Tag: 2024 ECCP

Categories
Blog

Building a Data-Driven Culture: A Compliance Imperative in the Age of AI

I recently read an article in the Sloan Management Review entitled “Building a Data-Driven Culture: Four Key Elements” by Ganes Kasari, founder and CEO at Tensor Planet. He posits that a data-driven culture is vital to success with AI projects, but shaping one involves many challenges. He suggests that learning how to build one from organizations that have made the journey engaging for employees is one approach to take. For compliance professionals, this is a critical issue. Compliance, risk management, and governance efforts may be ineffective if a company’s workforce does not instinctively turn to data when making decisions.

The Department of Justice’s (DOJ) 2024 Update on the Evaluation of Corporate Compliance Programs (2024 ECCP) has made it clear that compliance programs must be data-driven, proactive, and continuously monitored. But if an organization has not built a culture of data-driven decision-making, compliance will always be playing catch-up.

So, how do companies foster a data-driven compliance culture? Kasari says the answer lies in four key areas:

  1. Leadership Intervention
  2. Data Empowerment
  3. Collaboration
  4. Value Realization

Leadership Intervention: Setting the Tone from the Top

For a compliance program to be truly effective, proactive, and data-driven, leadership must take an active role in championing the importance of data in decision-making. Too often, executives fund compliance initiatives but delegate execution entirely to compliance and IT teams. The result? Employees still see compliance as someone else’s job rather than an integral part of business operations.

The DOJ has emphasized that compliance programs must have engaged leadership. That means:

  • Executives must communicate why data and AI are essential for compliance.
  • Leaders must use data themselves, modeling the behavior they expect from their employees.
  • Regular check-ins and accountability measures should ensure compliance is not just an IT issue but an enterprise-wide priority.

Concept in Action: Rewarding Compliance Innovation at DBS Bank

When DBS Bank launched its digital transformation initiative, CEO Piyush Gupta prioritized creating a culture that rewarded data-driven decision-making and innovation. In one case, an employee made a data-driven compliance decision, ultimately leading to a failed experiment. There was regulatory pressure to penalize the employee, but Gupta stepped in and awarded them instead—for trying, learning, and embracing the new compliance culture.

This kind of visible leadership support sends a powerful message: compliance isn’t just about avoiding penalties but also about building a smarter, more resilient organization.

Data Empowerment: Making Compliance Everyone’s Job

For compliance to be truly embedded in company culture, every employee, not just compliance officers, must be able to access, understand, and act on data.

This means focusing on three levels of readiness:

  1. Data Readiness – Ensuring high-quality data is available at the right time to the right people.
  2. Analytical Readiness – Training employees to interpret compliance data and make informed decisions.
  3. Infrastructure Readiness – Investing in AI-driven compliance tools, automation, and real-time risk monitoring systems.

Concept in Action: JPMorgan Chase and the DeepRacer Challenge

JPMorgan Chase wanted to upskill employees in AI and data analytics. Instead of boring compliance training sessions, the company introduced a global challenge using AWS DeepRacer, a competitive coding event where employees programmed autonomous vehicles to race.

Employees learned data analytics, AI programming, and machine learning principles while having fun. The result? Thousands of employees became data-literate, able to apply AI-driven insights to compliance, risk management, and fraud detection.

Collaboration: Breaking Down Compliance Silos

Too often, compliance sits in its bubble, siloed from business operations. However, in an AI-driven world, compliance must be embedded in every department, from finance and HR to product development and supply chain management.

A major barrier to compliance collaboration is language. Compliance teams often use technical jargon, while business teams use operational language. The result? Miscommunication, resistance, and confusion.

To fix this, compliance functions must invest in:

  • Cross-functional compliance training so business leaders understand compliance risks.
  • Compliance “translators”—employees who bridge the gap between compliance and business operations.
  • AI-powered compliance dashboards that translate risk into actionable business insights.

Concept in Action: Gulf Bank’s Data Ambassador Program

Gulf Bank wanted to embed data-driven compliance across its 1,800 employees. Instead of relying solely on compliance officers, the bank created a network of data ambassadors—employees across departments trained to champion compliance best practices.

The results were impressive: employees felt more ownership over compliance decisions, and the company saw a significant reduction in compliance violations.

Value Realization: Measuring and Celebrating Compliance Success

One of the companies’ biggest mistakes is treating compliance as a cost center rather than a value driver. Compliance isn’t just about avoiding fines—it’s about driving better business decisions.

To ensure compliance is seen as a competitive advantage, companies must:

  • Define clear KPIs to measure compliance impact.
  • Track and communicate compliance success stories internally and externally.
  • Tie compliance initiatives to tangible business outcomes (e.g., revenue growth, cost savings, enhanced brand reputation).

