Internal compliance reporting: measures and exceptions

Internal compliance reporting gives management a dated view of overdue control reviews, training completion, and unresolved remediation. Start with approved exports, calculate each measure against a defined population, and attach an owner and next action to every exception. The report describes recorded activity; responsible staff still assess what the findings mean.

The Justice Department's Evaluation of Corporate Compliance Programs discusses tailored training and continuous improvement, periodic testing, and review. Those are reasons to retain evidence behind the measures, rather than treat a completion percentage as a verdict on the whole program.

Fix the cutoff and the source rows

Use September 30, 2026, as the example cutoff. Export the control-review register, training assignments, and remediation log as they stood at that date. Include a unique record ID, accountable owner, relevant dates, and the recorded completion or closure evidence.

Keep the three populations separate. A control review is a scheduled review instance; a training assignment is one required person-course combination; a remediation item is one tracked action. Adding their counts would combine unlike units.

Put the cutoff in H1 on each worksheet:

=DATE(2026,9,30)

Use an approved historical snapshot or retained event dates. A current status of completed cannot establish whether an item was complete at an earlier cutoff. Remove personal details from the management view and retain only the fields necessary for the review.

Calculate overdue control reviews

Here is a US distributor's review register. Dates appear in month/day/year format; a dash represents a blank completion cell. Columns A through D contain the source fields.

In E2 and F2, fill these formulas down through row 7:

=--AND(C2<>"",C2<=$H$1)
=--AND(E2=1,C2<$H$1,OR(D2="",D2>$H$1))

An unfinished review becomes overdue after its due date. A review due on the cutoff is included in the due population but is not yet overdue under this convention. State that convention before comparing periods.

Open overdue review rate = Open overdue reviews / Reviews due by the cutoff

=IF(SUM(E2:E7)=0,"",SUM(F2:F7)/SUM(E2:E7))

The result is 2 / 5 = 40.0%. The population check is three completed reviews plus two outstanding reviews equals five due reviews. C03 was completed late, but it is no longer open overdue. Track late completion separately if management needs that question answered.

Calculate training completion on assignments

The training administrator supplies these reconciled assignment counts. Only assignments due by the cutoff enter this table.

With required assignments in B and completions in C, calculate D2 and the total rate as follows:

=IF(B2=0,"",C2/B2)
=IF(SUM(B2:B4)=0,"",SUM(C2:C4)/SUM(B2:B4))

The check is 185 completed plus 15 outstanding equals 200 required. Divide totals to calculate the company rate. A simple average of team percentages gives a small team the same influence as a large team.

Retain the assignment-level export behind this summary, including approved exemptions and removals. A worker taking multiple required courses contributes multiple assignments. For workforce coverage beyond this specific training population, use workforce management reporting.

Age the open remediation items

Use opening and closing dates to reconstruct which actions remained open at the cutoff. In this sheet, A through D are source fields, E is the open flag, and F is age.

=--AND(C2<=$H$1,OR(D2="",D2>$H$1))
=IF(E2=1,$H$1-C2,"")
=AVERAGEIF(E2:E5,1,F2:F5)
=COUNTIFS(E2:E5,1,F2:F5,">30")

The formulas return an average open age of 30 days and one action older than 30 days. That action represents 1 / 3 = 33.3% of the open population. Percentages are rounded to one decimal place; ages use elapsed calendar days. Microsoft documents COUNTIFS as counting rows where all supplied criteria are met.

An age threshold is a management convention, not a statement about legal deadlines or severity. The owner should explain R01's blocker, approved target date, and next action. Link related asset exceptions to asset management reporting instead of duplicating an asset register here.

Where it goes wrong

• Changing the population. New courses, canceled reviews, and exemptions can move a rate without any improvement in execution. Show the changes alongside the result.
• Treating missing dates as valid dates. Quarantine incomplete records for correction before calculating a due rate or an age.
• Counting reopened actions twice. Keep the action ID and reopening history so one action does not become two unresolved items.
• Confusing age with priority. An older low-impact action may need less urgent attention than a recent serious exception. Use the source owner's classification.

Place the resulting exception table inside the wider management reporting package. Questions about selecting the tool belong in choosing analytics software for compliance. Covirage is not affiliated with Microsoft.

Review your compliance exports in Covirage

Bring approved review, training, or remediation exports to Covirage; it maps the columns, and its tools compute and check the figures. The external AI model explains the results with every figure traced to its rows, supporting management review of the supplied records. Create a free Covirage account and bring a sample of your own data.

See Covirage for compliance teams for the supporting industry context.