A compliance issue is any failure by an organization to follow a rule it is legally or contractually bound to obey. Understanding the meaning of a compliance issue starts with knowing that those rules come from three places: statutes passed by legislatures, regulations written by government agencies, and the organization’s own internal policies. A single lapse can violate all three at once, and the financial exposure often grows by the day until the problem is fixed.
The Three Sources of Compliance Obligations
Every compliance issue traces back to one of three types of rules. Recognizing which layer a problem sits on tells you who enforces it and what the penalties look like.
Statutes
Statutes are formal laws enacted by Congress or state legislatures. The Sarbanes-Oxley Act, for example, requires corporate officers of public companies to personally certify the accuracy of their financial statements. An officer who willfully signs off on a false report faces up to 20 years in prison and a fine of up to $5 million.1Office of the Law Revision Counsel. 18 U.S. Code 1350 – Failure of Corporate Officers to Certify Financial Reports The Clean Water Act, the Fair Labor Standards Act, and the Bank Secrecy Act are other statutes that generate large volumes of compliance work.
Regulations
Agencies like the SEC, EPA, and OSHA translate statutes into specific, enforceable rules. A statute might require public companies to disclose material events; the SEC’s regulations specify that a Form 8-K must be filed within four business days of a triggering event.2Securities and Exchange Commission. Form 8-K Missing that deadline is a compliance issue even if no one intended to hide anything. The gap between the broad statutory command and the granular regulatory requirement is where many organizations stumble.
Internal Policies
Organizations also create their own rules through codes of conduct, ethics policies, and operational procedures. A policy prohibiting gifts over a set dollar amount goes beyond what any statute requires, but violating it is still a compliance issue. Internal rules form the backbone of most compliance programs, and federal prosecutors specifically evaluate whether a company actually enforces its own procedures when deciding how to handle misconduct.3U.S. Department of Justice. Evaluation of Corporate Compliance Programs
A compliance issue can be an affirmative act, like an employee destroying documents ahead of an audit, or an omission, like failing to file a required report. Regulators penalize both, and the DOJ looks closely at whether failures reflect isolated mistakes or a pattern of ignoring the organization’s own procedures.4United States Department of Justice. Evaluation of Corporate Compliance Programs
What Compliance Issues Look Like in Practice
The abstract definition sharpens when you look at the actual violations regulators pursue. A few categories account for most enforcement activity.
Financial Reporting and Money Laundering
Inaccurate financial reporting is one of the most common compliance issues in public companies. Misstating revenue, hiding liabilities, or improperly capitalizing expenses all violate Generally Accepted Accounting Principles.5Financial Accounting Standards Board. Revenue Recognition Under Sarbanes-Oxley, knowingly certifying a false report can result in fines up to $1 million and 10 years in prison, and willful certification pushes those limits to $5 million and 20 years.1Office of the Law Revision Counsel. 18 U.S. Code 1350 – Failure of Corporate Officers to Certify Financial Reports
Financial institutions face parallel obligations under the Bank Secrecy Act. The most basic is filing a Currency Transaction Report for any cash transaction over $10,000 in a single day. Multiple smaller transactions that add up to more than $10,000 must be treated the same way if the institution knows they involve the same person.6FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Assessing Compliance with BSA Regulatory Requirements Banks that don’t maintain adequate anti-money laundering programs have paid penalties in the hundreds of millions of dollars.
Data Privacy and Cybersecurity
HIPAA requires healthcare providers, insurers, and their business associates to protect patient health information through specific administrative, physical, and technical safeguards.7U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule Penalties scale with fault: a violation from genuine ignorance carries a minimum of $145 per incident, while willful neglect that goes uncorrected starts at $73,011 per violation and can reach over $2.1 million per calendar year.
California’s Consumer Privacy Act gives consumers the right to know what personal data businesses collect, to delete it, and to opt out of its sale. Failing to provide the required opt-out mechanism is a direct violation that can lead to statutory damages.8State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act Other states have enacted their own frameworks, and a company operating across state lines may need to comply with several at once.
Public companies also face SEC rules adopted in 2023 requiring disclosure of a material cybersecurity incident on Form 8-K within four business days of determining materiality. The only exception is a written determination by the U.S. Attorney General that immediate disclosure would threaten national security or public safety.9U.S. Securities and Exchange Commission. Public Company Cybersecurity Disclosures – Final Rules Non-bank financial institutions, including mortgage brokers, auto dealers, tax preparers, and payday lenders, must maintain a written information security program under the FTC’s Safeguards Rule.10Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Smaller businesses frequently miss this rule because they don’t realize it applies to them.
Labor and Employment
Treating someone as an independent contractor when they qualify as an employee under the Fair Labor Standards Act is one of the most common and expensive compliance failures. Misclassified workers miss out on minimum wage protections, overtime, and other legal benefits.11U.S. Department of Labor. Misclassification of Employees as Independent Contractors Under the Fair Labor Standards Act When caught, an employer owes the full amount of unpaid wages plus an equal amount in liquidated damages, effectively doubling the bill.12Office of the Law Revision Counsel. 29 U.S. Code 216 – Penalties Across a workforce of hundreds, back pay alone can reach seven figures before liquidated damages.
