From Signatures to Understanding: Rethinking Policy Distribution and Accountability

For most compliance teams, policy management has quietly settled into a familiar routine: push the document out, collect the signatures, file the attestations, and call it compliance. On a recent episode of The Ethicsverse, host Nick Gallo, Chief Servant and Co-CEO of Ethico, argued that this routine leaves an enormous amount of value on the table.

His guests were Evie Wentink, Principal at Ethical Edge Experts, and Ximena Restrepo, Compliance & Privacy Partner at Logan Health. Together they made the case that policies are not paperwork to distribute but a way to build genuine understanding across the organization, and that a collected signature is proof of delivery, not proof of understanding. Here are the key takeaways.

Key Takeaways

Start With Communication, Not Blame

The session grew out of a LinkedIn question Wentink saw: what do you do when employees violate a policy they acknowledged? When a violation surfaces, the first instinct should be to ask whether the policy was ever properly communicated to that specific audience, not what is wrong with the employee.
Restrepo starts every inquiry with the why: Was the change communicated? Did that department actually receive education that the policy or workflow had changed?
Wentink inherited a procurement policy posted to an internal site five years earlier and found 95% noncompliance, with a flood of emails asking where the requirement even came from. It had simply been posted and left, with compliance likely never involved in shaping or distributing it.
An audience poll agreed: after a violation, establish first whether the employee even knew the policy existed, and whether it had been effectively communicated.

Middle Managers Are the Real Distribution Channel

Managers are closest to their teams, surface changes in huddles and team meetings, and are the ones who ultimately enforce a policy or behavior.
Leveraging department managers to explain what changed, and why, is how a policy actually reaches people.
Wentink's "integrity playbook" teaches managers the compliance program, including where the policies live, so they take ownership of talking through policy content with their teams, rebuilding culture one conversation at a time.

Fight the Forgetting Curve With a Short Summary

Compliance officers live inside these documents, but the safe assumption is that employees are subject to the forgetting curve, losing the vast majority of what they heard within a month.
Pair any annual rollout or policy access with a brief summary of roughly 200 words that distills the most important aspects and can be refreshed year over year.
This is a natural place to use AI: have a policy lead generate a tight, bulleted summary that highlights the key changes and the why, and points readers to the specific pages that matter most.

Say It Seven Times, Seven Ways

Reject the one-and-done email. Effective communication is repetitive: say it seven times, seven ways, across multiple mediums.
Partner with marketing and corporate communications rather than competing with them; Restrepo eventually earned a recurring compliance spread at the front of a company-wide magazine.
Use many channels: leadership and department newsletters, board and committee agendas, and a five-minute ethics moment inside routine manager meetings, tied to a relevant news story.

Map First, Then Build a Distribution Plan

When you inherit uncommunicated or poorly written policies, start with a policy map: understand the landscape, when each policy was last reviewed, and which ones are most critical.
Most companies have a "policy on policies," but few document how policies actually get distributed, even though not every policy or audience carries the same criticality.
Apply the 80/20 rule and incrementalism. You cannot boil the ocean, so tackle the biggest, most widely applicable policies first and inch the ball forward.
Resist rewriting everything at once. Pull in a small group of subject-matter experts, clean up the most important pieces, and let the review cycle keep improving the rest.

Accessibility Is a Compliance Obligation

If a person who is blind cannot meaningfully access a policy, they cannot fairly be held accountable for it, and there is litigation to that effect.
Run accessibility checks on policies before distribution, treating access as both a legal safeguard and a visible commitment to the workforce.
Involve the right experts in drafting, including people with disabilities for disability-related policies, so employees see the policy exists to help them.

The 60-Second Signature Problem

E-signature tools reduce friction so well that employees open a document, jump to the end, and click. Most attendees did not know how long their people spent on an acknowledgment; where measured, it was often under two minutes.
Sending a policy through an e-signature system and getting the click back is proof of delivery, not proof of understanding.
Examine your system settings and deliberately slow the process down for important changes, up to requiring initials on the specific lines that changed.
This is the gap Ethico built Policy Plus to close: adding a short quiz turns a signature into a signal. A division might show 98% acknowledgment and an 85% quiz score, while a policy scoring 50% flags itself for a rewrite or targeted reeducation.

Decide Who Owns Policy

When a poll asked who owns policy distribution and acknowledgment, answers scattered across compliance, HR, and shared ownership, which both guests treated as a risk.
When something is everyone's job it becomes nobody's job, and shared responsibility turns into jump-ball risk.
Even where compliance does not formally own a policy, it should always be in the loop, guiding policy owners with checklists and best practices, while culture determines whether the program is truly lived.

What the DOJ Is Really Looking For

Regulators are not chasing a 100% completion rate; they want effectiveness. They look at the full set of mechanisms used to communicate a policy, how accessible it is, how often it is reinforced, and the related report and inquiry volume.
They are assessing good-faith effort and due diligence across the whole process, not a single attestation number.
Individual accountability matters too: employees are responsible for knowing where the repository is and how to search it, rather than expecting an email for every one of thousands of renewing policies.

When a Violation Happens, Enforce Consistently

Resist the reflex to immediately fault the employee. If all you did was send one annual email with no training, look inward and ask whether the program did everything it could to build understanding.
Filter by the nature of the violation, since a missed process step differs from harassment, retaliation, or fraud, and by whether the conduct was intentional or accidental.
Where the issue is genuine misunderstanding, treat the investigation as an opportunity for targeted reeducation of the employee and the wider department.
Enforcement must be consistent. A dress-code rule that a manager reminds a nurse about repeatedly, but never follows up on, loses its meaning. Counsel, then a written warning, then further steps per the sanctions policy.

The Five Rights of Policy Distribution

Right policy: the correct, approved version.
Right people: accurate, updated distribution lists.
Right format: a usable, accessible format for the audience.
Right communication and acknowledgment: clear messaging about what changed.
Right evidence: accessible records when you distribute electronically.

Closing Thoughts

Asked for a better version of the original question, the panel reframed it around understanding: how do we move from a mere signature toward genuine comprehension, and how do we eliminate the false sense of security a stack of acknowledgments can create? Wentink's advice was to audit your current process and pick the small, achievable improvements first, planning bigger changes for later. Restrepo agreed that there is no one-size-fits-all process, and the goal is simply to keep improving year after year. As Gallo summed it up, there is no silver bullet for policy communication and education, but by putting one foot in front of the other, mapping, summarizing, reinforcing, measuring, and enforcing consistently, compliance teams can close the distance between a signature and real understanding.