In the first four posts in the Leonardo Compliance Framework, we used Leonardo’s work to explore the compliance disciplines of Refine, Investigate, Innovate, and Monitor. For our final blog post, the lesson comes not from a single Leonardo masterpiece but to the extraordinary collection of notebooks he created throughout his life. Leonardo recorded observations about anatomy, engineering, mechanics, water, optics, mathematics, architecture, flight, weapons, and the natural world. He drew machines, recorded experiments, posed questions, explored ideas, and returned repeatedly to subjects that interested him.
The compliance lesson is larger than good note-taking. Leonardo externalized knowledge. He created a record of observations, ideas, questions, and reasoning that otherwise would have existed only in his mind. Modern corporations face a similar challenge. A CCO may understand why a particular control exists. An investigator may remember why an inquiry was expanded. A regional compliance officer may know why a distributor received enhanced scrutiny. An Audit Committee may understand why management accepted a particular residual risk. An AI governance committee may know why a particular use case was approved with specific limitations.
Then people leave, responsibilities change, businesses are reorganized, and memories fade. The policy remains, but the reasoning disappears. That is why documentation should be viewed as a component of compliance governance rather than simply an administrative obligation.
If It Is Not Documented, the Organization May Not Know It
Compliance professionals are familiar with the maxim that if something is not documented, it did not happen. That formulation can be overly simplistic, but it points toward a genuine problem. Organizations often know more than their systems preserve.
Consider a high-risk distributor approved five years ago. The compliance file may contain due diligence reports, certifications, contractual provisions, and an approval. Yet the people involved may have known far more. They may have discussed a government relationship, considered terminating the proposed engagement, obtained additional information, imposed enhanced controls, and ultimately concluded that the residual risk was manageable.
If the file contains only the final approval, a future reviewer may know what the company decided without understanding why it made the decision. That distinction matters. Good compliance documentation should preserve significant reasoning, not simply outcomes.
This does not mean every routine decision requires a lengthy memorandum. Documentation should remain proportional to risk. A routine low-risk approval may require little explanation. A significant exception involving elevated corruption risk, a senior executive, a sensitive investigation, or a consequential AI application may warrant considerably more.
Risk-based documentation is part of a defensible compliance program.
Documentation Creates Institutional Memory
One of the most significant vulnerabilities in many compliance programs is the concentration of institutional knowledge in particular individuals. Every organization has employees who know why things work the way they do.
A longtime compliance officer remembers why a control was implemented after an investigation. An Internal Audit executive understands why a particular business unit receives enhanced testing. A Finance employee knows why payments to a particular category of third parties require additional approval. An investigator remembers a series of cases that revealed a recurring management problem.
That knowledge has value. A new CCO should be able to understand why major components of the program exist. A new Audit Committee chair should be able to understand significant unresolved compliance risks. A new investigator should be able to identify relevant historical matters. A new control owner should understand what problem the control was designed to address. Institutional memory should belong to the institution.
Documentation Supports Accountability
Clear documentation also helps answer one of the most important questions in corporate governance: who decided?
Organizations make thousands of decisions involving compliance risk. Most are routine. Some are consequential.
When a significant risk is accepted, the company should be able to identify the person or governance body with authority to accept it.
This is particularly important for exceptions.
If a high-risk third party is approved despite significant red flags, who approved the relationship? If an investigation involving a senior executive is narrowed, who authorized the change in scope? If a remediation deadline is extended, who approved the extension and what interim controls are operating? If an AI system is permitted to influence consequential decisions, who approved the use case and under what conditions?
These are governance questions.
Documentation creates a decision trail.
That trail allows management, Internal Audit, the board, and, when necessary, regulators or enforcement authorities to understand how the organization exercised judgment.
A defensible compliance program does not require perfect decisions. Business decisions involve uncertainty.
It should, however, be able to demonstrate that significant decisions were made through an appropriate process by people with the authority and information necessary to make them.
Remediation Requires Evidence
The Michelangelo series emphasized the difference between closing a project and solving the underlying problem. Leonardo’s notebooks add another dimension: the organization should preserve evidence of what it changed and why.
Suppose an investigation identifies weak approval controls over distributor discounts. Management agrees to remediate the issue by modifying system permissions and requiring additional review.
The compliance record should identify the deficiency, remediation owner, planned corrective action, expected completion date, and evidence required for closure. When management reports that remediation is complete, the record should support that conclusion.
