In 2018, Life magazine published a special edition entitled “The World’s Most Haunted Places.”^[1] This edition featured the Winchester House in San Jose, California, later renamed the Winchester Mystery House. For those of you unfamiliar with the Winchester House, it was initially purchased by Sarah Winchester in 1886 when she moved from Connecticut to California. Sarah was the widow of William Winchester, son of Oliver Winchester, the founder of the Winchester Repeating Arms company.

After the move, Sarah began to renovate the house. And renovate it. And renovate it. Additions were added and skylights, cupolas, and stairways were built. The list goes on. These renovations lasted over 35 years until her death in 1922. The house has stairways to nowhere and doors that open to walls. This—and the fact some claim it is haunted—is the primary reason the Winchester House is now called a “mystery house.” It is more like a maze than a home.^[2]

What does this have to do with institutional compliance? In a recent compliance presentation, Andrew Neblett, co-founder of informed360 and chief operating officer at Ethisphere, pointed out that many institutional compliance programs today can end up looking like the floorplans of the Winchester House.^[3]

Here is how that can happen. Several years ago, the 17 “shalls” in the United States Federal Sentencing Guidelines’s “Effective Compliance and Ethics Program” were synthesized into what is commonly referred to today in the compliance industry as “the seven elements.” In addition, some regulations have comparable elements embedded into their requirements. As a result, many compliance programs in many industries are based on these (or similar) elements.