How to Build a Competition Compliance Program That Actually Works

A competition compliance program is the only antitrust investment that pays before anything goes wrong: it prevents infringements, detects the ones that start anyway while leniency is still available, mitigates fines in the regimes that credit it, and — increasingly — determines whether a regulator chooses conduct remedies or structural ones. This guide sets out how to build one that survives contact with reality, opening the compliance pillar of our Global Competition & Antitrust hub.

Why do companies with policies still commit infringements?

Because policies address the wrong layer. Most infringements are not committed by executives who read the antitrust policy and decided to violate it; they are committed by commercial staff who never mapped their situation onto the rules — the sales manager who joined the industry WhatsApp group, the category manager relaying “what the market is doing”, the tender team who called a competitor to check capacity, the HR director benchmarking salaries with talent rivals.

The failure pattern is consistent across published decisions: rules stated abstractly, training delivered once at onboarding, no owner for the risky channels, no monitoring of the media where the conduct actually lives, and incentive structures pulling the other way. That last point deserves emphasis — bonus plans rewarding “market discipline”, exclusivity wins or price stability are compliance risks written into compensation. A program that never touches incentive design is arguing with the organisation’s own machinery.

How do you run a competition risk assessment?

Start from the business, not the statute. Map each business unit’s market position (share bands, dominance triggers), its competitor-contact channels, its pricing and discount mechanics, its tender exposure, its distribution structure and its M&A activity. Score each intersection for likelihood and impact, and let the top ten cells drive everything else — policy content, training targets, monitoring scope.

Standard high-risk findings: trade-association memberships with no attendance rules; benchmarking or market-intelligence subscriptions of unverified provenance; JV boards where competitors sit; sales incentives tied to share-of-wallet; recurring public tenders in concentrated bidder pools; distribution agreements templated years ago and never re-reviewed as the business grew into dominance; and HR practices exchanging compensation data with talent competitors. Re-run the assessment annually and after any structural change — an acquisition, a market exit, a share jump. The dominance trigger matters most: the same commercial practice can move from unremarkable to actionable purely because the business grew, as our abuse overview explains.

What do the six components look like in practice?

1. Commitment and ownership: a board-approved policy, a named senior owner with budget and access, and — critically — visible reinforcement when compliance costs money (a walked-away deal, a rejected exclusivity offer). 2. Risk-based policies: short, situational documents (“what to do at a trade association meeting”, “how to respond to a competitor’s email”, “tender independence rules”) rather than one long statute summary.

3. Targeted training: sales, procurement, HR, pricing and legal each get scenarios from their own work; refreshed at least annually; delivered by someone who can answer real questions. 4. Monitoring and audit: sampling communications channels, screening pricing and rebate structures against the AEC tests, reviewing tender behaviour, checking association attendance records. 5. Reporting channels: a route to raise concerns without career risk, with documented non-retaliation. 6. Response capability: rehearsed dawn-raid and leniency protocols, pre-mandated external counsel, document-preservation switches — covered in our dawn raid guide and leniency guide.

How do you make training actually change behaviour?

By replacing law with situations. Nobody remembers Article 101; everybody remembers “a competitor sends you their price list — what do you do in the next ten minutes?” Build the curriculum from your own risk map and, where possible, your own near-misses (anonymised): the association meeting that drifted, the tender call, the benchmarking invitation.

Three design rules improve retention measurably. Role-specific: sales, procurement, HR, pricing, corp-dev and legal each need different scenarios — generic all-staff modules train nobody well. Decision-oriented: end each scenario with the exact action (leave the room, say this sentence, send this email, call this number), because compliance failures are usually failures of knowing what to do, not what is prohibited. Reinforced: short quarterly nudges tied to real events beat annual marathons. And test comprehension, not attendance — the metric regulators ask about is whether people knew what to do, and the answer should be measured.

What does monitoring look like beyond the checkbox?

Sampling with teeth. Periodic, privileged review of communications in the highest-risk populations (sales in concentrated markets, tender teams, association delegates) using keyword and pattern screens across email and the messaging apps people actually use — a program that ignores WhatsApp is monitoring the wrong medium. Pricing and rebate structures screened against the cost and AEC tests before launch, with a documented gate for below-cost or loyalty-conditioned designs.

Add bid-pattern analytics where you sell into tenders (your own win/loss patterns tell you what a screener would see), association-attendance logs with agenda review, and an annual contract sweep for exclusivity, parity and information-sharing clauses. The output that matters is a short, honest register of findings and fixes — because the question after any incident is not “did you have monitoring?” but “what did it find, and what did you do?” A monitoring function that has never found anything has never looked.

How do you handle an internal report of possible infringement?

With a pre-designed sequence, because improvisation here destroys options. Route the report immediately to legal under privilege; open a scoped internal investigation with external counsel where the allegation touches cartel conduct; suspend document destruction across relevant custodians the same day; and interview with Upjohn-style warnings so employees understand who counsel represents.

Then take the two decisions that matter: whether the conduct must stop immediately (almost always yes, choreographed so co-participants are not tipped off) and whether to seek leniency in each affected jurisdiction — a board-level call to be made in days. Discipline decisions come later and carefully: acting too fast creates hostile witnesses and independent leniency applicants; acting too slowly reads as ratification. Companies that have written and rehearsed this sequence reach the marker queue while others are still scheduling meetings.

How do you measure whether the program works?

With leading indicators, not incident counts. Useful metrics: training comprehension scores by role (not completion rates); number of drift incidents reported from associations and competitor contacts (rising is good — it means the channel works); percentage of rebate and exclusivity structures screened before launch; time-to-legal for competitor contact reports; results of communications-channel sampling; and drill performance on dawn-raid and leniency scenarios.

Report these to the board annually alongside the risk map’s changes. The narrative that matters is trajectory: risks identified, controls added, incidents surfaced early and closed. That report is also the document you will hand a regulator to evidence good faith — which is a strong argument for writing it as if that day has already arrived.

How do you build compliance into incentives and systems?

By making the compliant path the easy one. Pricing-approval workflows that require a legal gate for below-cost, exclusivity-conditioned or retroactive-rebate designs catch abuse risk before launch. Contract-management systems with dominance-mode clause libraries stop old templates propagating into new market positions. Tender systems that require an independent-bid certification and log competitor contacts create both deterrence and evidence. CRM and expense systems that flag competitor meetings feed the monitoring function automatically.

On incentives, review the compensation plans in the highest-risk populations: bonuses for share-of-wallet exclusivity, “price discipline” targets in concentrated markets, and tender win-rate metrics without independence controls all pay people to take the risks the policy prohibits. Aligning incentives is unglamorous and slow, and it does more to change conduct than any training module — which is precisely why the DOJ’s evaluation questions ask about it directly.

Frequently Asked Questions