Categories
Blog

Odyssey Week: Leadership: Penelope’s Loom: Integrity Under Pressure

Ed. Note: I was finally able to see the movie The Odyssey. To say it blew me away was an understatement. Even though it didn’t follow Homer’s work precisely or use ancient Greek, I still thought it was great cinema. Anytime you get people talking about the Greek classics, that is a win in my book. So check out the movie and enjoy it. Anne Hathaway was great as Penelope.

Penelope does not get enough credit. Odysseus gets the monsters, the storms, the speeches, the disguises, and the dramatic return. He gets the action scenes. Penelope gets the waiting. If the movie version made one thing clear, such an interpretation sells her short—very short.

Penelope is not simply waiting. She is governing under pressure. Opportunists surround her. The suitors have occupied her home, consumed her resources, pressured her to choose one of them, and treated uncertainty as an invitation to abuse. Odysseus is gone. Authority is contested. Telemachus is young. The house is under stress.

So Penelope does something quietly brilliant. She promises to choose a suitor after she finishes weaving a burial shroud for Laertes. By day, she weaves. By night, she unweaves. She buys time without surrendering the core issue. It is not flashy. It is not a thunderbolt. It is not a sword fight in the hall. It is disciplined patience under pressure.

That is why Penelope belongs in the leadership section of a compliance odyssey. She reminds us that integrity is not always dramatic. Sometimes it looks like refusing to sign the certification, approve the vendor, bless the transaction, release the report, close the investigation, or accept the explanation simply because everyone is tired of waiting.

The Corporate Translation

Penelope is the leader who understands that time pressure is not the same as good governance. Every organization has Penelope moments. The quarter is closing, and someone wants revenue recognized now. A third party has not cleared diligence, but the business sponsor says the relationship is too important to delay. A certification is due, but the control owner is not comfortable with the evidence. A board report needs to go out, but the investigation findings are still incomplete. A product launch is scheduled, but privacy, security, or regulatory concerns remain unresolved. A customer is demanding speed. A senior executive wants closure. The team is exhausted.

And then someone says the magic words: “Can we just move forward?” That is the sound of the loom beginning to tighten. Penelope’s lesson is not that delay is always virtuous. It is not. Delay can be passive, political, cowardly, or evasive. But some delay is not avoidance. It is governance. The question is whether the organization can tell the difference.

Defensible Delay Is Not Obstruction

In compliance, delay has a bad reputation. That is why compliance is known as The Land of No, populated by Dr. No. Sometimes it is the Department of Business (Non)Development. Whatever the moniker is, this is why business leaders often hear “we need more time” as “compliance is blocking the business.” Sometimes that criticism is fair. Compliance functions can be too slow, too opaque, too academic, or too disconnected from commercial reality. A policy review that disappears into a black hole is not governance. It is bureaucracy with a ticket number.

But there is another kind of delay: defensible delay. Defensible delay has a reason. It has an owner. It has a process. It has a timeline. It identifies the unresolved risk and the information needed to make a decision. It is communicated clearly. It is proportionate to the issue. It protects the company from making a false, rushed, or poorly documented commitment.

Penelope’s loom was not random. It had a purpose. It created time when the available choices were bad. That matters in corporate life. A leader who refuses to approve a questionable vendor is not “being difficult” if the due diligence is incomplete and red flags remain unresolved. A CFO who refuses to sign a certification without adequate support is not “overly cautious.” A compliance officer who asks for more facts before closing an investigation is not “dragging things out.” A privacy officer who pauses a product launch because sensitive data controls are not ready is not “anti-innovation.” Sometimes the most ethical sentence in business is “Not yet.”

Culture Is Built in the Waiting

Corporate culture is often revealed by what happens during delay. When a leader says, “We need more information,” does the organization respect the concern? Or does it start applying pressure?

Does the business provide the missing evidence, or does it complain that Legal is slowing things down? Does management support the control owner, or quietly ask for a more “practical” answer? Does the board ask why the delay is necessary or simply demand that the issue be resolved before the next meeting? Does compliance explain the path forward or hide behind process? These moments shape culture.

