A compliance survey your team can answer honestly
15 questions for the people who have to follow the rules: whether they can find them, follow them at the speed the work runs, and raise a concern without it costing them. Try it below, then open it in the editor.
- 15questions
- 6 minto complete
- 2 requiredthe rest skippable
- No scorecounts, not a grade
What a compliance survey asks, and what it must never ask
It measures the programme, not the people, and that settles most of the wording.
This is a survey you send to your own employees to find out whether your policies can be followed. It is not a vendor security questionnaire, a third-party due-diligence form, or a regulatory attestation. Those share the word compliance and nothing else.
It asks the people who live under the rules whether they can find the policy that applies to their job, whether it is written in language they can act on, who they ask before acting, and whether they know a route to raise a concern that does not run through their own manager. Each has an owner and a fix.
It is not an investigation, and the moment it behaves like one it stops working. So this template never asks whether you have reported something, seen something, or broken a rule. In a survey of more than 40,000 United States federal employees, 43 per cent of those who had made a disclosure said they were identified as the source of it, and 36 per cent said they had experienced a reprisal or the threat of one for reporting, a figure that had barely moved in the eighteen years since the same question was last asked.[2] Little is lost by leaving those questions out: questions 8 and 9 ask whether a person could raise something without it being held against them, and whether they believe anything would come of it. Everybody can answer both.
Three surveys sit close enough to be confused with this one. An internal control questionnaire asks a named control owner whether a control operated, so the answer becomes evidence. A company culture survey asks how the place feels to work in, which is wider and has no rulebook behind it. An employee feedback survey is a standing channel for anything.
The 15 employee compliance survey questions
Every question below is in the survey at the top of this page, in this order. Copy one group, copy all 15, or open the template and reword them.
Who is answering
Two classification items, both required, both first, both deliberately coarse. They are the cuts you read everything else by, and this is as fine as you can go and still publish a result without narrowing a group to one person.
- Which of these is closest to the kind of work you do?Broad work types, not departments. A named department of six is a name; "operations, production or field" is not.
- Do you manage people?Two levels, not a grade ladder. Managers and the people they manage answer questions 8 and 9 from different positions.
Knowing the rules
Three ratings about whether the rulebook is usable, asked before anything about behaviour, because somebody who cannot find a policy is not refusing to follow it. All are a 1 to 5 line with only the two ends labelled.
- I know where to find the rules that apply to my job.Finding, not knowing. A low answer sends you to where the policies live rather than to another training course.
- The rules that apply to my job are written in language I can follow.Asked separately from finding: a policy found and not understood needs a rewrite, not a better search box.
- The compliance training I did in the last year used situations I actually meet in my job.About the situations in the course, not about completion. Your learning system already knows who finished it.
Asking and raising
Four ratings, and the block that carries the page. Prosecutors evaluating a compliance programme are directed to ask whether the company tests "whether employees are aware of the hotline and feel comfortable using it" and how it assesses "employees' willingness to report misconduct".[1] These four ask that without asking anyone what they have personally done.
- I know who to go to first when I am unsure whether something is allowed.The everyday version. Most compliance questions get asked before anything happens, not after.
- I know at least one way to raise a concern that does not go through my own manager.A route past the line manager is what a reporting channel is for. This asks whether people know there is one.
- I could raise a concern about this without it being held against me.The retaliation item, worded as what the respondent believes could happen to them rather than what they have seen. Nobody describes an incident to answer it.
- If somebody here raised a concern, I believe it would be looked into.Written about "somebody here" rather than about you, so answering truthfully costs nothing. Knowing how to report and expecting nothing to happen is a follow-through problem.
Pressure and example
Two ratings and a frequency count about the conditions the rules have to survive: the gap between what is written down and what happens in a week with a deadline in it.
- When deadlines get tight in my area, the rules still get followed.The deadline item, and the one that shows whether a control is real or is the first thing dropped in a busy week.
- The managers I see day to day work the way they ask everyone else to work.About the managers a person actually sees rather than the board. It is the layer a programme owner can do something about.
- In the last 12 months, how often have you had to guess whether something was allowed?A count of how often somebody is left guessing. Keep these five options identical between runs.
Where it breaks, in your words
One diagnostic choice and two open boxes, last, because nothing substantive should sit behind a general comments box.
- Which of these makes it hardest to follow the rules in your job?Six named blockers and a "nothing makes it hard" option, so the answer is a diagnosis rather than a complaint. Each has a different owner.
