Author: Admin

Categories
Regulatory Ramblings

Regulatory Ramblings: Episode 73 – Geopolitical Risk: Thai Tensions / Sanctions, Tariffs & FCPA Enforcement in Asia

This episode focuses on geopolitical risk. In the initial spotlight segment, we speak with veteran journalist and Asia-watcher Christopher Cottrell about the military tensions in Thailand and their implications for the viability of the country’s newly proposed gaming law.

Following that, we chat with AML veteran Richard Butler of Dow Jones and data scientist Haider Mannan of BigTXN about the enforcement of the US Foreign Corrupt Practices Act, sanctions, and tariffs in the wake of recent actions by the Trump administration and the recent airstrikes on Iran.

Christopher Cottrell 

Christopher Cottrell resides in Thailand and has been covering the Indo-Pacific region since 1997, contributing to publications such as The Boston Globe, Christian Science Monitor, CNN, The Guardian, Macau Business, The New York Times, and the South China Morning Post.

He spent 18 years in China and has been reporting on geopolitics in the Pacific Islands and Southeast Asia for the past four years, having edited UK-based Winna Media’s white papers on the Thai Entertainment Complex bill since 2024.

 

 

 

Richard Butler

Richard Butler is the vice president and APAC head of risk and research for Dow Jones & Co. Based in Sydney, Australia, he is responsible for helping businesses with risk and compliance strategies offsetting various forms of regulatory and commercial risk – such as the provision of high-quality, accurate and comprehensive data for identifying, evaluating and monitoring varying types of risk.

Before joining Dow Jones, Richard was the AVP for Treasury Services for Australia and New Zealand at JPMorgan Chase, where he was responsible for ensuring that JPMorgan’s financial institutional and non-bank financial institution clients in Australia and New Zealand adhered to JPMorgan’s best-in-class Know-Your-Customer, compliance, due diligence, and counter-terrorist financing standards. He began his career at ABN AMRO Bank, where he served as both the CAAML (Client Awareness and Anti-Money Laundering) officer and sales manager for the ABN AMRO Treasury Solutions Group in Dublin, Ireland.

Richard is skilled in governance, risk management, and compliance (GRC), as well as team management, direct sales, relationship building, and financial analysis, particularly in the APAC region.

Haider Mannan

Haider Mannan is the CEO and founder of BigTXN, a risk intelligence data provider. He is a data scientist and subject matter expert in investment screening, specializing in ESG controversies, global sanctions, and investment restrictions. He sits on the UK board of the Association of Certified Sanctions Specialists and the membership committee of the UK Sustainable Investment and Finance Association. Haider is also a member of PRMIA‘s advisory expert group on investment risk.

Discussion:

The conversation begins with Chris recounting the threats to Thailand’s security and stability, including the ongoing land border closure and standoff with Cambodia. He recounts with Regulatory Ramblings host Ajay Shamdasani that, notwithstanding its 22 prior coups, military rule, and reputation as a fragile democracy, Thailand has long been the darling of the global investment community, which has long touted its positive long-term economic fundamentals.

He adds the country has curried favor with the West by opening up in ways that many would regard as progressive, such as permitting the sale of cannabis products and paraphernalia, permitting same-sex unions, and seeking to liberalize its gaming sector by tendering a recent bill.

Yet, given the July 1 suspension by the country’s Constitutional Court of Prime Minister Paetongtarn Shinawatra over ethics violations and the weekslong border spat with Cambodia, which has been roiling fears of Thailand’s 23rd coup d’état, the implementation of the new gaming law has been scuttled.

The discussion then shifts to Haider, who shares his thoughts on how data can help investment screening. He and Richard comment on how recent changes in the sanctions landscape, given the current geopolitical climate under the second Trump administration, pose a challenge for compliance and legal staff at banking and financial institutions, as well as multinational corporations.

Related to this are concerns about the implications for Asia regarding the extraterritorial enforcement of the much-dreaded US Foreign Corrupt Practices Act (FCPA) and the prospect of tariff imposition by the White House, as well as the potential for regulatory retaliation by other countries.