Was the system actually modified? Were users informed? Did testing confirm that the revised control operates as intended? Were similar vulnerabilities evaluated elsewhere? This creates a defensible chain from problem to solution.
Finding → Root Cause → Remediation → Ownership → Validation → Closure
That chain is valuable to the CCO because it demonstrates that compliance findings lead to management action. It is valuable to Internal Audit because it supports assurance. It is valuable to the board because it provides evidence that identified risks are being addressed. Documentation converts remediation from a promise into an accountable process.
AI Makes Documentation More Important
Artificial intelligence may make the documentation principle more important than at any previous point in the modern compliance program. AI governance involves decisions that may be difficult to reconstruct after the fact if they are not documented when made.
A company evaluating a significant AI use case should preserve enough information to understand the system’s intended purpose, business owner, risk classification, relevant data, identified risks, testing, required controls, human oversight, approval conditions, and monitoring expectations.
The record should also reflect material changes.
An AI application approved as a low-risk productivity tool may later gain access to sensitive internal data. A vendor may change the underlying model. A system may become integrated into a consequential business process. An application initially used to recommend actions may eventually be authorized to take them. The governance record should evolve with the system.
This is particularly important because AI can complicate traditional assumptions about decision-making. When a human employee makes a decision, organizations generally know who made it. When an AI system influences or takes an action, accountability can become less obvious.
Documentation should prevent that ambiguity from becoming an accountability gap. The company should be able to reconstruct what the system was authorized to do, who approved that authority, what controls applied, and who was responsible for monitoring its operation.
NIST AI RMF and ISO/IEC 42001 both reinforce the broader value of structured governance, risk management, documentation, monitoring, and continuous improvement. For the CCO, the important point is not simply alignment with a framework. It is the ability to demonstrate how the organization governed the technology in practice.
Documentation Should Feed Organizational Learning
Documentation becomes most valuable when the organization uses it. Investigation records can reveal recurring root causes. Exception records can identify controls employees routinely struggle to follow. Third-party approval records can reveal recurring risk patterns. Remediation documentation can show which corrective actions are effective. AI governance records can identify use cases generating repeated incidents or overrides.
The organization can analyze these records to improve the compliance program. This closes the loop between all five Leonardo principles.
- Documentation captures what monitoring reveals.
- Monitoring identifies issues requiring investigation.
- Investigations generate lessons that drive refinement.
- Refinement can support responsible innovation.
- Innovation creates new risks that require monitoring and documentation.
The framework is therefore not a linear sequence. It is a learning cycle. That is perhaps the most important Leonardo lesson for the modern CCO.
Completing the Leonardo Compliance Framework
With Leonardo’s notebooks, we complete our five-part framework:
Refine-> Investigate-> Innovate-> Monitor-> Document
Together, these principles describe compliance as an organizational learning system. Effective programs learn from experience, investigate failures to understand root causes, support innovation within appropriate governance, monitor whether controls continue to work, and preserve what the organization learns so that knowledge informs future decisions.
The Mona Lisa taught us to Refine. Compliance programs should improve because organizations learn from experience, changing risks, investigations, employee feedback, and data. Leonardo’s anatomical studies taught us to Investigate. Misconduct should be examined beneath the surface so the organization understands root causes, control failures, incentives, management behavior, and systemic vulnerabilities. His flying machines taught us to Innovate. Compliance should help the company capture the value of emerging technology while maintaining risk-based governance, meaningful human oversight, and clear accountability. The Last Supper taught us to Monitor. Controls can deteriorate as the environment changes, making testing, analytics, ownership, remediation, and continuing oversight essential to program effectiveness. Leonardo’s notebooks teach us to Document.
That provides the essential contrast with Michelangelo. His framework of Challenge, Execute, Defend, Build, and Govern taught a CCO how to construct and operate an effective compliance program. Leonardo teaches a CCO how to keep that program learning and adapting. The modern compliance function needs both disciplines because strong controls can become obsolete if the organization fails to recognize changes in its business, technology, and risk environment.
That combination is particularly important in 2026. AI is accelerating business change, geopolitical developments can alter risk rapidly, third-party ecosystems continue to expand, and boards need evidence that compliance systems work in practice. The CCO cannot administer yesterday’s compliance program while the business builds tomorrow’s operating model.
Leonardo’s notebooks leave us with a simple compliance mandate: learn from what the organization does, preserve what it learns, and use that knowledge to make the organization better.
