Benchmarking SMB Compliance – Turning Data Into Direction

Data can be one of the most potent tools in compliance – if you know how to use it. For small and mid-sized businesses, benchmarking transforms raw numbers into key performance indicators that guide priorities, strengthen budgets, and demonstrate impact.

In the Benchmarking SMB Compliance session of the Fall into Compliance series, Anders Olson, Isabella Oakes and Rebecca Walker unpacked new findings from the 2025 State of Risk & Compliance Report and the Hotline Benchmark Report. Their conversation centered on how smaller organizations can use data to build maturity – one step and one metric at a time.

The big takeaway: only 17% of SMBs consider their compliance programs "optimized." But that number isn't discouraging. It's an opportunity.

Where SMB programs stand today

The session began with an overview of the 2025 data. Most SMBs described their programs as "developing" or "partially implemented." The biggest barriers to optimization are limited staffing, fragmented reporting and reactive processes.

Anders Olson summarized the challenge clearly: "The fundamentals are there – policies, training, reporting channels – but integration is still evolving."

Data from the Hotline Benchmark Report echoed that point. SMBs are increasingly proactive about incident intake and retaliation prevention, but fewer have consistent follow-up documentation. That gap, the panel said, is where data can create leverage.

From reactive to proactive – using data as a growth tool

Rebecca Walker emphasized that benchmarking isn't about comparison for its own sake. It's about context. "Every organization is different," she said. "The goal isn't to chase averages; it's to understand what your data says about your progress."

When compliance teams can show measurable improvement – such as increased hotline engagement or faster case resolution – they can more effectively advocate for resources.

Olson agreed that data visibility often changes the nature of leadership conversations. "Once you can quantify the value of compliance, it stops being seen as overhead," he noted.

The panel encouraged SMB leaders to start small: track the metrics you already collect, even if informally. Year-over-year trends tell a story leadership can understand.

Small steps, big impact

While the numbers reveal room for growth, they also highlight what's working. The most mature SMB programs share three traits: clarity, consistency and communication.

• Clarity: Policies are accessible and written in plain language
• Consistency: Training and communication are steady, not seasonal
• Communication: Employees know where to report concerns and trust the process

Oakes noted that even small changes – like reintroducing reporting channels during team meetings or simplifying policy updates – can move an organization forward. "Progress doesn't have to mean transformation," she said. "It can mean doing the right things more consistently."

Those small, intentional moves add up to measurable maturity.