Does your compliance structure fit your tools - or the other way around?

Your reporting infrastructure was configured once, during implementation, for an organization that no longer exists. Since then you have added entities, redrawn reporting lines, absorbed two new regulations, and lost the person who knew why the routing rules were set up that way. The software has not moved.

That gap between how your organization works and how your software assumes it works is where the real cost sits. It shows up as reports parked in the wrong queue, local teams waiting on a central approval nobody owns, and a spreadsheet that quietly becomes the system of record.

The intake form belongs to someone else's organization

The first place rigidity becomes visible is the one place every employee sees. Reporting forms ship with a fixed set of categories and questions, built around a generic model of what a company investigates. Your organization investigates something more specific than that.

Compliance leads describe the same problem to us repeatedly: the questions locked into their platform don't match the concerns their people actually raise, and changing them means a vendor request, a quote, and a wait. So the form stays wrong. Employees choose the closest category, case handlers reclassify by hand, and your reporting data inherits the error at intake.

Most of what arrives isn't yours to handle

Real organizations don't split HR from compliance the way compliance software assumes they do. Reports land on the compliance desk that belong with Employee Relations. Grievances arrive through the ethics channel because it's the channel people know. In discovery conversations, compliance teams tell us the majority of what reaches them is an HR matter, and that someone has to open each case, read it, summarize it, and forward it before any investigation starts.

Then there are the cases that break the routing rules entirely: a report about the person who normally handles reports, or a concern that implicates a local managing director. These aren't edge cases. They are a predictable share of your volume, and a system built on one intake channel, one approval chain, and one investigation team has no way to express them. Someone handles them manually, every time, and that person becomes a single point of failure.

Every change goes through someone else's calendar

Adding a language. Changing who receives a category. Updating a form field. Reassigning a departing HR partner's open disclosures. Individually these are small; collectively they are your program.

When each one requires a vendor ticket, the pattern compliance teams report is a two to four week wait followed by an invoice. Your cost of ownership stops being the license fee and becomes the cumulative price of keeping the tool current with your own organization. Teams start batching changes, then postponing them, then working around them. The workaround becomes permanent.

There's a sharper version of this problem. When configuration knowledge lives with the vendor and the internal owners leave, organizations lose practical control of a system they're still paying for. Getting access back is its own project.

The system your team actually uses is not the one you bought

Concerns reach compliance by email, by Teams message, through a manager's open door, sometimes by WhatsApp. The formal channel handles a fraction of the real volume. Teams that inherit this build the obvious fix: a spreadsheet alongside the platform, a separate dashboard because the built-in reporting can't answer the board's question.

Two things follow. Your audit trail now sits in two places, and neither is complete. And the informal channels get treated as a compliance failure to be shut down, when in most organizations they work well and reflect genuine trust in a local colleague.

The channels aren't the problem. A system that can only account for what arrives through its own front door is the problem. Your case management should absorb what comes in through personal contact and a Teams thread, not compete with it.

What flexibility actually looks like

A system that fits your structure gives your team direct control over these things:

• Intake you configure yourself. Build the categories, questions, and forms that match what your organization actually investigates, per entity or per region, without a support ticket.

• Routing with exceptions. Send reports by entity, region, topic, or severity, and define the escalation path for cases that implicate a normal recipient.

• One record set. Log concerns that arrived by email, in person, or through a local channel, so your audit trail covers the whole program rather than one intake method.

• Access by role and geography. Local handlers see local cases. Global leads see the pattern across all of it. You set the boundary, and you change it when the org chart does.

• Intake in 100+ languages across web, phone, and app, so accessibility obligations don't depend on interpreter availability.

• Reporting you can interrogate. Slice case data by country, business unit, or risk type. With Sienna Insights your team asks questions of its own data in plain language instead of exporting to Excel and rebuilding a board deck each quarter.

• AI that does the triage nobody wants. Sienna AI categorizes and summarizes incoming cases, which cuts the reading-and-forwarding work that consumes case handler time before an investigation begins.

Across 750+ organizations in 30+ countries, no two structures we support are identical. Centralized in Europe, decentralized in Asia, hybrid in North America, and mid-restructure in at least one region: that's the normal condition, not the exception.

Questions worth asking before you sign

The demo will show you the happy path. These questions surface the rest:

• Who changes a routing rule, my team or yours, and what does that cost?

• Can we add or edit intake categories without a support request?

• What happens to open cases and disclosures when a case handler leaves? Is there a bulk reassignment, or does someone edit them one at a time?

• Can we log and manage a case that came in through a channel other than the platform?

• Which of the things you've just shown me are configuration, and which are a professional services engagement?

• How long from signature to go-live, and who does the work?

• When our structure changes next year, what does that process look like?

Ask the last one twice. Every organization restructures. The answer tells you whether you're buying software or a subscription to a vendor's project queue.

Where to start

If you're rebuilding your intake model rather than replacing a single tool, our guide on how to build a scalable compliance intake model walks through the design decisions in order: channels, categories, routing, and escalation.

If you're further along and want to see how routing and configuration work in practice, book a demo and bring your org chart. The complicated parts are the interesting ones.