- Describe one rule or process that is hard to follow in your job, and what makes it hard. Please do not name anyone.The box that explains the ratings. The instruction not to name anyone is inside the question, because free text is where a survey stops being anonymous.
- What one change would make it easier to do the right thing in your job?One change, in the respondent's own job. It closes the survey on something the reader can write down and do.
Only the first two questions are required. The eight ratings are a 1 to 5 line with the two ends labelled, which is the shape the editor builds; if the number of points is the argument you want settled first, it is set out under likert scale options. Nothing here is scored, and there is no grade at the end.
Three of those fifteen are rewrites, and the left column below is what this template used to ship. An item somebody can answer without exposing themselves comes back answered; published guidance on writing survey questions is the general version of the rule.[4]
| Instead of asking | Ask this |
|---|---|
| Have you ever reported a compliance concern or violation? | I could raise a concern about this without it being held against me. |
| How familiar are you with the company's compliance policies and procedures? | I know where to find the rules that apply to my job. |
| Was the compliance training effective? | The compliance training I did in the last year used situations I actually meet in my job. |
Reading what comes back
Fifteen answers are a conversation. Sixty are a map, drawn by cutting on the first two.
Count, do not score. For each rating, count how many people picked 4 or 5 and how many picked 1 or 2. There is no published norm for these fifteen items, so a single number out of a hundred would have nothing behind it. The comparisons that mean something are one item against another in your own results, and this run against your last.
Read question 13 first when a rating is low. The blocker question turns a low score into a category with an owner: cannot find the rule goes to whoever keeps the policy library, does not fit the work goes to whoever wrote it, not enough time goes to whoever set the deadline, and conflicting instructions goes to the two people giving them.
Put questions 8 and 9 side by side. Somebody who believes they could raise a concern but not that anything would come of it is describing a different failure from somebody who is afraid to speak at all. Cut both by question 2: managers and the people they manage sit on opposite sides of that answer.
Then decide whether the answer is training at all. A low answer on question 5 is about the content of a course rather than the amount of it, and a training needs survey settles that before anyone books a room. To find out what landed in a session you just ran, a training feedback survey is the shorter instrument. Then publish what you are changing and say when you will ask again: a survey run twice with nothing happening in between measures how patient people are.
What a survey link can and cannot protect
Say this plainly in the invitation. Overstating it is the fastest way to lose the answers.
An open survey link does not attach a name to a response, which is most of what people mean by anonymous. It is not the same as untraceable, and there are three ways a compliance survey stops protecting somebody.
Free text. A written answer can identify its author, from the incident it describes, the job it describes, or the way it is written. That is why the instruction not to name anyone sits inside question 14.
Small cuts. Two coarse classification questions are all this template collects, and even those become identifying if you slice them far enough. Set a floor before you look at anything and publish no group below it. A site, a shift or a job title makes that floor much harder to hold.
It is not a reporting channel. A survey has no case number, no acknowledgement and nobody on the other end, so a disclosure left in a comment box can sit unread for a fortnight. Confidential reporting mechanisms are a hallmark of a working programme,[1] which is why a survey should not be dressed up as one. Name the real route in the invitation and on the thank-you screen, and name the person who will read the survey itself. Disclosure to the people you are asking is part of published best practice for survey research,[5] and here it also decides whether the ratings mean anything.
Getting it sent
Five decisions this survey needs that a survey in general does not.
Name the rulebook in the title
Not "Compliance Survey". "Our code of conduct and expenses policy, October". People answer questions about rules they can picture, and the title is the line everybody reads.
Say what it is not, in the first three lines
That it is about the programme rather than individuals, that it is not the way to report something, and where the reporting route is. Put that link in the invitation, not just on the intranet.
Name who reads it
One line naming the person who opens the raw answers, and saying whether names travel with the results. Decide it once and keep to it.[5]
Remind the group, never the person
Send reminders to everybody invited, and do not work down a list of who has not answered yet. Chasing a named individual to complete a survey that asks whether they feel safe speaking up tells them the answers are traceable, whatever the invitation said.
Set the reporting floor before you send it
Decide the smallest group you will publish, and hold to it when somebody asks for their own team's numbers. Then build it in an online questionnaire creator, put your own policy names in, and send it.
Compliance survey FAQ
What is a compliance survey?