It’s worth noting that on June 9, Matthew Galeotti, head of the US Department of Justice’s (DOJ) criminal division, said that under new FCPA guidelines now in place, it would enforce the Act Firmly but fairly.” The comments followed President Trump’s announcement earlier this year that the DOJ would hold off on FCPA enforcement following a review of current standards, as it was believed the existing regulatory regime put US businesses at a disadvantage when competing abroad.

Haider and Richard also discuss why geopolitics matter and the need for lawyers and risk managers to go beyond merely tracking financial news. The conversation concludes with a discussion of a recent case in which the US DOJ’s Office of Foreign Asset Control (OFAC) sanctioned entities/companies in Hong Kong and mainland China that were involved in transferring Iranian oil to China.

Regulatory Ramblings podcasts is brought to you by The University of Hong Kong – Reg/Tech Lab, HKU-SCF Fintech Academy, Asia Global Institute, and HKU-edX Professional Certificate in Fintech, with support from the HKU Faculty of Law.

Useful links in this episode:

You might also be interested in:

Connect with RR Podcast at:

LinkedIn: https://hk.linkedin.com/company/hkufintech 
Facebook: https://www.facebook.com/hkufintech.fb/
Instagram: https://www.instagram.com/hkufintech/ 
Twitter: https://twitter.com/HKUFinTech 
Threads: https://www.threads.net/@hkufintech
Website: https://www.hkufintech.com/regulatoryramblings 

Connect with the Compliance Podcast Network at:

LinkedIn: https://www.linkedin.com/company/compliance-podcast-network/
Facebook: https://www.facebook.com/compliancepodcastnetwork/
YouTube: https://www.youtube.com/@CompliancePodcastNetwork
Twitter: https://twitter.com/tfoxlaw
Instagram: https://www.instagram.com/voiceofcompliance/
Website: https://compliancepodcastnetwork.net

Categories
Blog

COSO’s Corporate Governance Framework: Component 6 – Resilience

We continue our exploration of the recently released COSO  Corporate Governance Framework (the Framework) as a Public Exposure Draft.  Today, we begin a deep dive into the six individual components with a discussion of Component 6—Resilience. In today’s volatile business climate, one thing is sure: disruption is no longer the exception; it has become the norm. Whether it’s a cybersecurity incident, regulatory upheaval, geopolitical instability, or reputational crisis, the organizations that thrive are those that can bend without breaking. That’s why Component 6 – Resilience in the COSO Corporate Governance Framework (CGF) is more than timely; it may well be foundational.

For the compliance professional, resilience isn’t just about bouncing back—it’s about designing governance systems that withstand, anticipate, and even leverage disruption. The CGF reframes resilience as an integrated model that weaves together risk management, compliance, internal control, and continuous monitoring. This final Component of the framework is where compliance moves from policy enforcement to value creation. It is where compliance becomes a partner in operational continuity, strategic foresight, and cultural durability.

What Is the Resilience Component?

COSO defines resilience as the ability to withstand disruption, adapt to change, seize opportunity, and sustain long-term value. It is not reactive firefighting but rather about proactive design. This Component is structured around four principles:

  1. Manage and Oversee Risks and Opportunities
  2. Manage Compliance Responsibilities
  3. Establish and Evaluate Internal Control
  4. Monitor Governance Effectiveness

These principles span strategic, operational, and cultural dimensions of governance, reinforcing that a single function doesn’t own resilience. It’s built collaboratively across the board, executive leadership, internal audit, risk, and yes, compliance.

Why Resilience Belongs to Compliance

Compliance has continuously operated at the intersection of policy, people, and process. But in the Framework view, compliance is a key architect of resilience. Why? Because of the following:

  • Compliance sees how risks evolve across geographies, regulations, and business lines.
  • Compliance manages escalation, remediation, and accountability processes.
  • Compliance helps define the thresholds for risk acceptance and control failure.
  • Compliance monitors ethics and behavior—early indicators of cultural cracks.
  • Compliance is a trusted communicator in times of crisis.

The Resilience Component is our invitation to lead not just to prevent harm, but to build strength.