Concept in Action: AI-Powered Warehouse Compliance at a Logistics Firm

A cold chain logistics company struggled with inefficient warehouse scheduling, leading to regulatory fines and supply chain bottlenecks. The compliance team introduced an AI-driven scheduling system, analyzing weather data, shipment history, and supplier reliability to optimize deliveries.

The results?

  • 16% reduction in turnaround time
  • $1.2 million saved annually in avoided fines
  • Increased customer satisfaction

To celebrate this success, the company shared the story through internal newsletters, town halls, and webinars, ensuring that employees saw compliance as a strategic enabler rather than just a legal requirement.

Compliance in the Age of AI

The DOJ’s 2024 guidance has made it clear that compliance programs must be data-driven, proactive, and continuously monitored. But simply investing in AI tools isn’t enough. Companies must build a truly data-driven culture where compliance is instinctive, embedded, and embraced across all levels of the organization.

The key takeaways?

  1. Leadership must champion compliance—not just fund it.
  2. Compliance must be accessible, understandable, and actionable for all employees.
  3. Cross-functional collaboration is essential to break down compliance silos.
  4. Compliance success must be measured, celebrated, and tied to business impact.

In 2025 and beyond, companies that embed AI-driven compliance into their culture will not only avoid regulatory fines and penalties or even FCPA violations, but they will also gain a competitive edge in an increasingly complex business world.

Categories
Blog

From Sanctions to AI Disruption: How Compliance Officers Can Navigate the Rapid Pace of Change

The pace of change in today’s global business environment is breathtaking. Events that unfold over a weekend can have massive implications for corporate compliance professionals by Monday morning. When there is a business change, risks constantly change. Over the past week, this was demonstrated with two seemingly unrelated but equally impactful developments:

  • The U.S. is imposing sanctions on Colombia because of its alleged failure to take back migrants, including a 25% tariff on goods imported from the country.
  • The emergence of DeepSeek, a Chinese AI company that has developed a large language model rivaling OpenAI’s ChatGPT—at a fraction of the cost.

For the compliance professional, what do these risks mean for your organization? What do you think about a framework for assessing and managing these risks as they raise critical compliance concerns spanning sanctions enforcement, export controls, supply chain transparency, and regulatory readiness? In the most recent episode of the FCPA Compliance Report, I explored these issues with Jag Lamba, CEO at Certa.ai. We focused on the Department of Justice (DOJ) framework in its 2024 Update to the Evaluation of Corporate Compliance Programs (2024 Update) to make sense of and respond to these rapid developments.

The DOJ’s framework in the 2024 Update is broken down into three key components:

  1. Is the compliance program well-designed?
  2. Is the compliance program adequately resourced and empowered to function effectively?
  3. Does the compliance program work in practice?

We applied these elements to the recent developments and explored how compliance professionals can prepare for similar shocks in the future.

  • Is Your Compliance Program Well-Designed to Handle Rapidly Emerging Risks?

The first test of a compliance program is whether it is designed to assess, identify, and mitigate risks promptly. The DOJ has emphasized real-time risk assessment—a shift from static, once-a-year reviews to continuous monitoring.

Take the U.S. sanctions against Colombia. This was not a predictable, drawn-out regulatory action. It happened over a weekend, and by Monday, businesses importing Colombian goods faced a 25% tariff with little time to prepare. Compliance officers had to:

  1. Quickly identify how much of their supply chain relied on Colombian imports.
  2. Determine if alternatives existed to mitigate the cost impact.
  3. Communicate rapidly with leadership to ensure the company could pivot operations where needed.

A traditional, slow-moving risk assessment process would have left companies flat-footed. Instead, an agile risk management system, leveraging real-time data analytics and automated monitoring, can help companies proactively spot emerging risks before they become crises.

The same logic applies to export controls in the tech sector, especially in light of the DeepSeek development. Compliance officers at major AI and semiconductor companies must now be asking:

  1. Who are our customers in Singapore and neighboring markets?
  2. Are our chips being resold or rerouted to sanctioned entities in China?
  3. Do we have automated tools to track and verify shipments to ensure compliance with U.S. export control laws?

It may be too late to prevent regulatory scrutiny if a company relies on manual risk assessments and outdated compliance processes.

  • Is Your Compliance Program Adequately Resourced and Empowered?

The DOJ has clarified that a compliance program is only as good as the resources allocated to it. Ten years ago, the conversation centered around whether compliance officers had direct access to the board. The conversation then shifted to the quality of your Chief Compliance Officer (CCO) and compliance personnel. Today, the discussion is shifting to whether compliance has the technology, data, and personnel necessary to operate effectively.

Consider the situation with NVIDIA and its skyrocketing sales in Singapore—a market that, while business-friendly, is geographically close to countries facing strict U.S. export controls. Regulators are undoubtedly scrutinizing this data. The question for NVIDIA’s compliance team is:

  1. Do they have the visibility to track where these chips are ending up?
  2. Are they able to monitor sales intermediaries in real time?
  3. Can they preemptively flag anomalies—such as a single country purchasing a huge volume of restricted technology?

