Skip to main content
Policy Authority
Category: Ethics and Culture

Integrated Compliance and Ethics Framework

Simply put

The Integrated Compliance and Ethics Framework is an openly available reference standard, published by OCEG, that brings together the disciplines involved in helping an organization act lawfully and ethically. It is intended to give compliance and ethics professionals a common, interdisciplinary approach rather than treating areas such as compliance, ethics, business conduct, and internal controls as separate silos.

Formal definition

The Integrated Compliance and Ethics Framework is described by OCEG as an open-source, interdisciplinary standard for compliance and ethics professionals, drawing on principles and practices from disciplines including compliance, ethics, internal controls, business conduct, and regulatory activities. It is positioned within a broader governance, risk, and compliance (GRC) context and forms the basis for OCEG's Integrated Compliance & Ethics Professional (ICEP) body of knowledge. As a voluntary reference framework rather than a law or a certification standard tied to a specific regulator, its adoption and application vary by organization; the evidence available here does not specify particular clauses, version details, control requirements, or implementation and tooling specifics, which fall outside the scope of this entry.

Why it matters

Compliance and ethics responsibilities are frequently distributed across multiple functions, regulatory affairs, internal controls, business conduct, ethics offices, and legal, that may operate with different vocabularies, tools, and reporting lines. When these areas are managed as separate silos, organizations can face gaps, duplicated effort, and inconsistent handling of similar issues. The Integrated Compliance and Ethics Framework matters because it offers a common, interdisciplinary reference intended to draw these disciplines together, helping professionals coordinate rather than work in isolation.

As an openly available reference standard published by OCEG, the framework is positioned to support a shared professional approach rather than a proprietary or single-vendor method. This can be valuable for organizations seeking to align their compliance and ethics activities with recognized practices and to give practitioners a common body of knowledge. It is worth emphasizing that the framework is voluntary; it is not a law and is not a certification standard tied to a specific regulator, so its influence depends on how individual organizations choose to adopt and apply it.

Because the framework is interdisciplinary and reference-based, its practical value lies in coordination and shared language rather than in prescribing specific controls or guaranteeing outcomes. The evidence available here does not specify particular clauses, control requirements, or implementation details, and adoption varies by organization, jurisdiction, and sector. Practitioners should therefore treat it as a structuring reference to be tailored to their own regulatory context rather than a universal mandate.

Who it's relevant to

Compliance and ethics professionals
Practitioners responsible for lawful and ethical conduct across an organization may use the framework as a common, interdisciplinary reference to align their work rather than treating compliance, ethics, and business conduct as separate silos. It underpins the ICEP body of knowledge that describes the knowledge used by GRC professionals delivering compliance and ethics activities.
Governance, risk, and compliance (GRC) practitioners
Because the framework is positioned within a broader GRC context, GRC professionals may find it useful for connecting compliance and ethics activities with related governance and risk work. Its coordinating role is reference-based; it does not prescribe specific controls or replace an organization's own risk and control processes.
Internal controls and regulatory affairs teams
Functions that manage internal controls, regulatory activities, and business conduct may draw on the framework to establish shared language and a coordinated approach across these areas. Adoption is voluntary and should be tailored to the applicable jurisdiction, industry, and organizational context.
Compliance and ethics program leaders
Those designing or leading a compliance and ethics program may reference the framework to structure an integrated, interdisciplinary approach. As a voluntary standard rather than a regulatory requirement, it informs program design but does not, on its own, guarantee compliance outcomes or satisfy any specific legal obligation.

Inside Integrated Compliance and Ethics Framework

Program Governance and Oversight
The structures, roles, and decision rights that direct the compliance and ethics program, commonly including board or board-committee oversight and a designated compliance and ethics function. This element concerns the governance pillar, who is accountable for the program and how oversight is exercised, rather than the day-to-day execution of controls.
Codes of Conduct and Policies
The documented statements of expected behavior and organizational commitments. In many frameworks a policy sets the overarching intent, a standard specifies required attributes, and a procedure describes the steps to comply; an integrated framework typically aligns these so that ethics commitments and regulatory obligations are addressed within a coherent policy hierarchy.
Risk Assessment
The identification, assessment, and prioritization of compliance and ethics risks against the organization's objectives and obligations. This draws on the risk management pillar and is commonly used to focus program resources on higher-risk areas; the specific methodology and rating scales vary by organization.
Controls and Preventive Measures
The activities designed to reduce the likelihood or impact of compliance and ethics failures, distinct from the control objectives they are intended to achieve. These may span policy controls, training, approvals, and monitoring, and should be distinguished from independent assurance over their operation.
Training and Communication
Efforts to build awareness of expected conduct and applicable obligations across the workforce. Content and frequency commonly depend on role, risk exposure, and jurisdiction rather than being uniform across an organization.
Reporting and Speak-Up Mechanisms
Channels through which concerns can be raised, including whistleblowing arrangements, and processes for handling reports. The availability and legal protections associated with such mechanisms differ across jurisdictions and sectors.
Monitoring, Investigation, and Response
Ongoing monitoring of the program, investigation of alleged violations, and corrective or disciplinary action. Monitoring performed by management (a management activity) should be distinguished from independent assurance over the program (an assurance activity).
Continuous Improvement
Mechanisms to evaluate the program's design and operation over time and to update it in response to findings, changes in obligations, or emerging risks. This reflects the iterative nature described in many governance and compliance management standards.