A short questionnaire asking employees whether they can find the rules that apply to their job, follow them at the speed the work runs, and raise a concern without it costing them. It measures the programme, not the people: no answer to it is evidence about an individual.
What are good employee compliance survey questions?
Ones a person can answer honestly without incriminating themselves or anybody else. "I know at least one way to raise a concern that does not go through my own manager" is answerable by everyone; "Have you ever reported a violation?" asks the respondent to identify as a reporter, on a link you cannot make anonymous.
Is this the same as a compliance questionnaire for suppliers?
No. A vendor or third-party compliance questionnaire is a due-diligence form sent to another company before you do business with it. This is an internal survey of your own employees. The two share a name and nothing else.
How many questions should a compliance survey have?
Enough to name a cause, few enough that people finish. This template ships 15. When an experiment varied the stated length of a web survey, fewer people started and completed the longer versions, and answers placed later were faster, shorter and more uniform.[3]
Should a compliance survey be anonymous?
Decide before you send it, say which it is in the first lines of the invitation, and keep to it. What matters to the person answering is who reads it, so name them. Either way a survey link cannot make a free-text answer unidentifiable, which is why the open boxes carry that warning in the question itself.
Can we use the answers for discipline?
No. Use it to fix the programme, and say so in the invitation. If somebody describes a specific incident in a comment box, do not investigate it from the survey: point them at the reporting channel you named, where a disclosure gets handled properly.
How often should we send it?
Once for a baseline, then again after you have changed something, on the same 15 questions with the same wording. One run is a snapshot; two are a comparison. Prosecutors assessing a programme are directed to consider whether it is stale, and some companies survey employees to gauge the compliance culture and evaluate the strength of controls.[1]
Compliance asks whether people know the rules and feel able to speak up. Environmental reporting is a separate duty with its own frameworks, and the environmental sustainability questionnaire covers what the organisation measures and publishes.
Rules travel outside the company too. Where the question is whether a carrier is meeting what was agreed rather than whether staff understood a policy, the logistics survey questions score the provider.
Methods and sources
What this template is based on
All 15 questions were written for this template. The asking and raising block follows the two things prosecutors evaluating a compliance programme are directed to look for: whether the company tests that employees are aware of the reporting mechanism and feel comfortable using it, and how it assesses their willingness to report.[1] Leaving out every self-incriminating item follows the identification and reprisal rates measured among federal employees who had made a disclosure.[2] Shipping 15 items rather than the twenty-eight the previous version proposed, and putting the open boxes last, follows a web-survey experiment in which the longer the stated length, the fewer respondents finished.[3] The rewrite pairs follow published guidance on writing survey questions,[4] and the invitation advice follows best practice for survey research.[5]
Question licensing
Nothing here is adapted from a published compliance or ethics instrument, and most of them could not be: the best known industry item banks are All rights reserved with licensing by request. Both sources used are United States federal works in the public domain, and neither is a staff questionnaire.
Limits and disclosure
The federal disclosure figures describe government employees rather than your organisation, so they are a reason for how this survey is built and not a prediction about what it will find; they are used because the same question wording was asked eighteen years apart. The length experiment used a general online sample. There is no published norm for these 15 items, so nothing is scored. A low answer locates a gap in the programme; it is not evidence about the person who gave it.
SuperSurvey makes the editor this template opens in; everything here works with or without it. Nothing on this page is legal advice.
References
- U.S. Department of Justice, Criminal Division. Evaluation of Corporate Compliance Programs (updated September 2024), sections II.D and III.A. justice.gov
- U.S. Merit Systems Protection Board. Blowing the Whistle: Barriers to Federal Employees Making Disclosures, 2011, pages 10 and 11. Merit Principles Survey, more than 40,000 federal employees in 2010, against more than 13,000 in 1992 on the same wording. mspb.gov
- Galesic M, Bosnjak M. Effects of questionnaire length on participation and indicators of response quality in a web survey. Public Opinion Quarterly, 73(2), 349-360, 2009. DOI 10.1093/poq/nfp031. academic.oup.com
- Pew Research Center. Writing survey questions. pewresearch.org
- American Association for Public Opinion Research. Best practices for survey research. aapor.org
Send the version people can answer honestly
15 questions, about 6 minutes, and not one of them asks somebody to incriminate themselves. Open it in the editor, put your own policy names in, and name whoever will read it.
Use this template