Without AI-driven compliance monitoring and data analytics, even the best compliance teams risk being overwhelmed by the sheer volume of transactions and regulatory changes.

Similarly, companies impacted by the Colombian tariffs must ensure their compliance programs have the right supply chain monitoring tools to:

  1. Identify impacted suppliers instantly.
  2. Assess alternative sourcing options without regulatory hurdles.
  3. Develop contingency plans to mitigate financial and operational risks.

This compliance function cannot be effectively run using spreadsheets and email chains. Companies must invest in data automation, AI-driven analytics, and cross-functional collaboration tools to avoid such fast-moving regulatory changes.

  • Does Your Compliance Program Work in Practice?

Finally, compliance programs must not exist solely on paper but must demonstrate real-world effectiveness. The DOJ’s 2024 Update mandates data-driven evidence to assess whether a compliance program is functional and effective.

This means compliance teams must be able to show:

  1. How many third-party vendors and intermediaries have been vetted and monitored?
  2. How export controls are enforced in practice—not just documented in policy.
  3. How quickly can the company respond to a sudden regulatory change, such as the Colombian sanctions?

One of the best ways to demonstrate effectiveness is through compliance storytelling. A compliance officer should be able to present:

  • This is a clear narrative backed by data showing how the company detected and addressed a regulatory risk before it became a crisis.
  • These are case studies of how compliance actions have improved business outcomes—for example, reducing onboarding time for sales intermediaries without compromising compliance integrity.
  • Tangible evidence includes video training logs, compliance dashboards, and documented decision-making trails.

A powerful example comes from a Fortune 100 company that secured five years of compliance funding in one go rather than having to renegotiate budgets annually. How? By presenting compliance in business terms:

  • Demonstrating how compliance efficiencies improved sales and reduced onboarding delays.
  • Showing the financial impact of proactive risk management.
  • Using data-driven evidence to justify long-term compliance investments.

This is the future of compliance: a function that prevents regulatory risk and actively contributes to business strategy and growth.

The CCO as a Strategic Risk Navigator

The recent developments with Colombian sanctions and DeepSeek’s AI breakthrough highlight how fast compliance risks can evolve. Sanctions, export controls, and regulatory enforcement actions are no longer slow-moving threats—they can materialize overnight.

The DOJ’s 2024 Update provides a clear roadmap for compliance professionals to navigate these challenges:

  1. Risk assessment must be dynamic and continuous. Compliance programs must be designed to identify risks in real-time, not just during annual reviews.
  2. Compliance must be adequately resourced. Companies must invest in technology, data analytics, and automation to meet regulatory changes.
  3. Compliance must demonstrate real-world effectiveness. Data-driven evidence, compelling narratives, and tangible business impact must back compliance programs.

Compliance professionals who embrace data-driven decision-making, automation, and proactive risk management will not only survive but thrive in this era of regulatory volatility. The question is: Is your compliance program ready for the next unexpected headline?

Categories
FCPA Compliance Report

FCPA Compliance Report – Jag Lamba on Navigating Compliance Challenges in a Rapidly Changing World

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast on compliance. In this episode, Tom welcomes Jag Lamba, CEO of Certa.AI, the podcast’s sponsor.

We look at the recent events involving economic and trade sanctions levied on Colombia (now withdrawn) and the announcement of DeepSeek as a cost-effective competitor to ChatGPT in the AI space to discuss how quickly your risks can change. We overlay this discussion through the lens of the DOJ’s 2024 Update on the Evaluation of Corporate Compliance Programs (2024 ECCP). Jag provides insights on how compliance officers can proactively manage risk amidst rapidly changing global landscapes by ensuring their programs are well-designed, adequately resourced, and effective. Key takeaways include the importance of data, controls, and technology in building robust compliance frameworks and using business impact and ROI to secure necessary resources.

Key highlights:

  • Current Events Impacting Compliance
  • 2024 ECCP-Designing a Well-Structured Compliance Program
  • 2024 ECCP-Adequate Resourcing for Compliance Programs
  • 2024 ECCP: Effectiveness of Compliance Programs in Practice
  • Proactive Risk Management Strategies
  • Export Controls and Compliance Challenges

Resources:

Jag Lamba on LinkedIn

Certa.ai

Categories
Blog

How Compliance Can Leverage Agentic AI Systems, Part 2

Agentic AI systems, with their unique ability to operate autonomously, present a game-changing opportunity for corporate compliance functions. In a recent article in Bloomberg entitled “Using AI Agents Requires a Balance of Trust, Privacy, Compliance,” Sabastian Niles, President, and Chief Legal Officer of Salesforce, discussed AI agents’ roles. Today, we, therefore, enter the world of agentic AI systems. Understanding this new breed of AI is essential for compliance professionals to harness its power responsibly while safeguarding trust, privacy, and compliance.

