How does compliance demonstrate its value when enforcement priorities change? That question continues to arise in conversations with compliance professionals. It deserves an answer grounded in the work companies need to perform every day: making sound decisions, protecting resources, maintaining trust, and pursuing opportunities within appropriate boundaries.
In a recent conversation with Anik Shah, we explored how compliance can remain relevant during enforcement uncertainty. Anik offered a phrase that captured the responsibility exceptionally well: “responsible steward for managing risk.”
I immediately told him that phrase deserved a blog post. It provides a useful organizing principle for the next evolution of compliance. Stewardship combines professional judgment, business understanding, and accountability. It also establishes an obligation to leave the organization better equipped to manage risk than it was before. For CCOs, that means explaining risks accurately, recommending workable responses, and ensuring that decision-makers understand the consequences of their choices.
Credibility Begins with an Accurate Assessment
Shah emphasized that credibility is the compliance professional’s most important currency. Its value depends on whether management can rely on our advice. When enforcement priorities change, compliance must acknowledge the change. Repeating yesterday’s assessment without examining today’s circumstances weakens our standing with business leaders who can see that the environment has shifted.
The February 2025 the Trump Administration issues an executive order directed a pause in initiating new FCPA investigations and enforcement actions, alongside a review of existing matters. DOJ subsequently issued revised enforcement guidelines on June 9, 2025, emphasizing American economic and national security interests. Those developments changed enforcement policy; they did not repeal the FCPA.
A credible CCO explains that distinction and then examines the company’s actual exposure. Which government interactions, intermediaries, transactions, and jurisdictions warrant attention? What has changed in the likelihood of scrutiny? Which legal obligations and business vulnerabilities remain?
International developments also matter. In March 2025, authorities in the United Kingdom, France, and Switzerland established an anti-corruption prosecutorial taskforce to strengthen collaboration. The European Union’s new anti-corruption directive entered into force in May 2026, with national implementation generally required within two years and additional time for certain provisions. These developments require multinational companies to assess obligations across their operating footprint.
Precision also means avoiding sweeping claims about limitation periods. Counsel should assess the applicable offense, jurisdiction, and any tolling issues. A proposal to extend a limitation period must be described as a proposal. Credibility suffers when an urgent message depends on an overstated legal premise. The responsible steward makes the strongest accurate case available.
Stewardship Turns Analysis into Decisions
Shah described stewardship as leadership: helping the company navigate risk through clear, actionable advice. That requires compliance to understand what the business is trying to accomplish. Consider a hypothetical proposal to enter a new market through a distributor. The distributor has strong government relationships, requests substantial commissions, and provides incomplete ownership information.
A useful compliance assessment connects those facts to a decision. It identifies the information required before approval, explains the concerns surrounding compensation and ownership, and proposes conditions for proceeding. Those conditions might include verified beneficial ownership, documented services, payment controls, contractual protections, and continuing monitoring.
Management should also understand the alternatives. It could use another distributor, narrow the proposed engagement, delay entry while questions are resolved, or abandon the arrangement if material concerns cannot be addressed. This approach gives decision-makers a clear view of the opportunity and its constraints. It also makes accountability visible. Management owns the business decision within established authority; compliance provides independent advice, challenges unsupported assumptions, and escalates unacceptable conduct.
Stewardship includes the willingness to stop a transaction when necessary. Commercial pressure cannot convert prohibited conduct into an acceptable risk. The discipline is to explain the reason, document the decision, and identify a lawful path forward where one exists.
Demonstrate the Business Value of Controls
Shah also identified benefits of compliance that deserve greater attention in management discussions: detecting waste, fraud, and abuse. An expense review may uncover duplicate reimbursement, unsupported entertainment, or spending inconsistent with company policy. Third-party diligence may reveal an undisclosed employee relationship. A review of payments may identify services that were never delivered.
Each finding can protect company resources and improve management information, even where no bribery violation is established. CCOs should make those outcomes visible through evidence. Report substantiated recoveries, recurring control failures, corrective actions, and improvements in review time. Explain how the findings changed a process or prevented a known weakness from continuing.
