When an authority arrives at a company — whether in employment, administrative or data-protection matters, or in the course of a criminal investigation — it rarely asks whether a compliance programme exists. It asks for specific documents, and from the answers it infers whether the programme exists or has merely been printed.
The first request is usually the risk assessment: what risks the company identified, when, and by what method. A document with no date, no author and no relationship to the company's actual corporate purpose evidences nothing. An assessment that names real activities, specific areas and particular roles does.
Then come the policies, and with them the uncomfortable question: were they communicated? A policy nobody signed, that was not translated into the language the staff actually work in, or that lives in a shared folder almost nobody opens, is hard to sustain as a control measure.
Training is reviewed through its records: attendance lists, dates, contents, and whether it reached the areas where the risk was highest. Training the board and not the operating area, when the risk sits in operations, is a worse outcome than no training at all: it evidences that the company knew where the problem was.
Finally, the whistleblowing channel and the oversight body. Their existence is not enough: what matters is whether they received anything, what was done with it, and whether the person who reported suffered any consequence. A channel with not a single report in three years does not prove there are no problems; it proves nobody trusts it.
The pattern is constant: an authority does not assess intentions, it assesses traces. A compliance programme is, in practice, the set of traces a company can show when it is asked.