The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) asks whether a compliance program works in practice, whether senior and middle management have encouraged or discouraged compliance through their words and actions, and whether compliance personnel have sufficient authority, resources, and access to function effectively. It also asks whether employees have practical guidance and know when to seek advice.

That is Penelope’s world. Culture is not only what the company says about integrity. It is whether the company protects people who slow down a decision for the right reasons. If every delay is treated as disloyalty, employees learn to approve first and worry later. That is not agility. That is ethical surrender in business casual.

Ethical Resilience Under Pressure

Penelope is not powerful in the obvious way. She does not command an army. She does not remove the suitors by force. Her resilience is quieter. She endures pressure without surrendering judgment. That kind of resilience is essential in compliance.

Ethical resilience is the capacity to hold the line when the organization is tired, when the facts are inconvenient, when the deadline is real, and when compromise would be easier. It is the controller who insists on evidence. The manager who escalates a concern before approving the payment. The compliance officer who says the investigation is not complete. The board member who asks whether management’s optimism is supported by testing. The executive who tells the team, “We will not do this the wrong way just because the right way takes longer.”

The DOJ Justice Manual states that prosecutors should evaluate a company’s commitment to fostering a strong culture of compliance at all levels, including how the company incentivizes employee, executive, and director behavior through discipline, complaint handling, and compensation plans. That means ethical resilience cannot depend on heroic individuals. The system must support it.

People must know they will not be punished for raising legitimate concerns. Performance goals must not make ethical delay impossible. Leaders must model patience when facts matter. Governance bodies must ask for evidence, not just reassurance. Compliance must help the business move responsibly, not merely tell it to wait. Penelope’s loom works because she has discipline. A company’s compliance program works because discipline is built into the system.

What a Better Compliance Program Does

A better compliance program helps the organization make disciplined decisions under pressure. It defines which approvals require evidence. It gives control owners authority to withhold certifications when support is inadequate. It builds escalation paths for unresolved risk. It documents exceptions and unresolved issues. It trains leaders on how to respond when employees raise concerns. It tracks aging remediation items. It distinguishes between acceptable risk, unresolved risk, and ignored risk. It also makes delay visible.

If a vendor approval is paused, document the reason. If leadership cannot sign a certification, they should know what evidence is missing. If an investigation remains open, there should be a plan. If a product launch is delayed, stakeholders should understand which control or risk issue must be resolved. That is not bureaucracy. That is governance with receipts.

The Compliance Takeaway

Penelope’s loom is a lesson in ethical leadership. She shows that integrity is not always a grand public stand. Sometimes it is a disciplined refusal to be rushed into a bad decision. Sometimes it is the courage to say, “The facts are not ready.” Sometimes it is the wisdom to buy time without losing the trust of those who are waiting.

For compliance officers and business leaders, the challenge is to build organizations where prudent delay is respected and avoidance is exposed. Do not approve the questionable vendor because everyone is tired. Do not sign the certification because the calendar is unforgiving. Do not close the investigation because the subject is influential. Do not bless the transaction because the business has already promised the outcome.

Weave if you must. Unweave if you must. But know why you are doing it, tell the truth about the risk, and make sure the delay serves integrity rather than fear. That is Penelope’s gift to corporate compliance. She reminds us that sometimes the strongest leader in the room is the one patient enough not to make the wrong decision.

Final Thoughts

Taken together, the leadership lessons from The Odyssey show that corporate compliance is not sustained by slogans, heroes, or good intentions alone. The Trojan Horse reminds us that cleverness without discipline can become a control failure; Athena shows that wise counsel must have real authority, resources, and access to challenge power; and Odysseus demonstrates that even brilliant, high-performing leaders can become compliance risks when success becomes a shield from scrutiny.