Unlike traditional chatbots or large language models that are limited to providing static responses, Agentic AI systems can analyze complex data, adapt to new information, and take actions based on predefined parameters. This capability can revolutionize compliance operations by introducing efficiencies, enhancing decision-making, and improving the organization’s ability to anticipate and respond to risks. However, leveraging these systems effectively requires compliance professionals to approach them thoughtfully and strategically. Over this three-part blog series, I will explore what Agentic AI systems are, how they can be used in compliance, and how to use Agentic AI going forward. In Part 2, we look at how compliance can use Agentic AI systems.

Understanding the Potential of Agentic AI in Compliance

Agentic AI is distinguished by its autonomy. These systems do not simply respond to queries; they execute tasks, provide actionable insights, and adapt to changing circumstances with minimal human intervention. For compliance professionals, this shift represents an opportunity to go beyond even monitoring and detection. Instead, compliance teams can integrate AI agents into their workflows to proactively manage risks, enhance internal processes, and improve the organization’s overall compliance posture. Here are some specific ways agentic AI systems can be applied within the compliance function.

Automating Routine Tasks. Many compliance activities are repetitive and resource-intensive, leading to inefficiencies and bottlenecks. Agentic AI can streamline these processes by handling internal inquiries. AI agents can respond to frequently asked compliance questions from employees, such as clarifications on company policies, reporting obligations, or training requirements. This reduces the workload on compliance officers while ensuring consistent and accurate responses.

Agentic AI can assist in managing external counsel and external consultant relationships. For companies working with multiple external legal advisors, Agentic AI can automate the tracking of legal expenses, performance metrics, and case statuses, providing a centralized view of outside counsel activities. Finally, Agentic AI can be a game-changer in monitoring transactions on a real-time and ongoing basis. Agentic AI systems can autonomously review large volumes of financial transactions to identify red flags, such as unusual payment patterns or potential violations of anti-corruption laws.

  • Enhancing Decision-Making

Compliance often involves making decisions based on a wide array of data, from regulatory updates to internal audit findings. Agentic AI can enhance this process by providing real-time insights. It can analyze data across the organization to identify emerging risks, such as changes in geopolitical conditions or new regulatory developments, and provide recommendations on how to address them.

Agentic AI can also help reduce human error. Agentic AI can help eliminate biases or oversight errors in compliance assessments, ensuring that decisions are more objective and accurate. It can also model the potential impact of regulatory changes or proposed business initiatives, allowing compliance teams to anticipate challenges and provide informed guidance to leadership.

  • Driving Resilience

The regulatory environment is constantly evolving under the second Trump Administration, and organizations must be able to adapt quickly. Agentic AI can help compliance teams stay ahead by monitoring regulatory changes. It can automatically track and analyze updates to laws and regulations worldwide, highlighting changes relevant to the organization and suggesting actions to ensure compliance.

One of the key areas the Department of Justice communicated back in 2020 and brought forward in the 2024 Update to the Evaluation of Corporate Compliance Programs (2024 Update) was the need for risk assessments as your risk changes. Agentic AI moves you to a level beyond this with proactive risk assessments. By analyzing internal and external data, AI systems can identify vulnerabilities and recommend preventive measures, reducing the likelihood of compliance failures. It can also assist in your incident and triage process by investigating the issue, gathering evidence, and suggesting corrective actions, enabling the organization to respond more effectively.

Managing the Risks of Autonomy

While the autonomy of agentic AI systems offers significant benefits, it also introduces new risks that compliance professionals must address. Poor data quality and bias will still generate suboptimal results. Poor-quality or incomplete data can lead to incorrect or biased outputs from AI systems. Compliance teams must ensure that the data used by these systems is accurate, representative, and regularly updated.

The autonomous nature of Agentic AI means that organizations must establish clear guidelines for oversight and accountability. This includes defining when human intervention is required and ensuring that AI decisions align with organizational values and regulatory requirements. Finally, there are the dual areas of transparency and accountability. One of the most critical challenges with agentic AI is understanding how the system arrives at its decisions. Compliance teams must advocate for transparency in AI operations and develop mechanisms to explain decisions to regulators, stakeholders, and employees.