Five Key Lessons for Compliance Professionals

Lesson 1: Governance Without Risk Integration Is Incomplete

Principle 21: Manage and Oversee Risks and Opportunities

Executive management, with board oversight, must establish a structured, dynamic risk management process that aligns strategy, performance, and risk appetite. The board must allocate oversight of risk areas across committees while maintaining integrated ownership of enterprise-level risks.

Compliance Tip: Engage with your risk management function to ensure your compliance risks, such as regulatory enforcement, third-party integrity, and misconduct, are embedded in enterprise risk registers and heatmaps. Use scenario planning to show how legal and compliance risks could disrupt strategic objectives. Partner with the CRO to lead cross-functional risk workshops that consider both downside risk and upside opportunity (e.g., entering new markets with strong compliance advantages).

Lesson 2: Compliance Is Not a Silo—It’s a System

Principle 22: Manage Compliance Responsibilities

Compliance must be embedded across the enterprise, with clear ownership, independent oversight, robust policies, and responsive change management. The CCO must have the authority, access, and independence to lead an effective compliance program that evolves with risk.

Compliance Tip: Ensure your program includes both centralized compliance (for policy and strategy) and decentralized compliance partners (within functions or geographies). Consistency is key, but so is contextualization. Build a compliance change management protocol that activates when laws shift or operations expand. This should include regulatory horizon scanning, impact assessments, stakeholder training, and updated controls. Resilience depends on staying current, not compliant with yesterday’s standards.

Lesson 3: Internal Control Is Not Just Finance—It’s Enterprise Resilience

Principle 23: Establish and Evaluate Internal Control

Internal controls must support the achievement of operational, reporting, and compliance objectives. Executive management must align controls with ethics, legal obligations, and the entity’s risk profile, and boards must oversee their design and effectiveness.

Compliance Tip: Expand your oversight of controls beyond SOX and financial reporting. Review controls around conflicts of interest, data protection, anti-corruption, and third-party oversight. Collaborate with internal audit and risk to integrate compliance controls into enterprise-wide control frameworks and control testing cycles. Use this alignment to identify duplication, streamline assurance, and enhance board visibility.

Lesson 4: Monitoring Isn’t About Activity—It’s About Insight

Principle 24: Monitor Governance Effectiveness

Governance must be continuously monitored, not just audited periodically. This includes reviewing trends, stakeholder expectations, and gaps in policy or performance. Both the board and management should receive real-time insights on culture, compliance, and risk exposure.

Compliance Tip: Build dashboards that combine hard compliance metrics (e.g., training rates, hotline activity) with qualitative indicators (e.g., engagement survey results, tone-at-the-top assessments). Present these to executive leadership as part of quarterly reporting. Lead a governance “lookback” exercise after key incidents, such as investigations, regulatory inquiries, or market shifts. What worked? What broke down? What signals were missed? This practice turns mistakes into muscle.

Lesson 5: Technology Is a Force Multiplier—Use It to Scale Resilience

COSO highlights the power of technology, like GRC systems, data analytics, and artificial intelligence, to drive smarter, faster governance. Resilience requires visibility and agility, which technology can deliver when thoughtfully deployed.

Compliance Tip: Leverage tech to automate monitoring of high-risk processes, such as gifts & hospitality, vendor onboarding, or export controls. Use exception alerts to flag potential issues before they escalate—pilot predictive analytics for culture and ethics risk. Combine internal data (e.g., survey responses, exit interviews, training patterns) with external signals (e.g., Glassdoor, whistleblower trends) to identify emerging hotspots. That’s how resilient organizations get ahead of reputation-damaging crises.

Building a Resilience-Driven Compliance Program

Use COSO’s Resilience Component as the blueprint for a more integrated, forward-looking compliance program. Here’s how to begin:

  • Risk Integration: Map compliance risks to strategic objectives and ensure alignment with ERM.
  • Compliance Ownership: Assign roles and responsibilities at all levels, with a clear reporting line to the board.
  • Controls Framework: Ensure compliance controls are part of your internal control evaluation process, not isolated.
  • Technology Enablement: Deploy automation and analytics to monitor, report, and adapt.
  • Monitoring Infrastructure: Create a system for real-time visibility and feedback across all six COSO governance components.