Telemachus then carries the lesson into succession, showing that governance must survive the absence of the indispensable leader, with authority, control, ownership, and escalation clearly embedded into the business. Penelope completes the leadership arc by reminding us that integrity under pressure is often quiet, patient, and disciplined: the willingness to say “not yet” when facts are incomplete, risks are unresolved, and everyone else wants to move forward. Together, these stories teach that ethical leadership is not simply about winning the battle or reaching Ithaca; it is about building a compliance culture strong enough to resist shortcuts, challenge heroes, survive transitions, and hold the line when pressure is highest.

Categories
AI Today in 5

AI Today in 5: September 2, 2026, The Farmers Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world on compliance, ethics, risk management, leadership, or general interest in AI.

Top AI stories include:

  1. Streamlining compliance reviews with AI. (Business Wire)
  2. Musicians sue Suno. (WSJ)
  3. Consultants heading for a showdown with clients. (FT)
  4. John Deere to create a chatbot for farmers. (Bloomberg)
  5. USDA to use AI and satellites for crop estimates. Farmers are not amused. (Reuters)

For more information on using AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Broken Execution in Day-to-Day Compliance Operations – The BAE Enforcement Action

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into compliance-related topics, literally going into the weeds to explore a subject in greater depth. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the recent BAE export control enforcement action.

Matt views the BAE export control enforcement action as a strong example of how ITAR compliance failures often stem from routine breakdowns in day-to-day operations rather than dramatic smuggling schemes. He notes that BAE’s U.S. subsidiary sent technical information and services overseas without proper licenses, including to China and even some allied countries, showing that export controls apply to both data and services, not just physical weapons. Kelly argues that the case reveals common compliance weaknesses such as poor training, unclear procedures, weak system warnings, and employee turnover that can leave staff unsure of the rules. His broader point is that companies in export-controlled industries must maintain current licenses and build strong, monitored compliance programs because governments will continue using export controls as an important geopolitical tool.

Key highlights:

  • ITAR data shipments trigger BAE’s $36 million penalty
  • Broken execution in day-to-day compliance operations
  • Export-control warnings before sensitive file transmission
  • Missing Red-Flag Prompts in Export Control System
  • Self-Disclosed, Cooperated, Remediated, Monitored by Another Name

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred the Davey, Communicator, and W3 Awards, all for podcast excellence.

Categories
Daily Compliance News

Daily Compliance News: September 2, 2026, The Be Careful, Be Very Careful Out There Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Former Ecuadorian president jailed for corruption. (BBC)
  • Head of Polish POC arrested for corruption. (The Block)
  • Corruption issues abound in the Venezuela oil deal. (FT)
  • FTC sues Amazon over secret ad pricing system. (WSJ)

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on Amazon.com.

Categories
Blog

Odyssey Week: Leadership: Telemachus and the Succession Problem

Ed. Note: I was finally able to see the movie The Odyssey. To say it blew me away was an understatement. Even though it didn’t follow Homer’s work precisely or use ancient Greek, I still thought it was great cinema. Anytime you get people talking about the Greek classics, that is a win in my book. So check out the movie and enjoy it. Tom Holland was great as Telemachus.

Odysseus is away. That is the fact around which Ithaca slowly comes apart. He is not merely on a long business trip. He is not delayed in a regional office because the quarterly review ran over. He has been gone for years. In his absence, the household becomes a leadership vacuum. Penelope holds the center as best she can. Telemachus grows up surrounded by uncertainty. The suitors occupy the palace, consume resources, abuse hospitality, and become more comfortable with every passing day. No one is quite sure who has authority.

And when authority is unclear, misconduct finds a chair at the table. That is Telemachus’s compliance lesson. He is not just the son waiting for his father’s return. He is the next generation of leadership inheriting a control environment weakened by absence, ambiguity, and tolerated abuse.

For modern companies, Telemachus represents the succession problem: what happens to governance, compliance, and accountability when the founder, CEO, general counsel, CFO, chief compliance officer, regional president, or other key executive is absent, distracted, replaced, or functionally unreachable? The company may still have policies. It may still have a code of conduct. It may still have approval matrices, committees, workflows, and board decks.

