Ed. Note-we are in the midst of a three-part blog post series on three recent books by Hemma Lomax and Ashley Dubriwny. The are The Art of Ideation, The Art of Celebration and The Art of Implementation.
If The Art of Ideation is about imagining better compliance, The Art of Implementation is about making it real. Hemma Lomax and Ashley Dubriwny write that implementation is where culture lives or dies. That single sentence could serve as a mission statement for every Chief Compliance Officer.
Compliance professionals know this problem well. A program can have a good Code, a strong policy inventory, a well-designed training calendar, a hotline, third-party procedures, and investigation protocols. Yet the DOJ does not ask whether a company has merely created compliance artifacts. It asks whether the program works in practice. It goes directly to the DOJ’s Evaluation of Corporate Compliance Programs (ECCP). The ECCP continues to ask whether a program is well-designed, adequately resourced, empowered to function effectively, and working in practice. That is why The Art of Implementation matters. It moves from aspiration to action. It asks how values become systems, how ideas become habits, and how culture becomes durable.
Lesson One: Mindset Before Method
The book begins with a critical insight: implementation begins with how you think. Lomax and Dubriwny identify four commitments of the culture builder’s mindset: empathy before enforcement, curiosity over control, influence rather than insistence, and legacy as a lens. For compliance professionals, this is not a rejection of enforcement. It is a recognition that enforcement without trust creates fear, not culture. A CCO must enforce standards, discipline misconduct, and protect the company. But a CCO must also understand why employees resist, where controls create friction, and how people make decisions under pressure.
This is the difference between a compliance function that says “no” and one that helps the business get to “yes, with controls.” The former may be respected in moments of crisis. The latter is trusted before the crisis arrives.
Lesson Two: Think, Build, Ship, Adopt, Tweak
One of the strongest frameworks in the book is the five forces of implementation: think, build, ship, see it adopted, and tweak. The model is practical, and it is deeply consistent with the ECCP. Think means design the change with empathy. Build means operationalize the intention. Ship means start before every detail is perfect. Adoption means embed the practice into culture. Tweak means learn, adjust, and improve.
This is what compliance program effectiveness should look like. A CCO should not wait three years to discover that annual training did not change behavior. A third-party control should not remain unchanged after repeated red flags. An AI acceptable use policy should not sit static while employees quietly adopt new tools. A speak-up program should not wait for a scandal before testing whether employees trust it. The compliance application is straightforward. Build compliance like a product. Test. Measure. Listen. Improve.
Lesson Three: Alignment Accelerates Implementation
The book’s discussion of alignment is essential for compliance. Lomax and Dubriwny use Ocean’s Eleven as a cultural reference point. The plan works not because one person is brilliant, but because purpose, people, and process are aligned. Implementation fails when a good idea lacks the right coalition, the right operational fit, or the right timing.
This is a core challenge for the CCO. Compliance cannot implement an effective third-party program without procurement, finance, legal, sales, audit, and business leadership. Compliance cannot govern AI without IT, data science, privacy, cybersecurity, HR, legal, and business users. Compliance cannot build a speak-up culture without managers. Stakeholder mapping is therefore not an administrative exercise. It is a governance control. It identifies who can accelerate the initiative, who can block it, who must own it, and who must maintain it after launch.
Lesson Four: Find Failure First
The pre-mortem section of The Art of Implementation is one of the most useful tools for compliance professionals. The authors ask teams to imagine that an initiative has failed and then work backward to identify why. This is precisely how CCOs should approach major program changes. Before launching a new hotline platform, ask why employees might still avoid reporting. Before deploying AI-assisted monitoring, ask what privacy, bias, transparency, and explainability concerns could arise. Before rolling out a third-party due diligence platform, ask why business teams might work around it. Before redesigning incentives, ask what unintended behaviors the new metrics could create.
Pre-mortems are internal controls in action. They force the organization to identify failure modes before the market, regulator, whistleblower, or plaintiff does. They can and are a powerful tool at your disposal as a CCO or compliance professional.
Lesson Five: Movements Beat Mandates
A particularly powerful theme in the book is the distinction between mandates and movements. Mandates may produce obedience. Movements produce ownership. For compliance professionals, this is a critical distinction.
The Wells Fargo fake sale scandal remains a cautionary tale about mandates, metrics, and fear-based performance pressure. Employees may comply with the apparent demand for results while violating the deeper values of the organization. That is why incentives matter. The DOJ has emphasized that companies should use both incentives and consequences to promote compliance. Its compensation and clawback pilot report states that affirmative metrics and benchmarks can reward compliance-promoting behavior, and that financial penalties can deter risky behavior.
This is where compliance culture becomes real. Employees need to see that ethical leadership, control discipline, speaking up, and responsible business performance are recognized, promoted, and rewarded. They also need to see that misconduct, retaliation, and willful blindness have consequences.
Compliance Application
The CCO’s implementation challenge is to convert program design into operational evidence. That evidence includes adoption data, control testing, investigation metrics, remediation tracking, third-party monitoring, AI use inventories, exception reporting, and incentive alignment. Implementation also requires courage. A CCO must be willing to ship pilots, gather feedback, and make changes. The compliance function must stop treating launch as success. Launch is the beginning. Adoption, evidence, and improvement are the proof.
CCO Questions
Which compliance initiatives have launched but not been adopted?
Do we have stakeholder maps for our most important compliance priorities?
Are we running pre-mortems before major program changes, including AI governance, third-party risk, speak-up enhancements, and incentive redesign?
Do our incentives reward ethical behavior, control ownership, and transparency?
What compliance practices would continue if the current CCO left tomorrow?
Practical Takeaways
- Identify one compliance initiative that stalled and run a pre-mortem on why it failed.
- Build a stakeholder map for AI governance or third-party risk.
- Convert one compliance aspiration into a measurable operating practice.
- Review incentives and promotion criteria for compliance signals.
- Treat implementation as the evidence layer of the compliance program. Regulators do not reward intentions. They evaluate what works.
Implementation is where compliance culture is tested. It is where the organization discovers whether its ideas can survive business pressure, competing priorities, operational friction, and human resistance. Yet even the best implemented program must still be sustained. Controls must be reinforced. Speak-up must be protected. Ethical behavior must be recognized. Employees must see that integrity, not simply performance, is honored by the organization. That is the work of the third book in the trilogy, The Art of Celebration.
Join us tomorrow for Part 3, where we will turn to celebration as a compliance discipline and explore how recognition, incentives, rituals, morale metrics, and cultural memory shape what employees believe the company truly values.