Steps for Compliance Teams to Adopt Agentic AI

To maximize the benefits of agentic AI while minimizing its risks, compliance teams should take the following steps:

  1. Assess Current Processes. Begin by identifying compliance activities that are repetitive, time-consuming, or prone to error. These are often the best candidates for automation through agentic AI.
  2. Pilot AI Applications. Before deploying AI across the entire compliance function, start with pilot projects in specific areas, such as policy monitoring or transaction reviews. Use pilots to test the system’s capabilities, identify potential risks, and gather feedback.
  3. Strengthen Data Governance. Agentic AI relies heavily on data, making strong data governance practices essential. This includes implementing controls to ensure data accuracy, managing access to sensitive information, and maintaining compliance with data privacy regulations.
  4. Develop Ethical Guidelines. Work with cross-functional teams to establish ethical guidelines for AI use. These guidelines should cover issues such as transparency, accountability, and acceptable use and should be reviewed regularly to reflect evolving best practices and regulatory standards.
  5. Provide Training and Support. Compliance teams must be equipped to work effectively with AI systems. Offer training to help team members understand how agentic AI works, how it can be used responsibly, and their role in overseeing its operations.
  6. Establish a Feedback Loop. Implement processes for continuously monitoring AI performance and gathering feedback from users. Use this information to refine the system and address any issues that arise.

Down the Road

Agentic AI systems represent a powerful tool for compliance functions, offering the potential to enhance efficiency, improve decision-making, and build resilience. However, these benefits can only be realized if the technology is implemented responsibly. Compliance professionals must balance leveraging AI’s capabilities and maintaining the trust, privacy, and ethical standards critical to the organization’s success.

By taking a proactive approach to understanding and adopting agentic AI, compliance teams can streamline their own operations and position themselves as strategic partners in driving the organization’s broader innovation and risk management efforts. The question is no longer whether compliance teams should embrace agentic AI but how they can do so responsibly and effectively.

Categories
Blog

Top Compliance Leadership Skills for the Wild Wild West that is Coming – Part 1, Fairness

Today, Donald Trump will be inaugurated as the 47th President of the United States. I can only say with complete certainty that the world of compliance will never be the same after today. Trump promises tariffs and sanctions against America’s enemies, competitors, and friends. His views on the Foreign Corrupt Practices Act (FCPA) are well known (‘a horrible law’), and so are his views on bribery.

He may well be the first President to employ the FCPA as a weapon against companies from countries that are not only the US’s enemies and competitors but also our allies. This is nothing to say about how he will direct the Department of Justice to use the Foreign Extortion Prevention Act (FEPA) against our enemies, competitors, and allies. So get ready for the Wild West of corporate compliance for the next four years.

As compliance professionals face this miasma in 2025, compliance leadership skills will be more critical than ever. With these new, renewed, and mounting regulatory pressures, declining employee engagement, and intensifying demand for ethical corporate governance, the role of compliance leaders has never been more pivotal or challenging.

To navigate the first part of this Wild West, I propose three leadership skills for the Chief Compliance Officer (CCO), compliance professional, or compliance practitioner to focus on. One faces outward, one faces inward, and the third relates to your attitude. They are (1) fairness, (2) curiosity, and (3) a sense of humor. These three skills will enhance your team’s effectiveness and strengthen your organization’s overall compliance posture.

Fairness: The Cornerstone of Compliance Leadership

Fairness is the bedrock of a strong compliance culture. Employees who perceive their leaders as fair are likelier to adhere to policies, report concerns, and contribute to an ethical workplace. With 70% of workers dissatisfied with their pay and disengagement on the rise, fairness is no longer optional; it is essential. You only need to conference the entire controversy around Return to the Office (RTO) at JP Morgan when, as the Wall Street Journal reported, the company disabled its internal chat function because of the plethora of negative comments on the full implementation of RTO. Talk about not wanting to hear what is on your employees’ collective minds.

Fairness extends beyond legal compliance into the realm of interpersonal relationships. For compliance leaders, this means:

1. Relationship Justice-Treating employees with professionalism, dignity, and respect

Relationship justice is the foundation of trust in any organization and a critical component of compliance leadership. It involves treating employees as valued contributors, respecting them, and maintaining professionalism. Leaders who model relationship justice foster an environment where employees feel psychologically safe to raise concerns, share ideas, and report potential misconduct. For compliance professionals, this means actively listening to employee feedback, addressing grievances promptly, and avoiding behaviors that could be perceived as favoritism or bias. Consistently demonstrating respect and dignity reinforces ethical culture and strengthens employee morale and engagement, making them more likely to align with compliance initiatives.

2. Task Justice- Ensuring decisions are transparent and consistent.

Task justice focuses on the “how” of leadership—how decisions are made, communicated, and executed. Transparency is key to task justice; employees should understand the rationale behind decisions, especially when they affect their roles, responsibilities, or compensation. Consistency is equally important, as arbitrary or unpredictable decision-making undermines trust and can lead to perceptions of unfairness. Compliance leaders can implement task justice by using structured frameworks for decision-making, such as compliance risk matrices, and by documenting the process for policy updates or disciplinary actions. Clear communication of decisions and opportunities for employees to ask questions or provide feedback ensures that everyone feels included and informed, reducing resentment and fostering collaboration.