But the practical question remains: who owns compliance when the person everyone used to ask is no longer there?

The Corporate Translation

Every organization has formal authority and informal authority. Formal authority lives in charters, org charts, delegations of authority, board committee mandates, policy ownership tables, and job descriptions. Informal authority lives in the hallway, the inbox, the founder’s instincts, the CFO’s raised eyebrow, the general counsel’s quiet warning, and the compliance officer everyone calls before doing something adventurous.

The trouble begins when the company depends too heavily on informal authority. The founder knows where the risks are. The CFO knows which regional numbers smell funny. The general counsel knows which agents should never be used. The chief compliance officer knows which managers say all the right things and do something else entirely. The regional leader knows which customer relationships require special scrutiny.

Then one of them leaves, retires, burns out, gets promoted, goes on leave, is distracted by a transaction, or becomes unavailable during a crisis. Suddenly the company discovers that what it called “governance” was partly memory, personality, and habit. That is Ithaca without Odysseus.

Succession Is a Compliance Issue

Succession planning is often treated as a leadership development topic. That is too narrow. Succession is also a compliance issue.

When key people leave, the company can lose risk knowledge, control discipline, escalation history, and institutional memory. Open investigations may drift. Third-party concerns may be forgotten. Exceptions may remain unresolved. Sensitive approvals may migrate to people who do not understand the underlying risks. Business units may exploit the transition. Bad actors may test boundaries. The suitors always notice when the house is lightly supervised.

The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) asks whether a company’s program is well designed, adequately resourced and empowered, and working in practice. It also asks whether policies and procedures are integrated into day-to-day operations, who is responsible for that integration, and whether gatekeepers know what misconduct to look for and when to escalate concerns. Those are succession questions as much as compliance questions. A program that works only when one heroic executive is present does not work in practice. It works in person. That is a very different thing.

Delegation of Authority: Who Can String the Bow?

A delegation of authority matrix is not the most poetic corporate artifact. No one has ever said, “Gather the children by the fire while I tell the thrilling tale of approval thresholds and signature authority.” But delegation of authority matters. It defines who can approve payments, hire third parties, sign contracts, override controls, accept risk, access systems, certify reports, settle disputes, and bind the company.

When delegation is unclear, people improvise. And improvisation is where compliance problems breed. A regional manager approves a vendor because the usual executive is unavailable. A finance employee processes a payment because “someone senior said it was fine.” A business sponsor signs off on due diligence exceptions without understanding the risk. A system administrator grants access because the request came from an important person. A commercial leader commits the company before legal review because the customer needed an answer by Friday.

Each step may feel practical. Each may be defensible in isolation. Together, they reveal a governance weakness. Delegation of authority should answer three basic questions: who can decide, what can they decide, and under what conditions? It should also answer the question most likely to matter in a crisis: who decides when the usual decider is gone?

Control Ownership Cannot Be a Family Secret

In Ithaca, too much depends on Odysseus’s eventual return. That is not a control framework. That is a weather forecast with sandals. Modern companies make the same mistake when control ownership is unclear or overly personalized. Everyone assumes “finance owns that,” “legal handles that,” “compliance reviews that,” “the business manages that,” or “the board knows about that.” Assumption is not ownership. Control ownership should be specific. The owner should understand the risk the control addresses, how the control operates, what evidence demonstrates performance, when exceptions must be escalated, and who serves as backup.

This is especially important in operationally integrated compliance programs. The ECCP emphasizes that compliance policies and procedures should be reinforced through internal control systems and that employees with approval authority or certification responsibilities should receive guidance on what misconduct to look for and when to escalate. That means compliance cannot sit outside the business like a wise statue waiting to be consulted.

It must be embedded into approvals, workflows, reviews, certifications, access rights, vendor onboarding, financial controls, investigations, and reporting channels. Otherwise, when leadership changes, compliance becomes a scavenger hunt.

