If your program fails on these key points, watch out. 1. A culture where people feel comfortable disclosing their concerns. An organization should "foster a culture that legitimately encourages people to bring forth their compliance concerns," advises private practice attorney Jason Caron in Washington, D.C. 2. A track record for action and communication. When people do report their concerns, the organization should respond to the concerns and take corrective action, if needed, Caron urges. "Equally important," communicate the outcome to the "relevant stakeholders" in terms of why a concern is or isn't an issue and any corrective actions, he advises.