's regulatory expectations and supervisory feedback before presenting them.

Show the cost of the current structure. Point to specific instances where information reached the board late, was softened along the way, or where compliance faced a conflict because its line manager owned the activity under review. Keep it factual and anonymised where needed.

Use the retaliation data carefully. In the June 2026 survey, 58% of respondents first raised their concern with their manager, and 23.6% said that manager led the retaliation. That is a structural point about reporting lines, not a criticism of any individual, and it can be presented that way.

Propose a proportionate model. A full change of line may not be needed at first. Options include a formal dotted line to the audit or risk committee chair, regular private sessions without management present, a guaranteed right of escalation in a crisis, and committee involvement in the compliance officer's appointment, objectives, pay and removal.

Find a sponsor. The report recommends starting the conversation with the audit or risk committee chair. A non-executive who already cares about the issue is far more persuasive to the board than compliance arguing its own case.

Q3. Why are whistleblowing policies failing to protect so many compliance professionals from retaliation?

Most whistleblowing policies were designed for employees reporting to compliance, not for compliance reporting on the organisation. That gap shows up in several ways.

Raising concerns is the job. When a compliance officer flags a problem, it is often treated as routine work rather than a protected disclosure. Their concerns then flow through the normal management line, outside the confidential channels and safeguards the policy provides.

The person who receives the concern may be the problem. Whistleblowing frameworks usually route reports to compliance, legal or HR. When the concern involves those functions, or the compliance officer's own manager, there is often no independent route. The survey's manager paradox makes the point: 58% first raised the concern with their manager, and 23.6% said that manager led the retaliation.

Retaliation is mostly quiet. The most common forms reported were exclusion from usual meetings (63.8%), being bad-mouthed by colleagues (59.4%) and unwanted changes to role or responsibilities (48.7%). These are hard to document and easy to explain away, so they rarely meet a policy's threshold for action. Firings (28%) and lost bonuses or pay rises (30.6%) often come later.

Reports are not followed through. Of those who reported retaliation, 53.6% saw no investigation or action, 21% saw an investigation with no outcome, and only 4% saw corrective action against those responsible. A policy that is not enforced offers no deterrent, and 31% of respondents do not believe their employer takes retaliation against compliance officers seriously.

External routes are rarely used. 83% never considered going to a regulator or law enforcement. In practice, this leaves internal processes as the only safeguard.

The report treats this as a governance issue that ultimately sits with the board. Practical fixes include an escalation route for compliance that bypasses management, board oversight of any adverse action against the compliance officer, and contractual protections agreed at the point of hire. The report also notes wider ideas under discussion, such as fixed terms removable only for cause (as India requires for banking-sector compliance officers) and mandatory disclosure of compliance officer departures.

One caveat: the survey was self-selected, with 71% of respondents in North America and 17% in Europe, so it may over-represent those who have experienced retaliation. The direction of the findings is still hard to ignore.

Independence in practice

The three questions share one thread: independence has to be real, not cosmetic. Candidates can test it at interview, compliance leaders can make the case for it to the board, and boards can make sure the people who protect whistleblowers are protected themselves. As the report puts it: if compliance officers cannot safely raise concerns, how can the board expect anyone else to?

Leonid Group works with organisations hiring into ethics, compliance, governance and investigations roles, and with professionals assessing their next move. If you would like to discuss how reporting lines and independence shape senior compliance hiring, contact Claudia Custura at claudia@leonid-group.com.

Thanks to Murray Grainger and the Case IQ team for hosting. Case IQ's research reports are available at caseiq.com/resources/research-reports.