Common questions

Answers to the questions practitioners most commonly ask about Integrated Compliance and Ethics Framework.

Is an integrated compliance and ethics framework the same as a compliance program with a code of conduct attached?
No. An integrated compliance and ethics framework is broader than a compliance program that appends a code of conduct. A compliance program typically focuses on adherence to applicable laws, regulations, and internal policies, while the ethics dimension addresses organizational values, culture, and expected conduct beyond the minimum legal baseline. Integrating them means aligning these elements so that ethical expectations inform how compliance obligations are interpreted and applied, rather than treating ethics as a supplementary document. The degree of integration and its structure commonly vary by jurisdiction, sector, and organization size.
Does implementing this framework guarantee that misconduct will not occur?
No framework can guarantee the prevention of misconduct. An integrated compliance and ethics framework is designed to reduce the likelihood and impact of misconduct through structures, expectations, and controls, but residual risk typically remains. Framing such a framework as a guarantee misrepresents its purpose; it is a risk-management and governance construct intended to support, not assure, ethical and compliant behavior. Its effectiveness depends on factors such as culture, leadership, resourcing, and consistent application, which vary across organizations.
How should responsibilities for the framework be assigned across the organization?
Responsibilities are commonly allocated using a model such as the IIA's three lines model. Operational management (first line) typically owns and applies the day-to-day controls and expected conduct; compliance and ethics functions (second line) commonly set policy, provide guidance, and monitor; and internal audit (third line) may provide independent assurance over the framework's design and operation. It is important to keep management activities distinct from independent assurance, and to avoid assigning assurance functions ownership of the controls they later evaluate. Specific allocations vary by organization size, structure, and sector.
How can an organization assess whether the framework is operating effectively?
Assessment commonly combines monitoring by the second line with independent assurance from the third line. Indicators may include the design adequacy and operating effectiveness of controls, evidence of the framework being applied consistently, and outcomes such as reporting and case-handling patterns. Because ethics and culture are difficult to measure directly, organizations often use a mix of qualitative and quantitative inputs. Any specific metrics should be treated as context-dependent rather than universal, and assessment approaches vary by jurisdiction and industry expectations.
What is the relationship between the framework's policies, standards, and procedures?
These are distinct instruments that are commonly layered. A policy typically states high-level expectations and intent; a standard specifies more detailed, often measurable requirements that support a policy; and a procedure describes the steps for carrying out an activity in line with the applicable policy and standards. Within an integrated framework, these documents are commonly aligned so that ethical expectations and compliance obligations flow consistently from principle to practice. Conflating them can create gaps or ambiguity in how expectations are implemented.
How does the framework typically connect to the organization's broader governance and risk management activities?
An integrated compliance and ethics framework commonly connects to governance through decision rights, oversight roles, and reporting lines, and to risk management through the identification, assessment, and treatment of compliance and conduct risks against objectives. In many organizations it is aligned with enterprise risk management so that compliance and ethics risks are considered alongside other risk categories rather than in isolation. The specific integration points depend on the organization's structure, applicable frameworks, and jurisdictional context. This entry does not address implementation specifics, tooling, or legal advice.

Common misconceptions

An integrated compliance and ethics framework is essentially the same as a compliance program focused on rule-following.
Compliance concerns adherence to external laws, regulations, and internal policies, whereas ethics concerns conduct and values that may extend beyond what is legally required. An integrated framework seeks to align both, and treating them as identical can leave conduct risks unaddressed even where formal rules are met.
Having the framework in place, with monitoring by the compliance function, provides independent assurance that it is effective.
Management-led monitoring is a management activity, not independent assurance. Objective evaluation of the framework typically involves a function independent of the activities being reviewed, such as internal audit; conflating the two undermines the independence and objectivity that assurance is intended to provide.
A single integrated framework can be adopted uniformly across all locations and business units.
Many compliance and ethics obligations depend on jurisdiction, industry, and organization size. An integrated framework commonly provides a consistent structure while allowing for differences in applicable requirements, protections, and practices across jurisdictions and sectors.

Best practices

Clearly define governance roles and decision rights for the program, including board or committee oversight and an accountable compliance and ethics function, and distinguish these from operational execution.
Use a documented risk assessment to prioritize compliance and ethics risks against organizational objectives, and direct program resources toward higher-risk areas rather than applying uniform effort.
Maintain a coherent policy hierarchy that distinguishes policies, standards, and procedures, and align ethics commitments with applicable regulatory obligations.
Preserve the independence of assurance activities by separating management's monitoring of the program from objective evaluation performed by a function such as internal audit.
Tailor training, communication, and reporting mechanisms to role, risk exposure, and jurisdiction, and confirm that speak-up channels reflect applicable legal protections in each relevant location.
Establish continuous-improvement mechanisms to review the framework's design and operation and to update it in response to findings, changes in obligations, and emerging risks.
Promotional banner for the Pentest Readiness checklist download