The Telemachus Problem in Business

Telemachus is not weak. He is inexperienced. That distinction matters. Many next-generation leaders inherit messy control environments. They did not create the old habits. They did not approve the questionable third parties. They did not design the incentive plan. They did not tolerate the difficult executive. They did not ignore the aging audit findings. But they inherit all of it.

That is the Telemachus problem. New leaders often face a painful choice. They can preserve the comfortable ambiguity that made the prior regime work, or they can impose clarity and risk making everyone uncomfortable. Compliance should help them choose clarity.

A new leader should ask, “What are the top compliance risks in this business?” Which controls depend on specific individuals? Which approvals have weak backup coverage? Which investigations or remediation items are open? Which third parties are high risk? Which exceptions have been granted? Which business units have recurring audit findings? Which employees are afraid to speak up? Which senior people are treated as untouchable?

Those questions do not undermine leadership. They establish it. Telemachus cannot govern Ithaca by pretending the suitors are merely enthusiastic guests.

Board Oversight During Transition

Boards of Directors should pay special attention during leadership transitions. A CEO departure, founder transition, CFO replacement, compliance leadership change, merger integration, restructuring, or sudden executive absence can create real compliance vulnerability. It may not appear on the face of the financials. It may not show up immediately in hotline data. But the risk is there.

The board should ask whether interim authority is clear, whether compliance has direct access to leadership, whether key controls remain staffed, whether open issues are being tracked, and whether employees understand where to escalate concerns.

A transition plan should not be limited to investor messaging and organizational charts. It should include compliance continuity. Who owns active investigations? Who signs certifications? Who approves high-risk third parties? Who can grant policy exceptions? Who reports to the board? Who monitors retaliation risk? Who tracks remediation? Who protects records and data? Who communicates expectations to employees? If those answers are unclear, the suitors are already choosing seats.

The Compliance Takeaway

Telemachus teaches us that compliance continuity matters. A company cannot rely on heroic founders, all-knowing executives, indispensable compliance officers, or informal networks of people who “just know how things work.” That may function for a while. It may even feel efficient. But when the key person is gone, the weakness becomes visible. Governance must survive absence.

Authority must be clear. Control ownership must be documented. Delegation must be practical. Oversight must continue. Compliance must be integrated into operations, not dependent on personalities. Because when authority is unclear, misconduct does not wait politely outside the palace. It pulls up a chair, pours the wine, and starts acting like it owns the place.

Join us Tomorrow

Telemachus teaches that governance must survive absence: authority must be clear, ownership documented, and compliance embedded deeply enough that Ithaca can operate without Odysseus in the room. Penelope carries that lesson into the next test, showing what ethical leadership looks like when authority is contested, pressure is relentless. Everyone wants a decision before the facts are ready. If Telemachus asks who owns compliance when the key leader is gone, Penelope asks whether the person with authority has the discipline to say “not yet” to a questionable vendor, weak certification, incomplete investigation, or rushed transaction. Together, they move the leadership arc from succession and continuity to integrity under pressure: first making governance clear, then proving it can hold the line when the suitors demand an answer.

Categories
AI Today in 5

AI Today in 5: September 1, 2026, The Increased Burden Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world on compliance, ethics, risk management, leadership, or general interest in AI.

Top AI stories include:

  1. The new burden for compliance in the age of AI. (Forbes)
  2. How agentic AI is reshaping financial crime compliance. (AML Intelligence)
  3. ChatGPT says it didn’t steal Apple employees; rather, Apple has ‘poor offboarding.’ (WSJ)
  4. ChatGPT faces tougher safety issues in the EU. (FT)
  5. Banks are rethinking legacy SW costs to fund AI. (Asian Banking & Finance)

For more information on using AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.