OSHA requires safe working conditions and appropriate protective equipment. A serious violation costs up to $16,550 per instance; a willful or repeated violation ranges from a minimum of $11,823 to a maximum of $165,514.13Occupational Safety and Health Administration. 29 CFR 1903.15 – Proposed Penalties If a willful violation causes a death, the responsible party faces up to six months in prison for a first offense and up to a year for a second.14Occupational Safety and Health Administration. 29 U.S.C. 666 – Penalties
Environmental Violations
Environmental penalties are typically calculated per day of non-compliance, so a problem that persists for months before discovery can generate staggering fines even when the underlying conduct seems minor. The Clean Air Act requires factories and chemical plants to install pollution controls and meet emission limits.15US EPA. Air Enforcement The Resource Conservation and Recovery Act governs the handling, storage, and disposal of hazardous waste, and improperly classifying waste or shipping it without required manifest documentation triggers enforcement.16U.S. Environmental Protection Agency. RCRA Corrective Action Enforcement Authorities
Discharging wastewater into a navigable waterway without a National Pollutant Discharge Elimination System permit is a Clean Water Act violation with real teeth. A negligent violation carries criminal penalties of up to one year in prison and $25,000 per day; a knowing violation increases those to three years and $50,000 per day.17US EPA. Criminal Provisions of Water Pollution On the civil side, each day of violation can cost up to $68,445 after inflation adjustments.18eCFR. 40 CFR 19.4 – Statutory Civil Monetary Penalties, as Adjusted for Inflation
How Compliance Issues Surface
How a problem is discovered has a large effect on the outcome. Organizations that catch issues internally face far better results than those that learn about them from a regulator.
Scheduled internal audits are the first line of defense. Many organizations use continuous monitoring software that flags transactions or communications outside established thresholds, catching anomalous expense reports or unusual payment patterns before they become full violations. Anonymous hotlines and reporting portals give employees and third parties a way to raise concerns without fear of retaliation, and a tip through one of these channels is frequently the catalyst for a formal investigation. The DOJ treats a functioning reporting mechanism as evidence of a healthy compliance program.3U.S. Department of Justice. Evaluation of Corporate Compliance Programs
Government agencies also conduct their own examinations. By the time a regulator initiates one, the organization has lost the chance to control the narrative. Once a potential issue is flagged, a formal internal investigation gathers documents, interviews witnesses, and analyzes electronic data to determine whether a violation occurred, who was responsible, and whether the problem was isolated or systemic. Those findings drive the most consequential decision in the whole process: whether to self-report.
What Non-Compliance Costs
The cost of a compliance failure extends well beyond the initial fine. Civil monetary penalties vary dramatically by area, from a $16,550 OSHA serious violation to $68,445 per day for a Clean Water Act violation. Beyond government fines, organizations face civil litigation from affected parties, including class actions from consumers or investors. Remediation costs, including overhauling IT systems, hiring external consultants, and implementing new controls, frequently exceed the fine itself.
The most serious failures trigger criminal prosecution of both the organization and the individuals involved. Destroying or falsifying records to obstruct a federal investigation is a felony punishable by up to 20 years in prison.19Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records The DOJ has made individual accountability a centerpiece of its corporate enforcement strategy, meaning leniency for a company does not shield the people who orchestrated the misconduct.20United States Department of Justice. Department of Justice Releases First-Ever Corporate Enforcement Policy for All Criminal Cases
Regulators can revoke or suspend the licenses a business needs to operate, effectively shutting down entire divisions. They can also require the appointment of an independent compliance monitor who oversees operations for years, adding substantial cost and slowing decision-making. Reputational damage is harder to quantify but no less real: negative coverage erodes customer trust, complicates recruiting, and can depress stock prices long after the fine has been paid.
Why Self-Reporting Changes the Math
How an organization responds after discovering a compliance issue often matters as much as the violation itself. In March 2026, the DOJ announced a department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. Companies that voluntarily report misconduct, fully cooperate with investigators, and fix the underlying problem in a timely way can qualify for a declination, meaning the government chooses not to prosecute at all.20United States Department of Justice. Department of Justice Releases First-Ever Corporate Enforcement Policy for All Criminal Cases Companies that narrowly miss the requirements for a full declination can still receive a fine reduction of 50 to 75 percent off the low end of the sentencing guidelines range. Any criminal resolution within the prior five years counts as an aggravating factor, so repeat offenders get far less benefit.
The SEC evaluates cooperation along four dimensions: whether the company had effective compliance procedures before the misconduct, whether it self-reported promptly and completely, whether it took meaningful remedial steps like disciplining wrongdoers and fixing internal controls, and whether it cooperated by turning over relevant information.21U.S. Securities and Exchange Commission. Benefits of Cooperation With the Division of Enforcement Organizations that score well on all four can receive substantially reduced penalties or, in rare cases, no enforcement action at all. A compliance program that exists only on paper provides no protection when enforcement arrives.