Skip to main content
Governance Authority
Category: Compliance Programs

Paper Program

Simply put

A paper program is a compliance, ethics, or risk program that exists on paper in the form of written policies and procedures but is not actually put into practice or enforced within the organization. The term is used critically to describe governance measures that appear adequate in documentation yet fail to function in day-to-day operations.

Formal definition

In governance and compliance usage, a 'paper program' refers to a compliance or ethics program whose formal documentation (codes, policies, procedures, controls) is not supported by effective implementation, monitoring, resourcing, or cultural embedding, such that control design may exist without demonstrable operating effectiveness. The concept typically arises when assessing whether a program is capable of preventing and detecting misconduct in practice, and accountability for genuine operationalization generally rests with management under board oversight. NOTE: The evidence packet provided does not contain sources addressing this governance/compliance meaning of 'paper program'; the supplied sources refer to unrelated subjects (design tools, graph paper, handwriting paper, sketching apps, and commercial paper). This definition is therefore based on the standard practitioner sense of the term and could not be corroborated by the evidence. This entry is educational and not legal, audit, or compliance advice; the significance of a 'paper program' finding depends on facts, jurisdiction, applicable frameworks, and professional judgment.

Why it matters

The label "paper program" captures one of the central failures in compliance and governance: the gap between what an organization has written down and what it actually does. A program that looks robust in a binder, complete with a code of conduct, policies, and control descriptions, provides little protection if those measures are not implemented, resourced, monitored, or reinforced through the organization's culture. In practical terms, this is the distinction between control design and operating effectiveness; a paper program may satisfy the former while failing entirely on the latter.

The finding matters because it typically drives conclusions about whether a program is genuinely capable of preventing and detecting misconduct. When regulators, courts, auditors, or internal assurance functions assess a program, they generally look beyond documentation to evidence of real-world functioning. A program characterized as "on paper only" can undermine an organization's credibility, complicate its position when addressing a compliance failure, and expose weaknesses that were masked by formally adequate paperwork. How much weight such a finding carries depends on the facts, the jurisdiction, and the frameworks that apply to the entity.

Because the term is used critically, it also serves as a warning signal within governance discussions, a shorthand for the risk that investment in policy drafting has not translated into behavioral change. Its significance in any given case rests on professional judgment rather than on the mere existence or absence of documents.

Who it's relevant to

Boards and their committees
Directors exercising oversight need to understand that adopting policies is not the same as running an effective program. The board's oversight role generally includes probing whether management has moved beyond documentation to demonstrable, functioning controls, rather than assuming that formal adequacy equals real-world effectiveness.
Chief compliance and risk officers
These leaders are typically responsible, under board oversight, for the genuine operationalization of compliance, ethics, and risk programs. The paper program concept underscores the need to support written measures with implementation, monitoring, resourcing, and cultural embedding so that the program can prevent and detect misconduct in practice.
Internal auditors and assurance functions
Assurance professionals assess whether a program's control design is matched by operating effectiveness. Identifying a paper program is central to this work, as it distinguishes controls that merely exist on paper from those that function reliably in day-to-day operations.
General counsel
Legal advisers evaluating an organization's exposure need to recognize when a program may be characterized as existing only on paper. Because the significance of such a finding depends on facts, jurisdiction, and applicable frameworks, general counsel play a role in interpreting what a genuine versus a paper program means for the organization's position.

Inside Paper Program

Documented Policies and Procedures
A paper program typically features a complete set of written policies, codes of conduct, and procedures that exist on paper but are not consistently implemented, communicated, or enforced in day-to-day operations.
Nominal Governance Structures
Formal committees, charters, reporting lines, and assigned responsibilities may be established on paper, yet the associated oversight, meetings, and decision-making do not occur meaningfully in practice.
Gap Between Design and Operating Effectiveness
The defining characteristic is a disconnect between control design (what the documentation prescribes) and operating effectiveness (whether controls actually function as intended). A paper program often has designed controls that are not operating.
Absence of Monitoring and Evidence
Little or no evidence exists that controls are performed, that training reaches personnel, that violations are detected and addressed, or that the program is periodically tested and updated based on results.
Weak Accountability and Ownership
Responsibility for executing and maintaining the program is unclear or unassigned in practice, so activities that management or assurance functions are nominally accountable for do not take place.

Common questions

Answers to the questions practitioners most commonly ask about Paper Program.

