30-60-90 day plan for compliance officers
On this page
A compliance officer inherits obligations that existed before they arrived: open hotline reports, investigations half finished, policies past their review date, training that lapsed, audit findings with promised fixes and a board or committee expecting a report. They also inherit a culture, which decides whether employees report concerns or keep quiet. A new officer who rewrites the code of conduct in month one while an investigation stalls has the order wrong. A 30-60-90 day plan for compliance officers should keep open matters moving, map the obligations and risks with the business, and finish with a work plan the board or committee approves.
This plan is for the CEO, general counsel or audit committee chair hiring a compliance officer or chief compliance officer in a regulated company, such as healthcare, financial services or a government contractor. Analyst-level hiring is covered in the compliance analyst screening questions. The general structure is in the 30-60-90 day plan template for new hires.
The frameworks to review against
Industry rules differ, but most compliance programs in the United States are judged against the same few federal sources. As of October 2026:
- Sentencing Guidelines. Section 8B2.1 of the U.S. Sentencing Guidelines sets the minimum elements of an effective compliance and ethics program, including oversight by the governing authority, specific high-level personnel with overall responsibility, people with day-to-day responsibility who have adequate resources, appropriate authority and direct access to the governing authority, training, monitoring and auditing, a reporting system that allows anonymous or confidential reports without fear of retaliation, and periodic risk assessment.
- DOJ evaluation guidance. The Criminal Division's Evaluation of Corporate Compliance Programs, updated September 2024, asks whether a program is well designed, whether it is adequately resourced and empowered to function effectively, and whether it works in practice. It states that it is neither a checklist nor a formula.
- Healthcare. HHS OIG's General Compliance Program Guidance summarizes the federal fraud and abuse laws and describes the seven elements of a compliance program infrastructure for healthcare organizations.
Banking, securities, privacy, export control and government contracting each add their own regulators and requirements. Use the frameworks above as the outline for the first review, and confirm industry rules with counsel. This is not legal advice.
The 30-60-90 day plan
30-60-90 day plan — [Name], Compliance Officer, [company]
Reports to: [CEO / general counsel] Committee: [audit / compliance]
Start: [date] Industry rules: [list main regulators]
Team: [N] analysts / investigators Hotline: [vendor]
DAYS 1-30 — Keep matters moving and map the program
Goals:
- Review every open hotline report and investigation;
confirm an owner and next step for each
- Read the last risk assessment, audit reports,
regulator correspondence and committee minutes
- Build an obligations inventory: laws, regulators,
licenses, filings and their due dates
- Inventory policies with owners and review dates
- Meet the leaders of the highest-risk functions
Deliverables by day 30:
- Open case list with owners and dates
- Obligations calendar and policy gap list
- Written first impressions for [reporting line]
Check-in: day 30
DAYS 31-60 — Refresh the risk assessment
Goals:
- Run risk interviews with business leaders
- Rank risks by likelihood and impact with the business
- Assign overdue policies and training with dates
- Set an investigation protocol: intake, triage,
timelines, documentation and closure
Deliverables by day 60:
- Refreshed risk assessment
- Investigation protocol in use
Check-in: day 60
DAYS 61-90 — Plan and report
Goals:
- Build a compliance work plan tied to the top risks:
audits, monitoring, training and policy work
- Present it to the board or committee
- Agree reporting measures for each meeting
Deliverables by day 90:
- Approved work plan and budget request
- First committee report with agreed measures
Check-in: day 90 — full reviewWhat to measure
Compliance measures should show whether the program works, not reward low case counts, which can mean people have stopped reporting. The standards below are examples only.
| Measure | Why it matters | Example standard (example only) |
|---|---|---|
| Open cases by age | Stale cases signal a weak response | Every case owned with a next step and date |
| Reports by channel and topic | Shows whether employees use the system | Tracked, not targeted |
| Policies past their review date | Outdated rules are hard to enforce | Each one assigned and dated |
| Required training completion | Required by many rules and frameworks | Overdue staff followed up by their managers |
| Audit and regulator findings closed | Repeat findings draw harder scrutiny | Closed with evidence, not just marked complete |
A filled example
Compliance officer: Renee Bishop (invented), previously a compliance manager at a hospital system, joining a multi-site physician group as its first full-time compliance officer.