This is not simply about regulatory defense. It’s about strategic readiness and stakeholder trust.

What Boards Need to Hear from Compliance

Bring these messages to your next governance, audit, or risk committee meeting:

  • Resilience is the outcome of integrated governance, compliance, risk, internal control, and culture that must work together.
  • Compliance is a strategic partner in managing disruption, not just avoiding penalties.
  • The board should regularly review compliance monitoring dashboards alongside risk and financial data.
  • The compliance function must be properly resourced and independent to support resilience.
  • Resilience is not just bouncing back; it is about designing systems that do not fold under pressure.

When boards see compliance as an enabler of value, not just a cost center, they make better decisions and support stronger programs.

Final Thoughts: Resilience Is the Future of Compliance

The COSO Resilience Component confirms what many of us have been saying for years: compliance must evolve from a reactive function to a proactive pillar of enterprise stability.

Do not simply write the policy. Build the process. Don’t just monitor conduct. Predict behavior. Don’t just advise in hindsight. Prepare with foresight. Because in governance, resilience isn’t a buzzword; it is a business model. And compliance is right at the center of making it real.

To read or comment on the full CGF Public Exposure Draft, click here. The comment period closes July 11, 2025.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Internal Control Improvement

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we look at internal control override. It’s not necessarily bad, but it may indicate that your controls need improvement.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Daily Compliance News

Daily Compliance News: July 10, 2025, The Loyalty Oath Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, including compliance, ethics, risk management, leadership, or general interest, relevant to the compliance professional.

Top compliance stories:

  • Fired officers accuse the NYC Mayor of all PD corruption. (NYT)
  • Goldman to demand loyalty oaths. (Bloomberg)
  • Linda Yaccarino leaving X. (CNN)
  • Measles is at its highest in the US since 1992. (FT)

You can donate to flood relief for victims of the Kerr County flooding by going to the Hill Country Flood Relief here.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 39 – Federation Fundamentals: What “Journey to Babel” Teaches Us About Global Compliance

In the ever-expanding universe of corporate compliance, the question of how to bridge cultural divides is as critical as it is complex. Navigating global operations, integrating diverse teams, and balancing conflicting interests. These challenges would be familiar to Captain Kirk and the crew of the Enterprise, particularly in the Star Trek: The Original Series classic “Journey to Babel.”

Today, we explore five essential cross-cultural compliance lessons, each grounded in a scene from “Journey to Babel.” These insights are not simply for the Starship Enterprise. Instead, they are vital for every compliance professional in today’s globalized business world.

Lesson 1: Cultural Awareness is the Foundation of Trust

Illustrated By: At a diplomatic reception. Ambassadors Sarek (Vulcan) and Gav (Andorian) nearly come to blows over the proposed admission of Coridan to the Federation.

Compliance Lesson: Cultural awareness is the bedrock of ethical business practice. As compliance professionals, we must recognize that every culture brings its perspectives, values, and sensitivities to the table.

Lesson 2: Personal Bias Must Never Trump Professional Duty

Illustrated By: Kirk discovers that Spock’s parents, Sarek and Amanda, are aboard.

Compliance Lesson: Compliance professionals must create policies and foster cultures that prioritize professional integrity above personal interest, even (or especially) when emotions run high.

Lesson 3: Open Communication is Critical in Preventing Escalation

Illustrated By: Tensions flare after Ambassador Gav’s murder.

Compliance Lesson: Silence or closed-door decisions breed mistrust and can quickly escalate a manageable issue into a full-blown crisis.

Lesson 4: Ethical Leadership Means Making the Hard Call

Illustrated By: Kirk, gravely wounded during an assassination attempt, insists on returning to the bridge rather than receiving treatment so that Spock can perform surgery on Sarek.

Compliance Lesson: Effective compliance leaders are those who lead by example, making tough decisions that may be unpopular or personally costly, but which uphold the organization’s mission and values.

Lesson 5: Unity Through Diversity Drives Mission Success

Illustrated By: Despite assassination attempts, sabotage, and political intrigue, the Enterprise ultimately succeeds in its mission.

