Skip to main content
Governance Authority
Category: Anti-Bribery and Corruption

Proportionate Procedures

Also known as: Proportionality Principle, Proportionate Controls
Simply put

Proportionate procedures are compliance and control measures that are scaled to match the actual risks an organization faces, so that the response is neither excessive nor inadequate relative to the threat. The underlying idea, drawn from the broader legal principle of proportionality, is that the means chosen should be balanced against the objective being pursued. In practice, a smaller or lower-risk organization would generally be expected to have simpler measures than a large or higher-risk one.

Formal definition

Proportionate procedures describe an approach in which the design and intensity of controls, policies, and safeguards are calibrated to the nature, scale, and complexity of an organization's activities and the assessed level of risk. The concept rests on the general legal principle of proportionality, under which the legality or appropriateness of an action is evaluated by the balance between the objective sought and the means and methods used to achieve it, and, in some contexts, by selecting the option least restrictive of protected interests. As applied within compliance frameworks, proportionality typically functions as a guiding principle rather than a fixed quantitative standard; the specific procedures that will be considered proportionate depend on facts, the applicable jurisdiction and regulatory regime, and the entity's own risk assessment and judgment. This entry describes the general concept and does not set out the requirements of any particular statute, code, or framework, several of which use proportionality differently. It is educational and not legal, audit, or compliance advice.

Why it matters

Proportionate procedures matter because compliance resources are finite and misallocation carries real consequences in both directions. Controls that are excessive relative to the risk waste resources, slow legitimate business activity, and can breed the kind of box-ticking culture that obscures rather than illuminates genuine exposures. Controls that are inadequate leave an organization vulnerable to the harms the procedures were meant to prevent. Calibrating the response to the assessed level of risk is how an organization tries to avoid both failure modes at once.

The principle also reflects a broader legal idea, drawn from proportionality in law more generally, that the means chosen should be balanced against the objective being pursued, and in some contexts should be the option least restrictive of protected interests. Because proportionality typically operates as a guiding principle rather than a fixed quantitative standard, it places weight on an organization's own risk assessment and judgment. What counts as proportionate for a small, lower-risk entity will generally differ from what is expected of a large or higher-risk one, and the same organization may need to revisit its judgment as its activities, scale, or risk profile change.

Because the concept depends on facts, jurisdiction, and the applicable regulatory regime, treating proportionality as a one-time or one-size-fits-all exercise is itself a source of risk. Several statutes, codes, and frameworks use the term differently, so the appropriate benchmark for what is proportionate must be located in the specific regime that applies to the entity rather than assumed.

Who it's relevant to

Chief Compliance Officers
Compliance leaders are typically responsible for designing and maintaining control frameworks that match the organization's assessed risks. Proportionality gives them a basis for scaling policies and safeguards up in higher-risk areas and keeping them simpler in lower-risk ones, and for documenting the judgment behind those choices. The specific procedures that will be considered proportionate depend on the applicable regime and the entity's own risk assessment.
Risk Officers and Risk Functions
Because proportionality is anchored in the assessed level of risk, the quality of the underlying risk assessment directly shapes what counts as a proportionate response. Risk functions generally provide the characterization of the nature, scale, and complexity of activities that compliance and management use to calibrate controls, and they help identify when a change in the organization's risk profile calls for a reassessment.
Boards and Committees
Boards and their committees typically hold oversight responsibility for whether management's approach to controls is reasonable given the organization's risk profile, rather than operating those controls themselves. Proportionality gives directors a lens for asking whether procedures are neither excessive nor inadequate relative to the risks, while recognizing that the specifics rest on management's judgment, the facts, and the applicable jurisdiction and regime.
General Counsel and Legal Advisers
Legal advisers engage with proportionality both as a general legal principle and as a term that several statutes, codes, and frameworks use differently. They are often called on to identify which regime applies, how that regime frames proportionality, and how the balance between objective and means should be documented, while noting that the analysis depends on facts and jurisdiction.
Internal Auditors and Assurance Providers
Assurance functions may be asked to evaluate whether an organization's procedures are proportionate to its assessed risks and whether the supporting rationale is documented and current. Because proportionality is a guiding principle rather than a fixed quantitative standard, such evaluations generally rest on judgment about the balance between risk and response rather than a single prescribed benchmark.

Inside Proportionate Procedures

Risk-Based Design
The principle that an organisation's procedures should be calibrated to the nature, scale, and complexity of the risks it actually faces, rather than applying a uniform or maximal control set regardless of exposure. In many anti-bribery and compliance frameworks, this is the foundation of proportionality: the extent and rigour of measures follow from a documented risk assessment.
Contextual Factors
Considerations that shape what is proportionate, typically including the size of the entity, the sectors and jurisdictions in which it operates, the nature and value of its transactions, its use of third-party intermediaries, and the maturity of its existing controls. What is proportionate for a large multinational generally differs from what is proportionate for a small enterprise.
Origin in Guidance
The concept is most closely associated with non-binding guidance issued under certain anti-bribery regimes, where 'proportionate procedures' is generally the first of several stated principles for an adequate or reasonable compliance programme. It is a principles-based standard rather than a prescriptive rulebook, and its specific application varies by jurisdiction and framework.
Documentation and Rationale
Because proportionality is a judgement rather than a fixed threshold, the reasoning behind why a given level of procedure was chosen is typically recorded, so that the organisation can demonstrate the link between assessed risk and the controls adopted.
Ownership and Accountability
Designing and implementing proportionate procedures is generally a management responsibility, operating within the risk appetite and oversight framework set by the board. The board or a relevant committee typically oversees whether the approach remains appropriate, while assurance functions may independently evaluate design and operating effectiveness.
Dynamic Review
Proportionality is not a one-time determination. As the risk profile, business model, or regulatory environment changes, procedures are typically reassessed and adjusted so they remain aligned with current exposure.