3. Distributive Justice – Aligning rewards with individual contributions

Distributive justice ensures that rewards, recognition, and outcomes are proportionate to the effort and contributions of individual employees. This dimension of fairness requires leaders to assess performance objectively and ensure that rewards—whether promotions, bonuses, or simple recognition—are distributed equitably. For compliance professionals, distributive justice can manifest in recognizing team members’ contributions to audits, investigations, or training programs. Leaders should avoid blanket recognition that overlooks individual effort and tailor rewards to highlight specific accomplishments. Employees who feel their contributions are valued and acknowledged are more likely to remain engaged, motivated, and committed to compliance goals. Ultimately, distributive justice reinforces the message that ethical behavior and hard work are consistently rewarded.

The CCO is pivotal in embedding fairness within the compliance program and the broader corporate culture. The DOJ refers to this as Institutional Justice and Fairness in the 2024 Evaluation of Corporate Compliance Programs. Whatever you (or the DOJ) might call this, the CCO must prioritize transparency, consistency, and respect across all compliance and cultural touchpoints to achieve this.

First, fairness starts with transparent processes in the compliance program. The CCO should establish clear protocols for investigations, audits, and disciplinary actions, ensuring employees understand the steps and criteria used in decision-making. The CCO can reduce bias and promote consistency by leveraging tools such as decision matrices or documented frameworks. Regular communication about compliance updates, policy changes, and enforcement actions reinforces transparency and builds trust.

Second, fairness in corporate culture is achieved through relationship-building and recognition. The CCO should foster open dialogue by creating channels for employees to voice concerns without fear of retaliation. Training programs emphasizing fairness—such as workshops on unconscious bias or ethical leadership—can cultivate a more respectful workplace. The CCO must ensure that ethical behavior and contributions to compliance efforts are consistently acknowledged and rewarded.

Ultimately, by modeling fairness in leadership and weaving it into compliance processes and cultural practices, the CCO sets the standard for ethical behavior, fostering employee trust and long-term organizational integrity.

Join us tomorrow to explore curiosity and the CCO/compliance professional.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 3- Key Updates in the ECCP: Messaging Apps, Internal Controls, and Compensation

Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.

In today’s episode, we delve into the significant updates in the evaluation of corporate compliance programs, focusing on messaging apps, internal controls, and adequate compensation. The revised language in the ECCP highlights the DOJ’s increased scrutiny on the use of messaging apps, emphasizing the need for tailored policies that align with a company’s specific risks and business needs. We also discuss the critical importance of internal controls as minimum expectations set by the DOJ, and the necessity of continuous monitoring to manage these risks effectively. Lastly, we examine the newly added provisions related to adequate compensation, ensuring that compliance teams are empowered and protected against retaliation. The episode concludes by summarizing three key takeaways for compliance professionals: the growing importance of communications compliance, the need for robust and functional internal controls, and the imperative of adequately compensating compliance personnel.

Key Highlights

  • Messaging Apps and Compliance
  • Internal Controls and Risk Management
  • Adequate Compensation for Compliance Teams

Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 2-2024 ECCP on Incentives, Consequences, and Clawbacks

Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days series in January 2025, I will post a key part a best practices compliance program each day. By the end of January, you will have enough information to create, design or enhancement a compliance program. Each podcast will be short, at 6-8 minutes with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will plan to join each day in January for this exploration of best practices in compliance.

In this episode, we discuss how the Department of Justice (DOJ) has emphasized the importance of designing and implementing compliance-based compensation schemes. Financial incentives, such as deferred or escrowed compensation tied to conduct, play a critical role in fostering a culture of compliance. The episode also explores the necessary continuum of assessment, analysis, implementation, and monitoring that companies must follow for effective compliance incentive programs. Additionally, Tom covers the DOJ’s rigorous approach to consequence management, particularly concerning clawback provisions in executive contracts. The episode guides compliance professionals on the essential steps and analyses required to adhere to the enhanced DOJ expectations. Key takeaways include the importance of financial incentive analysis and the distinct yet related roles of clawbacks and consequence management within a compliance program.

Key Highlights

  • Starting with Incentives and Consequences
  • Incentive Program Breakdown
  • Consequence Management Deep Dive

Resources

Listeners to this podcast can receive a 20% discount to The Compliance Handbook, 5th edition by clicking here.

Categories
Blog

AI in Compliance: Part 5 – Leveraging AI for Continuous Monitoring

In Part 5, we conclude our five-part series on using AI in a compliance program. In today’s concluding blog post, we look at using AI for continuous monitoring. Traditional monitoring and auditing approaches, typically reliant on periodic audits and manual reviews, are simply not sufficient in this post-COVID world of instant Black Swan events. Enter artificial intelligence (AI), a transformative tool that enables continuous monitoring and reporting across financial transactions, procurement processes, and operational activities.

AI allows compliance professionals to set customized thresholds for acceptable behavior, flag anomalies, and generate tailored reports that provide actionable insights to stakeholders. This strengthens the compliance function and aligns with the DOJ’s 2024 Evaluation of Corporate Compliance Programs (2024 ECCP) emphasis on dynamic, data-driven compliance systems. Today, we will explore how AI reshapes continuous monitoring and reporting, its best applications, and how to implement it effectively while addressing deployment challenges.