Compliance Lesson: When managed ethically, cross-cultural teams produce better solutions, more robust risk assessments, and more effective compliance outcomes.

Final ComplianceLog Reflections

“Journey to Babel” reminds us that successful missions, whether in interstellar diplomacy or global business, depend on more than technical expertise or strategic positioning. They require cultural competence, ethical leadership, and a willingness to prioritize the mission over personal interests.

For the compliance professional, the lessons are clear: invest in cultural awareness, build transparency, foster ethical leadership, and leverage diversity as a driver of success. In today’s interconnected world, the road to Babel is one we all travel. It is your job as a compliance professional to ensure we do so ethically, collaboratively, and boldly.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Blog

Boldly Going Together: Cross – Cultural Compliance Lessons from Star Trek’s “Journey to Babel”

In the ever-expanding universe of corporate compliance, the question of how to bridge cultural divides is as critical as it is complex. Navigating global operations, integrating diverse teams, and balancing conflicting interests. These challenges would be familiar to Captain Kirk and the crew of the Enterprise, particularly in the Star Trek: The Original Series classic “Journey to Babel.”

In this episode, the Enterprise is tasked with transporting 114 ambassadors from across the Federation to a pivotal diplomatic conference. The plot thickens as old enmities, conflicting interests, and even attempted murder threaten the mission’s success. At the heart of the episode lies a powerful message: cross-cultural competence is not just an HR catchphrase. It is a critical compliance and ethical imperative.

Today, we explore five essential cross-cultural compliance lessons, each grounded in a scene from “Journey to Babel.” These insights are not simply for the Starship Enterprise. Instead, they are vital for every compliance professional in today’s globalized business world.

Lesson 1: Cultural Awareness is the Foundation of Trust

Illustrated By: The Enterprise hosts a diplomatic reception. Ambassadors Sarek (Vulcan) and Gav (Andorian) nearly come to blows over the proposed admission of Coridan to the Federation.

The opening scenes aboard the Enterprise are a masterclass in cultural complexity. The ambassadors, each representing worlds with deep-seated histories and conflicting interests, demonstrate how easily cultural misunderstandings and political baggage can undermine trust.

Compliance Lesson: Cultural awareness is the bedrock of ethical business practice. As compliance professionals, we must recognize that every culture brings its perspectives, values, and sensitivities to the table. Failure to understand these nuances can breed suspicion and derail collaboration, just as the Vulcan and Andorian ambassadors struggle to find common ground.

Prioritize cultural training as part of compliance education. Ensure that codes of conduct are not only translated but also contextually adapted, and that your team is prepared to identify and address cultural gaps before they become compliance risks.

Lesson 2: Personal Bias Must Never Trump Professional Duty

Illustrated By: Kirk discovers that Spock’s parents, Sarek and Amanda, are aboard. Despite personal tensions—especially between Spock and his father—Spock insists on performing his duties during the crisis, even when Sarek’s life is at stake.

This episode famously reveals Spock’s human mother and Vulcan father, bringing family dynamics into the mix. Yet, when Sarek is gravely injured and a heart operation is required, Spock refuses to leave the bridge while the ship is in danger. His professional commitment outweighs personal emotion.

Compliance Lesson: In cross-cultural or high-pressure environments, personal biases and relationships can threaten objective decision-making. Compliance professionals must create policies and foster cultures that prioritize professional integrity above personal interest, even (or especially) when emotions run high.

Implement clear conflict-of-interest policies and foster an environment where recusal and transparency are not just encouraged but expected—train staff to recognize when personal loyalties or cultural allegiances might compromise objective action.

Lesson 3: Open Communication is Critical in Preventing Escalation

Illustrated By: Tensions flare after Ambassador Gav’s murder. Accusations fly, especially toward Sarek, who had argued publicly with Gav just before his death. The crew’s refusal to jump to conclusions, coupled with ongoing dialogue among all parties, helps keep the situation from spiraling.

The murder mystery at the heart of “Journey to Babel” is propelled by suspicion and lack of trust. Yet Kirk, Spock, and Dr. McCoy consistently push for fact-based investigation, communication, and transparency, resisting pressure to act on rumor or assumption.