If our organization has written policies, procedures, and a code of conduct in place, does that mean we have an effective compliance program?
Not necessarily. Documented policies are a necessary foundation, but a program consisting only of written materials that are not operationalized is what is commonly called a 'paper program.' Effectiveness generally depends on whether those policies are implemented, communicated, understood, monitored, and enforced in practice. Regulators and courts in many jurisdictions tend to look past documentation to evidence of actual conduct, training completion, monitoring results, investigations, disciplinary action, and remediation. Written materials alone do not demonstrate that a program is working; they demonstrate only that it exists on paper. Whether any given program is effective depends on the facts and is ultimately a matter of professional judgment.
Doesn't having a well-documented program automatically reduce our legal or regulatory exposure?
Documentation by itself provides limited protection. In many enforcement regimes, authorities evaluate whether a program was genuinely implemented and effective at the relevant time, not merely whether policies existed. A program that looks robust on paper but is not embedded in operations may offer little mitigation and, in some circumstances, can suggest that the organization knew of a risk and failed to act on it. The degree to which a program influences exposure varies by jurisdiction, sector, framework, and the specific facts, and this entry is educational rather than legal or compliance advice. Assessing exposure in a particular matter is a question for qualified counsel and compliance professionals.
How can an organization tell whether its program is operating in practice rather than only on paper?
The distinction generally turns on evidence of operating effectiveness as opposed to design alone. Design refers to whether a policy or control is capable of addressing the intended risk; operating effectiveness refers to whether it functions consistently over time. Indicators typically examined include training participation and comprehension, use of reporting channels, timeliness and quality of investigations, monitoring and testing results, disciplinary consistency, and evidence of remediation when weaknesses are found. Assurance functions such as internal audit or independent testing may assess whether controls operate as designed. The specific indicators relevant to any organization depend on its risk profile, size, and sector.
Who within the organization is accountable for ensuring a program does not become a paper program?
Accountability is typically distributed across roles. Management, often including the chief compliance officer or equivalent within the second line, generally owns the design, implementation, and day-to-day operation of the program. The board or a designated committee generally holds oversight responsibility, satisfying itself that management has implemented the program and receiving reporting on its functioning; the board's role is oversight rather than operation. Assurance functions such as internal audit, operating in the third line, may independently evaluate whether the program operates effectively. The precise allocation of these responsibilities varies by entity type, governance structure, and applicable requirements.
What practical steps help move a program from documentation toward genuine implementation?
Common approaches include tailoring policies to the organization's actual risk profile rather than adopting generic templates, delivering role-specific training and testing comprehension, resourcing the compliance function appropriately, embedding controls into business processes and systems, monitoring and testing whether controls operate as intended, tracking and acting on issues raised through reporting channels, and applying discipline consistently. Periodic review and updating in response to changes in the business or its risk environment is also generally regarded as important. The appropriate steps depend on the organization's size, sector, resources, and risk exposure, and reflect professional judgment rather than a fixed checklist.
How might an organization document that its program is more than a paper program without creating documentation for its own sake?
The goal is generally to capture evidence that reflects actual activity rather than to generate additional static policies. This can include records of training delivery and completion, logs of reports received and investigations conducted, monitoring and testing results, minutes reflecting board and committee oversight discussions, and records of remediation and disciplinary outcomes. Such records tend to be valued because they evidence how the program functioned in practice. Organizations often weigh the usefulness of documentation against the risk of accumulating records that are never reviewed or acted upon, which can itself signal a program that exists mainly on paper. What is appropriate depends on the facts and applicable expectations in the relevant jurisdiction.

Common misconceptions

Having comprehensive written policies means an organization has an effective compliance or risk program.
Documentation reflects control design only. Effectiveness generally depends on whether controls operate as intended over time, are monitored, and produce evidence of performance. Regulators and assurance functions in many jurisdictions distinguish design from operating effectiveness, and a well-drafted policy that no one follows is characteristic of a paper program.
A paper program is primarily a documentation problem the compliance function can fix by improving the wording.
The core issue is typically execution, culture, and accountability rather than drafting. Remediation generally requires management ownership of operating the controls, board or committee oversight of whether the program functions, and assurance testing, responsibilities that sit with different functions and cannot be resolved by rewriting documents alone.
Any program that passes a documentation review is not a paper program.
A review of documents alone assesses design, not whether controls operate. A program can present complete, well-structured documentation while failing in practice; identifying a paper program generally requires testing operating effectiveness and gathering evidence of actual performance, which depends on the facts and the reviewer's judgment.

Best practices

Test operating effectiveness, not just design, gather evidence that controls, training, and monitoring activities actually occur rather than relying on the existence of written policies.
Assign and confirm clear ownership so management is accountable for executing controls, assurance functions independently test them, and the board or relevant committee oversees whether the program functions in practice.
Require documented evidence of performance (completed reviews, attendance records, escalation and remediation logs) so that activities can be substantiated rather than presumed.
Establish periodic monitoring and reporting that surfaces gaps between what documents prescribe and what happens operationally, and route findings to the appropriate oversight body.
Update policies and procedures based on actual operating results and identified failures, treating documentation as a living reflection of practice rather than a static artifact.
Engage the board or its committees to probe evidence of execution and effectiveness, not merely the presence of documentation, when assessing program health, recognizing that appropriate assurance and oversight roles vary by entity type, sector, and jurisdiction.