The Case for Continuous Monitoring with AI 

Continuous monitoring is the backbone of a proactive compliance program. It enables organizations to complete several different compliance tasks, including identifying issues in real time. Instead of waiting for the next audit or whistleblower report, AI-driven monitoring systems can detect anomalies as they occur. This allows you to mitigate risks early, as prompt alerts allow compliance teams to investigate and remediate potential violations before they escalate. Finally, it enhances accountability, as automated monitoring creates an auditable trail of compliance activities, bolstering transparency and trust. AI amplifies these benefits by processing vast amounts of data, identifying patterns, and learning from new information.

Applications of AI in Continuous Monitoring

There are several ways AI can assist the compliance professional. In financial transactions, AI-powered systems can analyze financial transactions to identify irregularities that might signal fraud, corruption, or money laundering. AI can do so by flagging a series of payments under the approval threshold to a vendor in a high-risk jurisdiction. Such notice would allow compliance or internal audit to investigate whether these payments circumvent anti-bribery controls, potentially averting an FCPA violation.

This type of monitoring is the backbone of compliance detection, but now it can be done in real time. AI can detect round-dollar payments, split invoices, or unusual payment patterns. It can also monitor transactions against sanction lists and politically exposed persons (PEP) databases. Finally, AI can analyze historical data to refine thresholds and reduce false positives.

AI is equally proficient in the procurement process, where multiple areas of compliance risk can arise, including bribery, conflicts of interest, and vendor fraud. An example might be when AI detects a pattern where a single employee consistently selects a particular vendor despite higher bids or less favorable terms. The result could be an investigation that reveals a conflict of interest, enabling swift corrective action.

AI is also well suited for monitoring potential conflicts of interest through real-time tasks such as comparing procurement decisions against benchmarks for fairness and competitiveness, identifying relationships between employees and vendors through data mapping, and spotting deviations from approved procurement policies or procedures.

Operational activities are always a challenge for corporate compliance, as they are so dynamic and certainly rife with compliance challenges. AI enables organizations to monitor these areas dynamically. AI can facilitate real-time warning systems, such as sensors in a manufacturing plant feeding data to an AI system, which flags a series of maintenance delays that could violate environmental or safety regulations. This could allow compliance to address the lapses before they result in fines or accidents.

Automating Compliance Reporting with AI

AI does not stop at monitoring; it revolutionizes reporting by automating the generation of tailored compliance dashboards. These dashboards provide stakeholders with the information they need to make informed decisions.

  1. Real-Time Dashboards for Leadership. A Board of Directors and C-suite require high-level overviews of compliance performance. AI-powered dashboards can present such areas as key risk indicators (KRIs) across functions and geographies. It can graph trends in incidents, investigations, and remediation efforts. It can develop heat maps highlighting high-risk areas. By automating these insights, AI saves time and ensures consistency, allowing leadership to focus on strategy rather than data collection.
  2. Regulatory Reporting. AI can streamline submissions to regulators for industries with strict reporting requirements, from industries and verticals as diverse as financial services to healthcare and everything in between. AI can compile and validate data for anti-money laundering (AML) reports in the financial regulatory world, ensuring accuracy and compliance with reporting standards. This can reduce errors, faster submissions, and fewer regulatory penalties.
  3. Internal Audit Support. Internal auditors need detailed, granular data to assess compliance effectiveness. AI enhances their capabilities by generating reports on specific transactions or activities. AI can highlight recurring issues or control gaps. It can Document Document Documents by providing audit trails for all monitoring activities.

Best Practices for Implementing AI in Monitoring and Reporting

Many compliance professionals struggle with implementing AI into their compliance regimes. The key is to start small, test and validate, and then build out and scale. Begin by customizing your thresholds and parameters. AI systems are only as effective as the thresholds and rules you provide them. Customize these settings based on your organization’s risk profile, industry norms, and regulatory requirements. An example might be to set lower thresholds for transactions in high-risk jurisdictions to capture more potential violations.

You should work to prioritize the integration of AI into your compliance program. AI tools must integrate seamlessly with existing compliance systems, including enterprise resource planning (ERP) and financial and procurement platforms. This ensures consistent data flows and minimizes disruptions.

Building out and scaling are critical as you move forward. You can do this by focusing on the explainability of your AI program. AI systems can sometimes act as “black boxes,” making decisions that are difficult to interpret. You should select AI tools that provide clear, explainable outputs to facilitate investigations and meet regulatory expectations.

You must work to address data quality to combat GIGO (Garbage In, Garbage Out) and move to BIBO (Best Input, Best Output)—the effectiveness of AI hinges on the quality of the data it processes. Implement robust data governance practices to ensure accuracy, consistency, and completeness.