Compliance Lesson: When dealing with culturally diverse teams or stakeholders, open and transparent communication is your most effective defense against misunderstanding, rumor, and escalation. Silence or closed-door decisions breed mistrust and can quickly escalate a manageable issue into a full-blown crisis.

Establish robust reporting, investigation, and escalation protocols that emphasize transparency and communication. Utilize regular cross-cultural dialogues and forums to identify concerns before they become compliance issues.

Lesson 4: Ethical Leadership Means Making the Hard Call

Illustrated By: Kirk, gravely wounded during an assassination attempt, insists on returning to the bridge rather than receiving treatment so that Spock can perform surgery on Sarek. Both men make personal sacrifices for the greater good and the safety of the mission.

At the height of the crisis, leadership is defined not by rank but by the ethical choices made. Kirk’s and Spock’s willingness to sacrifice for the mission —Kirk risking his life, Spock postponing surgery on his father —demonstrates that ethical leadership means prioritizing the welfare of the collective over personal comfort or interest.

Compliance Lesson: Effective compliance leaders are those who lead by example, making tough decisions that may be unpopular or personally costly, but which uphold the organization’s mission and values. This is especially true in global environments, where decisions often have cross-cultural ripple effects.

Cultivate leadership at all levels that models ethical decision-making. Recognize and reward those who act in the organization’s best interests, even when it is personally inconvenient. Build ethics into leadership development and performance evaluations.

Lesson 5: Unity Through Diversity Drives Mission Success

Illustrated By: Despite assassination attempts, sabotage, and political intrigue, the Enterprise ultimately succeeds in its mission. Thanks in large part to the combined talents and perspectives of its diverse crew and the ambassadors aboard.

In the final act, the ship faces a Romulan attack, and only through the unique expertise of its multicultural crew does the Enterprise survive. The message is clear: unity does not require uniformity. Diversity of culture, thought, and background can be a superpower when harnessed ethically and collaboratively.

Compliance Lesson: In global organizations, diversity is not a problem to be managed, but an asset to be leveraged. Cross-cultural teams, when managed ethically, produce better solutions, more robust risk assessments, and more effective compliance outcomes. But this only works if compliance programs move beyond lip service to real inclusion and empowerment.

Ensure your compliance program explicitly values diversity, not just demographically, but also in terms of ideas and problem-solving approaches. Involve diverse voices in policy creation, risk assessments, and investigations. Use cultural differences as a resource, not a barrier.

Final ComplianceLog Reflections

“Journey to Babel” reminds us that successful missions, whether in interstellar diplomacy or global business, depend on more than technical expertise or strategic positioning. They require cultural competence, ethical leadership, and a willingness to prioritize the mission over personal interests.

For the compliance professional, the lessons are clear: invest in cultural awareness, build transparency, foster ethical leadership, and leverage diversity as a driver of success. In today’s interconnected world, the road to Babel is one we all travel. It is your job as a compliance professional to ensure we do so ethically, collaboratively, and boldly.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Blog

COSO’s Corporate Governance Framework: Component 5 – Communication

We continue our exploration of the recently released COSO  Corporate Governance Framework (the Framework) as a Public Exposure Draft.  Today, we begin a deep dive into the six individual components with a discussion of Component 5—Communication. Suppose culture is the heart of an organization, and people are its muscle. In that case, communication is the circulatory system, carrying oxygen (information), nutrients (values), and antibodies (escalations and feedback) to every part of the governance body.

Most assuredly, it is not a side note. Communication is a core governance function, equally as critical as oversight, strategy, and culture. This component affirms something that compliance professionals have long known: poor communication creates risk, while effective communication fosters trust, resilience, and accountability. The Framework lays out a comprehensive roadmap for governing the quality, flow, and purpose of information both inside and outside the enterprise. It addresses communication as both a technical capability and a leadership responsibility, making it a perfect area for compliance professionals to lead from the front.

Today, we examine what Component 5 encompasses and identify five actionable lessons for compliance professionals who are ready to champion the communication function in governance.

What Does the Communication Component Cover?