Be disciplined about financial claims. Hours released for other work do not automatically become cash savings. Estimated losses avoided should be distinguished from money actually recovered. That discipline reinforces the larger argument: compliance contributes to business performance through better decisions and stronger controls. Its value can be demonstrated without assigning a speculative dollar amount to every activity.
Boards should expect that connection. A report showing policy completion rates becomes more useful when it also explains whether employees apply the policy and whether identified weaknesses are being corrected.
Trust Must Be Earned in Daily Operations
Our conversation returned repeatedly to trust. Employees need confidence that raising a concern will lead to a fair response. Business leaders need confidence that compliance advice reflects sound judgment. Directors need confidence that significant issues reach them promptly. Those expectations are connected.
A company that invites employees to speak up must have managers prepared to listen. Reports should receive appropriate attention, investigations should be conducted fairly, and employees should receive meaningful updates within confidentiality constraints. Promotion and compensation decisions reinforce the message. If a manager repeatedly overrides controls yet continues to advance because of strong sales, employees will draw their own conclusions about the company’s priorities.
CCOs should examine those signals with human resources and business leadership. Ask whether ethical conduct affects performance assessments, whether repeat exceptions receive scrutiny, and whether corrective action applies consistently across organizational levels. Stewardship also requires institutional continuity. Document important judgments, develop colleagues, and preserve the reasoning behind significant decisions. A program dependent on one individual’s memory or relationships remains vulnerable when that person leaves.
Use AI to Create More Room for Judgment
AI occupied an important part of our discussion because it can support the work of stewardship. The practical opportunity is to reduce time spent gathering and sorting information so compliance professionals can devote more attention to interpretation, investigation, and advice. Expense review provides a useful starting point. A controlled pilot could assess whether a tool helps identify duplicate submissions, missing documentation, unusual spending patterns, or transactions requiring additional review.
Begin with a defined population and a documented baseline. Compare the tool’s output with experienced reviewers. Examine false positives and missed issues, including a sample of transactions the tool did not flag. Measure total review time, including the effort required to resolve alerts. A flagged transaction should prompt examination. An employee deserves a fair assessment of the facts before any conclusion is reached.
Regulatory monitoring offers another practical use case. An AI-assisted process could collect developments from approved sources, summarize changes, and route potentially relevant items to responsible specialists. Its usefulness depends on verification. The process should preserve the underlying source, distinguish proposals from enacted requirements, identify effective dates, and connect developments to the company’s activities. A confident summary that omits a jurisdictional limitation can send the business in the wrong direction.
For both applications, establish ownership, access controls, confidentiality protections, and procedures for addressing errors. Determine whether the tool is approved to handle the information involved. Review performance when the model, data, or business process changes. The management case should be specific: faster identification of relevant issues, broader review coverage, or additional capacity for substantive advice. Present measured results alongside implementation costs and unresolved limitations.
Success in expense review does not establish suitability for preparing financial statements. Each materially different use requires its own assessment, testing, and accountable oversight. Most importantly, decide how released capacity will be used. Time saved can support deeper third-party reviews, stronger investigations, or earlier involvement in business planning. Technology delivers compliance value when it improves the quality and timeliness of decisions. Professional judgment remains necessary to determine what an anomaly means, what action is proportionate, and when an issue requires escalation.
Put Stewardship into Practice
CCOs can translate this approach into five immediate actions:
- Refresh the risk narrative. Explain what has changed, what remains applicable, and how the assessment affects priorities.
- Provide decision-ready advice. Present options, conditions, owners, and escalation points alongside identified risks.
- Demonstrate operational value. Track substantiated outcomes and distinguish measured benefits from estimates.
- Test trust. Examine reporting experiences, management responses, incentives, and consistency of accountability.
- Pilot AI with clear controls. Define the use case, validate performance, and direct released capacity toward higher-value judgment.
Boards should ask whether compliance has sufficient authority and information to challenge decisions, whether management acts on significant findings, and what evidence demonstrates improvement.
Being a responsible steward for managing risk means accepting responsibility for the quality of the guidance we provide and the capabilities we help build. That is a durable basis for compliance leadership through changing enforcement priorities, new technologies, and the next business opportunity.