Common questions

Answers to the questions practitioners most commonly ask about Proportionate Procedures.

Does having proportionate procedures mean an organisation can simply do less about compliance?
No. Proportionality is not a licence to under-invest or to treat compliance as optional. The concept generally means calibrating the extent and rigour of procedures to the risks an organisation actually faces, taking account of factors such as its size, sector, geographic footprint, and the nature and complexity of its activities. A smaller entity with limited risk exposure may reasonably adopt lighter procedures than a large multinational, but a small entity operating in a high-risk market or sector may need robust measures. Proportionality is a matter of matching effort to risk, not minimising effort. This entry is educational and not legal or compliance advice; what is adequate in a given case depends on the facts and any applicable jurisdictional requirements.
Is 'proportionate procedures' a single legal standard that applies the same way everywhere?
No. Proportionality appears in various forms across different regimes and guidance, and its meaning and legal weight vary by jurisdiction, sector, and entity type. In some contexts it forms part of statutory or regulatory expectations, and in others it features in non-binding codes, frameworks, or best-practice guidance. Whether proportionality is a defence, an expectation, or simply a design principle depends on the specific regime in question. Organisations should identify the particular rules, guidance, or frameworks that apply to them rather than assume a universal standard exists. This entry describes the general concept and does not substitute for advice on any specific legal or regulatory requirement.
How should an organisation assess what level of procedure is proportionate to its risks?
The starting point is typically a documented risk assessment that identifies the relevant risks and evaluates their likelihood and potential impact. Procedures can then be calibrated to address the more significant risks with greater rigour, while lower-risk areas may warrant lighter measures. Relevant considerations often include the organisation's size and structure, the sectors and markets in which it operates, the nature of its transactions and relationships, and its use of intermediaries or third parties. Proportionality is an ongoing judgement rather than a one-time calculation, and the reasoning behind chosen measures is generally worth recording. The appropriate level of procedure ultimately depends on the facts and any applicable requirements, and professional judgement is usually needed.
Who within the organisation is responsible for designing and owning proportionate procedures?
Responsibility is typically distributed across roles. Management generally owns the design and operation of procedures as part of running the business, including embedding controls into day-to-day activities. A compliance function often supports the design, provides subject-matter input, and monitors whether procedures operate as intended. Internal audit or another assurance function may independently evaluate whether the procedures are adequate and effective, without owning them. The board and its relevant committees generally hold oversight responsibility, satisfying themselves that a proportionate approach is in place, rather than performing the operational work themselves. The precise allocation depends on the organisation's structure and any governance framework it follows.
How does an organisation demonstrate that its procedures are genuinely proportionate rather than merely present on paper?
Demonstrating proportionality generally involves showing a clear link between the risk assessment and the procedures adopted, together with evidence that the procedures operate in practice. It can help to distinguish control design from operating effectiveness: well-designed procedures that are not actually followed may not support a claim of adequacy. Documentation of the risk assessment, the rationale for chosen measures, training, monitoring outcomes, and periodic review generally supports the position. Assurance activity that tests whether controls operate as intended can provide independent evidence. What constitutes sufficient demonstration depends on the applicable regime and the facts, and this entry does not offer a definitive evidentiary standard.
How often should proportionate procedures be reviewed and updated?
There is generally no single prescribed frequency; the appropriate cadence depends on the organisation's risk profile and any applicable requirements or guidance. Many organisations review procedures on a periodic basis and also in response to trigger events, such as entering a new market, launching a new product, a significant change in the business or its third-party relationships, a regulatory development, or an incident or near miss. Because proportionality tracks the risks an organisation faces, a material change in those risks would typically prompt reassessment. The review approach itself should be proportionate, and the specifics remain a matter of judgement in light of the relevant facts and framework.

Common misconceptions

Proportionate procedures mean doing less, and therefore offer a way to reduce compliance effort.
Proportionality means matching effort to risk, not minimising it. For high-risk activities or sectors, proportionate procedures may require extensive and rigorous controls. In lower-risk settings they may justifiably be lighter. The standard is about calibration to assessed risk, not a licence to under-invest.
Proportionate procedures are a binding legal checklist that, once completed, guarantees a defence or safe harbour.
In many regimes the concept appears in non-binding guidance describing a principles-based expectation rather than a prescriptive rule. Whether a programme is adequate typically depends on the facts, the framework, and a professional's own judgement, and outcomes vary by jurisdiction. Entries here are educational and not legal or compliance advice.
A single proportionate design can be set once and applied uniformly across the organisation.
Proportionality is context-specific and dynamic. Different business units, jurisdictions, and third-party relationships may warrant different levels of procedure, and the appropriate level generally needs to be revisited as the risk profile and environment change.

Best practices

Ground the design of procedures in a documented risk assessment, so the level of control can be traced back to specific, identified risks rather than to a generic template.
Record the rationale for why a given level of procedure was judged proportionate, enabling the organisation to demonstrate the link between assessed risk and controls adopted.
Differentiate the intensity of procedures across business units, jurisdictions, sectors, and third-party relationships according to their respective risk exposure, rather than applying a uniform standard everywhere.
Clarify accountability by assigning design and implementation to management while ensuring the board or relevant committee oversees whether the overall approach remains appropriate.
Reassess proportionality periodically and on trigger events such as entering new markets, changing business models, or shifts in the regulatory environment, adjusting procedures as the risk profile evolves.
Consider independent evaluation of both control design and operating effectiveness through assurance functions, and confirm how the applicable framework or jurisdiction defines expectations before relying on any particular approach.