COSO organizes this component around four principles:

  1. Commit to Information Quality
  2. Engage Stakeholders Strategically
  3. Communicate Effectively with Internal Stakeholders
  4. Communicate Effectively with External Stakeholders

Taken together, these principles stress that communication is strategic, multidirectional, and accountable. It is not just about what is said; rather, it is about who says it, how it is said, where it flows, and whether the message enables ethical decision-making, risk awareness, and stakeholder engagement.

Why Communication Matters to Compliance

For compliance professionals, communication is both a tool and a test. How we communicate policies, processes, and expectations shapes how employees behave. How the board receives information determines the quality of its decisions. How stakeholders perceive our transparency defines our license to operate.

More than ever, regulators, investors, and employees demand not just disclosure but meaningful, timely, and values-driven communication. That means compliance must go beyond the whistleblower hotline and annual training; we must build communication systems that enable governance excellence.

Five Key Lessons for Compliance Professionals

Lesson 1: Information Quality Is a Governance Issue—Own the Integrity of the Message

Principle 17: Commit to Information Quality

Boards and management must ensure that all internal and external information is accurate, complete, timely, and relevant to the decisions being made. This includes maintaining systems and controls to validate data and eliminate ambiguity in terminology.

Compliance Tip: Perform a communication audit of compliance reporting. Are your dashboards jargon-heavy or decision-ready? Do your risk reports help the board prioritize issues or confuse the message? Work with IT, internal audit, and risk to deploy governance, risk, and compliance (GRC) platforms that centralize and standardize your reporting. Use these tools not just to track activities but to tell a governance story.

Lesson 2: Stakeholder Engagement Is Risk Management—Make Communication Strategic

Principle 18: Engage Stakeholders Strategically

Executive management must identify key internal and external stakeholders and ensure that appropriate channels exist to share information, solicit feedback, and address concerns. This includes employees, investors, regulators, customers, suppliers, and communities.

Compliance Tip: Map your stakeholder communication channels, including the messages sent to whom, when, and through which medium. Identify gaps where feedback isn’t captured or transparency is lacking. Lead a quarterly cross-functional stakeholder forum with representatives from legal, ESG, investor relations, operations, and compliance. Use it to review messaging consistency, flag potential disconnects, and align on communication strategy for high-impact governance topics.

Lesson 3: Internal Communication Must Flow in All Directions—Not Just Top-Down

Principle 19: Communicate Effectively with Internal Stakeholders

Effective communication within the entity must support timely, secure, and informed decision-making across all departments and levels. It must include not only top-down directives, but also cross-functional collaboration and bottom-up feedback.

Compliance Tip: Evaluate whether your policies and training materials are accessible and understandable to frontline employees. Simplify complex legal language. Reinforce messaging across multiple touchpoints, not just once a year. Establish a compliance “listening architecture.” This could include monthly manager check-ins, anonymous digital suggestion boxes, and cultural pulse surveys. Use the insights to adapt your messaging, identify unspoken risks, and refine your program in real-time.

Lesson 4: External Communication Requires Guardrails—Balance Transparency and Confidentiality

Principle 20: Communicate Effectively with External Stakeholders

Boards and executive management must govern external communications with care, thereby ensuring transparency while protecting sensitive information and aligning with legal, regulatory, and reputational considerations. This includes formal disclosures, media engagement, investor briefings, and even social media interactions.

Compliance Tip: Coordinate with legal, investor relations, and public affairs to ensure external compliance disclosures (e.g., investigations, regulatory actions, ESG updates) are accurate and strategically timed. Recommend creating or expanding the entity’s disclosure committee beyond financial reporting. Include ethics, cybersecurity, and ESG in its scope. This ensures consistent governance over all public-facing statements, not just 10-Ks and earnings calls.

Lesson 5: Escalation Protocols and Whistleblower Systems Are Core Communication Channels

COSO stresses that communication is not simply about planned messaging, but it is about creating pathways for critical issues to reach decision-makers quickly. That includes whistleblower programs, hotline escalation, and crisis protocols that support real-time visibility and accountability.