Categories
Daily Compliance News

Daily Compliance News: September 1, 2026, The Once a Con Man Always a Con Man Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Kalshi permanently bans George Santos. (NYT)
  • Georgia GOP, Ponzi schemes, and return of political contributions. (WSJ)
  • Corruption charges against Lula’s son cast a shadow over the Brazilian Presidential election. (Bloomberg)
  • Trump Administration actions killing off investments in Mexico. (Reuters)

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on Amazon.com.

Categories
Innovation in Compliance

Innovation in Compliance: Paul Welter on AI Legal Reasoning for Embedded Compliance Workflows

Innovation comes in many areas, and compliance professionals need to not only be ready for it but also embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom visits with Paul F. Welter, co-founder at Bayshore AI.

Welter is a German-qualified lawyer whose path into legal innovation began with an early background in software engineering, giving him a rare combination of legal and technical expertise. That experience led him to study how legal reasoning could be automated at Stanford Law School’s Codex, and later to co-found Bayshore AI to build LLM-based tools for in-house legal and compliance teams. He believes AI can help scale legal and compliance support because demand far exceeds human capacity, but he expects adoption to happen gradually through copilots, policy chatbots, and targeted workflow automation rather than a sudden transformation. At the same time, he stresses that regulated companies need systems that are transparent, auditable, and able to show how decisions are made, with human oversight remaining essential for higher-risk matters and regulator-facing accountability.

Key highlights:

  • AI Legal Reasoning for Embedded Compliance Workflows
  • Auditable Legal Decision Logic from Conventional Programs
  • Customer-Specific Policy Logic with Deterministic Compliance
  • Logic translated into code for reviewable decisions
  • Full-time employee days of manual compliance checks
  • AI copilots, compliance workflows, and decision trails

Resources:

Bayshore

Innovation in Compliance was recently honored as the Number 4 podcast in Risk Management by 1,000,000 Podcasts

Categories
Blog

Odyssey Week: Leadership – Odysseus the Brilliant Problem: Tone at the Top

Ed. Note: I was finally able to see the movie The Odyssey. To say it blew me away was an understatement. Even though it didn’t follow Homer’s work precisely or use ancient Greek, I still thought it was great cinema. Anytime you get people talking about the Greek classics, that is a win in my book. So check out the movie and enjoy it. Matt Damon was great as Odysseus.

Odysseus is the kind of leader every board says it wants. He is brave, strategic, persuasive, resilient, creative under pressure, and very good at producing results when the situation looks impossible. He wins wars. He escapes monsters. He talks his way out of death more than once. He is the executive you send into the room when the deal is collapsing, the market is hostile, and everyone else has run out of slides.

He is also, on occasion, his own biggest compliance risk. That is what makes Odysseus so useful for business leaders and compliance professionals. He is not a cartoon villain. He is not reckless in the simple sense. He is brilliant. And brilliance can be dangerous when no one is willing to challenge it.

Odysseus reminds us that tone at the top is not only about what leaders say in polished town halls. It is about how leaders behave when the pressure is real, the stakes are high, and the rules feel inconvenient. The corporate lesson is straightforward: high-performing leaders can create high-performing risk. The organization must be able to challenge its stars.

The Corporate Translation

Every company has an Odysseus. Sometimes he is the rainmaking sales leader who always makes the number. Sometimes she is the visionary founder who can charm investors, customers, regulators, and the board in a single afternoon. Sometimes it is the regional head who delivers growth in difficult markets. Sometimes it is the product leader who moves faster than the control functions can process. The organization loves this person because they win. And that is precisely the problem.

Success can become a shield. Results can become a permission structure. A leader who delivers extraordinary outcomes may slowly become exempt from ordinary scrutiny. Questions that would be asked of anyone else are softened, delayed, or skipped entirely.

  • “How did we win that deal? ”
  • “Why was that third party necessary? ”
  • “Who approved that discount? ”
  • “Why was Legal brought in so late? ”
  • “Why are employees afraid to challenge this person? ”
  • “Why does Internal Audit keep finding exceptions in this business unit? ”

In a healthy culture, these questions are routine governance. In a weak culture, they sound like betrayal. That is the Odysseus problem. He saves the quarter, dazzles the board, and leaves Internal Audit wondering why no one asked how he did it.