Day 30: Found eleven open hotline reports, four with no activity in two months, and a billing audit finding from the prior year with no record of the promised corrective action. Monthly exclusion screening of new vendors had stopped when the previous coordinator left.
Day 60: Assigned every case and closed six with documented findings. Restarted exclusion screening and checked the vendors added during the gap. Risk interviews ranked coding accuracy and physician referral arrangements highest.
Day 90: The compliance committee approved a work plan with a coding audit, a review of referral arrangements with outside counsel and refreshed training. The first committee report showed cases by age and topic.
What "on track" looks like
| Checkpoint | On track | Worth a direct conversation |
|---|---|---|
| Day 30 | Every open case owned; obligations mapped | Cases untouched while policies are rewritten |
| Day 60 | Risk assessment built with the business; protocol in use | Risk assessment written without business input |
| Day 90 | Work plan approved; measures agreed | No access to the board or committee |
Independence and access
The Sentencing Guidelines expect the people running the program to have adequate resources, appropriate authority and direct access to the governing authority. Settle in the offer stage how the new officer reports to the board or committee, whether they can meet it without management present, and who can approve or block an investigation. A compliance officer who learns in month two that every report must go through the business leader under review cannot do the job. The internal auditor screening questions cover a partner function whose independence questions are similar.
The first report to the board or committee
The day-90 report sets the pattern for every report after it, so keep it plain. It should state the top risks from the refreshed assessment and who owns each, open cases by age and topic without identifying reporters, audit and regulator findings with their status, training and policy gaps with dates, and the work plan with the resources it needs. Say what the officer has not yet been able to review. A board that hears about gaps early can fund the fix; one that hears about them after a regulator does will ask why it was not told. Agree the format with the committee chair before the meeting, and use the same measures at every meeting so trends are visible.
What the company owes the new officer
- A clear reporting line and committee access, agreed before the start date.
- Access to records: hotline data, audit reports, contracts and regulator correspondence.
- Budget for outside counsel or auditors when a matter needs them.
- Leaders' time for risk interviews in the second month.
Common mistakes
| Mistake | Result | Fix |
|---|---|---|
| Starting with a new code of conduct | Open matters stall | Open cases first, documents later |
| A risk assessment written alone | The business does not own the risks | Interviews and ranking with leaders |
| Targeting fewer hotline reports | Concerns go unreported | Track reports by channel and topic instead |
| Closing findings without evidence | Repeat findings later | Evidence of the fix in every closure |
Adapting the plan
- Financial services: add the anti-money laundering program, regulatory exam findings and filing calendars.
- Healthcare: use the OIG elements as the outline and add coding audits, exclusion screening and referral arrangements.
- Smaller companies: combine the risk assessment and work plan, and focus on the few rules that carry the most exposure.
Finance controls overlap with compliance monitoring; the 30-60-90 day plan for controllers shows how a new controller maps segregation of duties, and the 30-60-90 day plan for HR managers covers employee relations cases that often arrive through the same hotline.
Questions people ask
What should a new compliance officer do first?
Read the last risk assessment, the open hotline and investigation cases, recent audit and regulator findings, the policy inventory with review dates and the last board or committee compliance report. Then meet the leaders who own the biggest risks. Open cases come first, because an investigation that stalls during a handover is the hardest problem to recover from.
What does an effective compliance program include?
The U.S. Sentencing Guidelines, at section 8B2.1, set minimum elements: standards and procedures, oversight by the governing authority and high-level personnel, reasonable efforts to keep people who engaged in misconduct out of positions of authority, training and communication, monitoring and auditing, a reporting system that allows anonymous or confidential reports, consistent incentives and discipline, and response to misconduct, all informed by periodic risk assessment.
How does the DOJ evaluate a compliance program?
The Criminal Division's Evaluation of Corporate Compliance Programs, updated in September 2024, organizes its questions around three fundamental questions: whether the program is well designed, whether it is adequately resourced and empowered to function effectively, and whether it works in practice. It is guidance for prosecutors, not a checklist, but it is a useful outline for a new officer's review.
How do you measure a compliance officer's first 90 days?
By whether open cases kept moving, whether the risk assessment was refreshed with the business, whether overdue policies and training were assigned and dated, and whether the board or committee approved a work plan. Case counts and substantiation rates should be tracked, not targeted.