Compliance Tip: Review your escalation policy. Is it clear when, how, and to whom an issue must be reported? Is there redundancy if a leader is implicated? Does the board know what “red lines” exist? Include whistleblower trends and escalation effectiveness as standing items in your board or audit committee materials. Go beyond volume and share insights about culture, responsiveness, and process quality. That’s how you earn board confidence and budget support.

Building a Governance Communication Program

To operationalize COSO’s Communication Component, compliance leaders should help lead the development of an integrated governance communication program with the following features:

  • Message alignment across all internal and external platforms;
  • Defined roles for who speaks, who approves, and who responds;
  • Feedback mechanisms like surveys, listening sessions, and open-door policies;
  • Secure reporting systems that support anonymity and protect whistleblowers; and
  • Crisis playbooks that define escalation paths, communications teams, and messaging protocols.

The goal? To ensure that communication is not just noise, but a narrative that guides behavior, enables decisions, and builds trust with all stakeholders.

What Boards Need to Hear from Compliance

Here’s what to communicate to your board:

  • The quality of governance depends on the quality of information.
  • Misaligned or confusing communication creates regulatory and reputational risk.
  • Stakeholders expect timely, truthful, and values-aligned information, not just compliance.
  • Compliance has a unique view into cross-functional communication gaps and whistleblower data.
  • The board should actively monitor communication systems and protocols, just as it does financial reporting.

When the board understands that communication is a control, not just a convenience, they will begin to ask better questions and set higher expectations.

Final Thoughts: Communication Is Governance in Motion

To determine whether your governance program is effective, listen to what people say and, equally importantly, what they do not. COSO’s Communication Component reminds us that in governance, silence is a risk, confusion is a vulnerability, and transparency is a strength.

As compliance professionals, we are communicators by necessity, but COSO invites us to become communicators by design. That means building systems that convey messages, address concerns, and connect people to their purpose. Governance is not just about structure; in many ways, it is about story. Make sure yours is told well.

To read or comment on the full CGF Public Exposure Draft, click here. The comment period closes July 11, 2025.

Categories
Hill Country Authors

Hill Country Authors – Exploring Texas History and Writing with Jack Woodville London

Welcome to a new season of the award-winning Hill Country Authors Podcast, sponsored by Stoney Creek Publishing. In this podcast, Hill Country resident Tom Fox visits with authors who live in and write about the Texas Hill Country. In this episode, Tom visits author Jack Woodville London, discussing his intriguing career and novels focused on Texas history.

London, a seasoned courtroom lawyer with a background in aviation accidents, delves into his journey from practicing law to writing creatively. They explore his experiences at Oxford University and his fascination with historical research. London shares insights into his books, particularly the ‘French Letters Series’ and ‘Dangerous Latitudes,’ highlighting lesser-known events in Texas history. The discussion also touches on public education, historical figures, and the Mexico-Texas conflicts, providing a rich tapestry of historical and literary insights.

Key highlights:

  • Jack’s Professional Background
  • Oxford Experience and Writing Journey
  • Books and Writing Process
  • Texas History and Dangerous Latitudes
  • Lamar and Texas Politics
  • Research and Publishing

Resources:

Dangerous Latitudes on Stone Creek Publishing

Dangerous Latitudes on Texas A&M University Press

Stoney Creek Publishing Website

Jack Woodville London Website

Podcast Cover Art

Nancy Huffman Fine Art

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Daily Compliance News

Daily Compliance News: July 9, 2025, The TACO Don Caves Again Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, including compliance, ethics, risk management, leadership, or general interest, relevant to the compliance professional.

Top compliance stories:

  • What happens when your bot goes antisemitic? (⁠NYT⁠)
  • Spanish PM announces new ABC laws amid graft probe. (⁠Bloomberg)⁠
  • Trump pushes back on tariff dates yet again. (⁠WSJ⁠)
  • Vibe coding for compliance. (⁠WSJ⁠)

You can donate to flood relief for victims of the Kerr County flooding by going to the Hill Country Flood Relief ⁠here⁠. 

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Lessons from Internal Control Failures

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we look at what happens when there is an internal control override that leads to a compliance failure.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.