Tone at the Top Is Conduct, Not Content

Companies are very good at producing leadership messages. The CEO video. The annual ethics letter. The opening paragraph of the Code of Conduct. The carefully scripted statement that “integrity is our highest value” usually releases the same week everyone is being told to accelerate growth, reduce costs, launch faster, and stop bringing problems without solutions.

Leadership messaging isn’t wrong. It matters. Employees do take cues from senior leaders. The FCPA Resource Guide states that compliance begins with the board and senior executives setting the proper tone and that managers and employees take cues from corporate leaders. It also emphasizes that senior management should clearly articulate standards, communicate them unambiguously, adhere to them, and disseminate them throughout the organization.

Indeed, the Evaluation of Corporate Compliance Programs (ECCP) asks some specific questions. Regarding Conduct at the Top, these questions include: How have they modeled ethical behavior to subordinates? Have managers tolerated greater compliance risks in pursuit of new business or greater revenues? Have managers encouraged employees to act unethically to achieve a business objective or impeded compliance personnel from effectively implementing their duties?

But employees are sophisticated. They listen to the speech, then watch the calendar, the budget, the promotions, the exceptions, and the discipline decisions. They notice who gets praised. They notice who gets protected. They notice whether compliance concerns change decisions or merely create additional paperwork. They notice whether the high performer who bullies employees, ignores controls, or plays games with approvals is treated as a problem or as “complicated.” Tone at the top is not what leadership says when the cameras are on. Tone at the top is what leadership tolerates when the revenue is attractive.

The Danger of the Heroic Exception

Odysseus lives by exception. That is part of his greatness. He survives because he improvises. He adapts. He reads the room, the monster, the god, the storm, and the weakness in every opponent. He does not always follow the obvious path because the obvious path often leads directly into the sea. Unfortunately, exceptions, not properly managed, are what get companies into hot water.

Business needs leaders who can adapt. Compliance should not become a shrine to rigidity. A company that cannot make decisions, approve thoughtful exceptions, or move with commercial urgency will not be admired for its purity. It will simply become irrelevant. But there is a difference between disciplined exception management and heroic exception culture.

Disciplined exception management asks, “What is the risk?” Who owns it? Who approves it? Is the exception documented? Is it time-limited? Are there compensating controls? Will we monitor it? What precedent does it create? Heroic exception culture says, “Odysseus has it handled.” That is not governance. That is mythology with a travel budget. The ECCP asks, “What exceptions to these policies has an organization permitted?”

When organizations build around heroic exceptions, they become dependent on personality rather than process. The leader’s instincts replace controls. Their confidence replaces documentation. Their track record replaces scrutiny. Their urgency replaces escalation.

Eventually, the organization is no longer asking whether the decision is right. It is asking whether it trusts the hero. That is a dangerous way to run a company. Always remember: trust, but verify.

Pressure to Perform Changes the Ethical Weather

Tone at the top is inseparable from pressure. Leaders may say all the right things about ethics and compliance, but if every business conversation ends with “just get it done,” employees hear the real message. If compensation rewards only revenue, employees hear the real message. If managers who raise concerns are labeled as blockers, employees hear the real message. If compliance is praised in public and bypassed in private, employees hear the real message.

The ECCP asks how senior leaders, through words and actions, have encouraged or discouraged compliance, how they have modeled ethical behavior, and whether managers have tolerated greater compliance risks in pursuit of new business or greater revenues. It also asks whether managers encouraged employees to act unethically to achieve a business objective or impeded compliance personnel from doing their jobs.

That is an excellent test for any leadership team. Not, “Did we say integrity matters? But did our conduct make integrity practical? “A leader who sets impossible targets and then expresses surprise when employees cut corners has not created a compliance culture. He has created plausible deniability. Odysseus often survives impossible pressure. Companies should be careful about asking employees to do the same.

