Webinar report: From legal counsel to compliance officer

Should legal own compliance? What skills are needed? What’s the case for a dedicated function?

From law firms in London and Sydney, through an aeronautics giant in Toulouse to his own Madrid-based international consultancy, Murray Grainger’s career has been a remarkable journey – and not just in the geographical sense.

After six years in private practice in both the UK and Australia, Murray transitioned into in-house with Airbus. After holding senior legal roles for six years at the aerospace corporation, he pivoted to the role of Head of Ethics & Compliance Office for a further four.

In 2013 Murray founded Impact on Integrity in Madrid. In the years since - and in diverse capacities - he has supported major international clients and individuals with compliance services, ethics programme effectiveness consultation, board training and software solutions.

Murray collaborated with CLL to answer three of the burning questions around leading an effective ethics and compliance (E&C) function in a modern organisation.

E&C and legal – integrate or separate?

A range of models for integrating E&C functions into organisations exist globally. It seems opinion is divided about whether they should be embedded within legal or established as discrete departments.

Murray argues that they should be distinct from one another, a view shared by the Office of Inspector General at the US Department of Health and Human Services, whose 2023 General Compliance Program Guidance states:

“The CO [Compliance Officer] should not lead or report to the entity’s legal or financial functions… the CO should report directly to the CEO or the board.”

The US Department of Justice Criminal Division hints at a similar sentiment in its Evaluation of Corporate Compliance Programs document. Without explicitly advocating for one side or the other, is does ask:

“Where within the company is the compliance function housed (e.g., within the legal department, under a business function, or as an independent function reporting to the CEO and/or board)? To whom does the compliance function report? Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company? Are compliance personnel dedicated to compliance responsibilities, or do they have other, non-compliance responsibilities within the company? Why has the company chosen the compliance structure it has in place? What are the reasons for the structural choices the company has made?”

Furthermore, in the US, corporate integrity agreements require CCOs to submit regular formal reports to relevant federal agencies.

In the UK and other nations, including the US, France, China, Spain and Singapore, meanwhile, prosecutors are permitted to grant prosecutorial credit to organisations with robust and well-structured compliance functions. In the US, this applies where individuals with operational responsibility for compliance have direct reporting obligations to the governing authority. This effectively means that organisations will need a separate E&C function to qualify for prosecutorial credit.

And as Tina Tolliver, guest columnist for Radical Compliance, put it as recently as April 2026:

“Think of all organisations that have faced federal investigations, criminal liability, and reputation collapse. How many of them had a “too powerful” Compliance Officer? Just about none.”

What skills does an effective E&C team need?

E&C skillsets diverge from those traditionally gained in law school, further enforcing the case for the function to be distinct from legal. Key strengths of the winning E&C team include:

• Approachability – GCs don’t have to be the most approachable individuals in the building, but CCOs most certainly do. People need to be comfortable raising ethics-related issues and collaborating with the compliance team;
• Communications - raising awareness and providing quality training about E&C risks are vital parts of the CCO’s role, so great communication skills are indispensable;
• Culture and change management - embedding ethical and compliance-related awareness across an entire workforce can involve extensive change in the corporate culture;
• Data and analytics – compliance teams generally love data and analytics – something rarely on the radar in legal functions;
• Listening skills – E&C teams need to have their fingers on the emotional pulse of the organisation, something impossible to achieve without active listening;
• Relationship building – the E&C team needs to be trusted by stakeholders at all levels of seniority internally – and respected by external stakeholders such as regulators, the media, etc, and
• Innovation – creativity and a willingness to try new ideas - and accept that some may fail in the pursuit of continuous improvement – is a great mindset in the E&C team.

What’s the business case for E&C?

The business case for a robust E&C function is strong. The Association of Certified Fraud Examiners has, for example, estimated that, globally, organisations lose 5% of their annual revenue to occupational fraud. Losses comprise expenditure incurred because of:

• Fines;
• Management time taken up by fraud cases;
• Legal costs;
• Monitorships; and
• Debarments.

However, the upside is equally, if not more, compelling. Consider, for example, that, according to the Institute of Business Ethics:

• Top quartile cultures deliver 60% higher returns for shareholders; and that
• Employees in organisations with visible ethics programmes are twice as likely to speak up.

And in its 2024 Benchmark of Ethical Culture Report, the ethics education company LRN found that:

• Companies with the strongest ethical culture outperform weaker cultures by 50%;
• Strong ethical cultures are 2.6 times more likely to be adaptable – a key determinant of an organisation’s resilience; and
• Psychological safety really matters – it makes employees up to 2.4 times more willing to report misconduct.

Other proven benefits enjoyed by businesses that make E&C a core pillar of their culture include greater attraction and retention of talent, higher valuations and less regulatory scrutiny.

All which also means they win more customers.