New survey data shows the Chief Compliance Officer's reporting line is swinging back toward Legal. For boards, the org chart is the easy part. Mandate, access and influence are what actually decide whether compliance earns its seat at the table.
The reporting line for compliance is moving again. According to Compliance Week's 2025 Inside the Mind of the CCO survey, 39% of compliance officers now report to the General Counsel or legal department — more than to any other executive or governing body. The CEO accounts for 29%, and the board just 11%.
That is a notable reversal. In 2024, 43% of CCOs reported directly to the CEO — the high-water mark across the survey's seven-year history. In the space of a year, the centre of gravity has shifted from the corner office back to the General Counsel.
Why is this such a talking point in compliance?
The reason this lands as more than an org-chart footnote is that reporting lines are widely read as a proxy for influence. A direct line to the CEO or the board is often taken to signal that compliance is a strategic voice, close to the decisions that shape the business. A line into Legal, by contrast, can be read as compliance being folded back into a support function.
Some observers have gone further, suggesting the move reflects a broader mood: in a tighter economic environment, organisations may be recalibrating toward baseline legal compliance rather than investing in programmes that go beyond the minimum. If that reading is right, the reporting line is a symptom of a more cautious posture toward risk and spend.
It is a plausible story. But having placed and advised senior governance leaders across complex, high-stakes environments, we would urge boards not to over-read the solid line.
The org chart is an unreliable barometer
Reporting structure tells you where a function sits. It tells you very little about whether that function is heard.
We have seen CCOs with a direct line to the CEO who were, in practice, kept at arm's length from the decisions that mattered: consulted late, resourced thinly, and expected to bless outcomes rather than shape them. We have also seen compliance leaders reporting through the General Counsel who carried real weight: trusted by the board, close to the commercial agenda, and able to change behaviour because people wanted their input, not because a chart forced it.
The veterans of this field tend to agree. Who you report to matters far less than whether you have genuine access to decision-makers and the standing to influence them, and that standing is earned by solving problems and adding value.
So the more useful question for a board is not whether compliance reports to the CEO or the GC. It is: does our compliance leader have a clear mandate, direct access when it counts, the data and resources to act, and the visibility to build trust across the business? Those things determine impact, and they can be present — or absent — under any reporting structure.
What this means for boards and executive teams
The reporting-line debate is a useful prompt, but the design questions behind it matter more. A few worth asking:
- Is the mandate clear? Compliance leaders derail most often not on technical gaps but on ambiguity about what they are there to do. Define success before the structure.
- Is there real access? A dotted line to the board with a standing agenda slot can carry more influence than a solid line that never reaches the room where decisions are made.
- Are they resourced to act? Influence without information, systems and budget is a title, not a capability.
- Is trust being built early? Compliance leads through influence, not authority. Relational capital — earned through visibility and problem-solving — is what makes the mandate real.
- Handled well, a reporting line into Legal doesn’t necessarily mean a step away from Board access. A closer partnership between compliance and the General Counsel can sharpen the function's legal defensibility and its evidence base (provided the leader retains the access and standing to challenge the business, not just document it).
Our final thought
Reporting lines will keep swinging with the economic cycle and the mood of the moment. Boards that treat each swing as a verdict on compliance's importance are looking in the wrong place. The organisations that get the most from their compliance function are those that design the role around mandate, access, resources and trust - and then appoint and integrate a leader set up to use them.
That is where influence actually comes from. The org chart simply describes it.