Challenging the Star Performer

The true test of tone at the top is whether the organization can challenge its stars. Can compliance question the top sales executive? Can internal audit review the founder’s favorite business unit? Can Legal slow down the CEO’s preferred acquisition? Can HR investigate a high-performing manager accused of retaliation or harassment? Can Finance reject revenue recognition pressure from a powerful regional leader?

Or does the organization quietly apply one standard to ordinary employees and another to those who deliver? Employees do not need a formal policy memo to understand a double standard. They see it immediately. If a junior employee is disciplined for a policy violation while a senior leader is “coached” for comparable conduct, the culture learns. If a high-performing executive is allowed to mistreat people because “the business is too important,” the culture learns that compliance matters only when it doesn’t affect the powerful. If compliance concerns disappear when they involve influential leaders, the culture learns that compliance matters only when it doesn’t affect the powerful.

The ECCP looks at whether compliance is enforced consistently and whether consequences apply regardless of an employee’s position or title. It also asks whether managers are held accountable for misconduct that occurred under their supervision and for supervisory failures. That is not just enforcement logic. It is cultural logic. A company cannot claim integrity as a value while treating performance as immunity.

What a Better Program Does

A better compliance program does not try to eliminate Odysseus. That would be both impossible and unwise. Organizations need bold leaders. They need commercial courage, strategic imagination, persuasive ability, and the confidence to act in uncertainty. The goal is not to make leaders timid. The goal is to make leadership accountable.

A better program builds controls around high-risk authority. It monitors exceptions. It reviews pressure points. It includes compliance in strategic decisions early. It gives the board visibility into recurring overrides, hotline trends, audit findings, employee turnover, and control failures in high-performing units. It trains senior leaders not only on rules but also on how their behavior shapes risk. It also asks uncomfortable questions about success.

Where are results unusually good? Where are margins unusually high? Where are approvals unusually fast? Where are complaints unusually low? Where do people say, “That is just how that leader operates”? Where does the company rely on one person’s relationships, instincts, or influence more than on process? Those are Odysseus questions. The point is not to assume misconduct. The point is to understand that extraordinary performance deserves thoughtful scrutiny, not blind applause.

The Compliance Takeaway

Odysseus is brilliant. That is why he is dangerous. He shows us that leadership risk does not always arrive as laziness, incompetence, or obvious corruption. Sometimes it arrives as charisma. Confidence. Commercial success. Strategic genius. The leader who always finds a way.

Tone at the top means ensuring that even the most successful leaders operate within the company’s values, controls, and accountability structures. It means the Board of Directors and senior executives must model ethical conduct not only in speeches but also in decisions. (Talk the Talk but also Walk the Walk.) It means performance is celebrated but not worshiped. It means the organization can ask its heroes hard questions before the journey turns into an investigation. Every company needs leaders who can win. But no company should become so dazzled by Odysseus that it forgets to check the map, inspect the ship, and ask what happened to the crew.

Join Us Tomorrow

Odysseus reminds us that brilliance can become risk when success turns into a shield, exceptions become heroic, and no one is willing to challenge the leader who always finds a way. But even the most brilliant leader eventually leaves the room, and that is when the next compliance test begins: whether governance survives without the hero. Telemachus inherits the house Odysseus left behind, where authority is uncertain, informal power has filled the gaps, and bad actors have grown comfortable at the table. If Odysseus asks whether top performers are held to the same standards as everyone else, Telemachus asks the follow-up question every board should fear: when the indispensable leader is gone, does the compliance program still work, or was it only working because Odysseus was there?

Categories
Daily Compliance News

Daily Compliance News: August 31, 2026, The Oops, Just Kidding Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • $50MM and a DPA in FIFA FCPA case.(Law360)
  • Trump Administration blacklisting of Anthropic ruled illegal. (WSJ)
  • US corp intelligence firm withdraws claim against trader. (FT)
  • What is really behind Xi’s ABC campaign? (SCMP)

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on Amazon.com.