As with most any other corporate initiative, you must work to both train and upskill the employee base, with an emphasis on targeted training for key AI team members. You must ensure compliance teams understand how to use AI tools effectively. Provide training on interpreting AI outputs, refining thresholds, and integrating insights into decision-making processes.

Challenges and Aligning AI with DOJ Expectations   

While AI offers transformative potential, you must work to navigate challenges ethically and responsibly. Beware of false positives, as an overly sensitive AI system may generate excessive alerts, leading to “alert fatigue.” Regularly review and adjust thresholds to maintain balance. Data Privacy should also be at the forefront of your concerns. Ensure compliance with data privacy laws, such as GDPR or CCPA, particularly when monitoring employee or vendor activities. Finally, you must make sure there is no bias in algorithms. AI models must be tested for biases that could lead to unfair treatment of certain groups or regions.

The DOJ’s 2024 ECCP emphasizes the need for data-driven, dynamic compliance programs. AI aligns with these expectations by enabling real-time monitoring, providing transparency through automated reporting, creating a clear, auditable trail of compliance activities, and supporting continuous improvement. To demonstrate alignment with DOJ expectations, document how AI tools are used, the insights they generate, and how these insights inform decision-making.

The Future of Compliance Monitoring and Reporting 

AI is revolutionizing compliance by making continuous monitoring and reporting more efficient, effective, and transparent. By harnessing AI, organizations can anticipate and address risks in real-time, provide actionable insights to stakeholders, and build programs that meet the highest regulatory standards. However, AI is not a panacea. Its success depends on thoughtful implementation, ethical use, and a commitment to continuous improvement. The bottom line for a compliance professional is that a compliance program that cannot see around corners simply needs to be better. AI gives us the vision to anticipate risks, act decisively, and build stakeholder trust. Finally, always remember the human in the loop.

Categories
Blog

AI in Compliance: Part 3, Leveraging AI for Employee Behavioral Analytics in Corporate Compliance

We continue our 5-part exploration of using AI in compliance by considering how employee behavioral analytics can be used to prevent employee misconduct. Whether intentional or inadvertent, employee misconduct can present significant risks to corporate integrity, financial stability, and reputation. From conflicts of interest and fraudulent activity to harassment and toxic workplace cultures, identifying and mitigating these risks is a cornerstone of an effective compliance program.

However, traditional monitoring methods often miss subtle warning signs or are applied inconsistently. Enter artificial intelligence (AI) employs behavioral analytics powered by natural language processing (NLP). By analyzing communication patterns, sentiment, and tone in employee emails, chats, and other digital interactions, AI provides a proactive, scalable approach to identifying indicators of unethical behavior before they escalate.

However, deploying AI in this sensitive area, especially privacy and trust, comes with challenges. In Part 3, we explore the best practices for using AI to enhance compliance through employee behavioral analytics while navigating the ethical and legal complexities of such monitoring.

The Promise of AI in Employee Behavioral Analytics

AI’s strength lies in its ability to sift through large volumes of unstructured data—emails, instant messages, chat logs—and identify patterns or anomalies that might signal risk. For compliance, this translates into:

  1. Early Detection of Red Flags. AI can flag terms or phrases commonly associated with misconduct, such as “special arrangement,” “off the books,“ or “don’t tell.“ These signals can point to potential fraud, bribery, or other violations. For instance, if an analysis detects a pattern of discussions about unauthorized “side deals,“ it might prompt a closer look at contract negotiations or procurement activities to ensure compliance with anti-corruption policies.
  2. Sentiment Analysis. NLP tools can analyze the tone of communications to detect hostility, coercion, or undue pressure, which are common markers in harassment or toxic workplace cases.
  3. Proactive Risk Mitigation. AI allows compliance teams to intervene early, whether through targeted training, process reviews, or investigations, by identifying behavioral trends or hotspots.

Real-World Applications of AI in Employee Monitoring

AI can help prevent fraud and financial misconduct. AI tools can scan communications for phrases or patterns indicative of fraudulent behavior, such as collusion between employees and vendors. An example might be an uptick in messages between a procurement manager and a vendor containing terms like “cash payment“ or “split invoice,“ which could warrant investigation. Early identification prevents financial loss and regulatory scrutiny.

Conflicts of Interest still present a real set of risks. AI can identify potential conflicts of interest by cross-referencing communications with external datasets, such as LinkedIn profiles or corporate registries. For example, an employee who regularly communicates with a third party in which they hold a financial interest might be flagged for further review. Addressing these conflicts helps maintain transparency and trust.

Workplace harassment is still an ongoing issue in many organizations. Sentiment analysis tools can detect signs of harassment, such as bullying or discriminatory language, even when explicit complaints have not been filed. For example, a pattern of negative sentiment in internal chat groups tied to a specific team or manager could indicate a problematic workplace culture. Such proactive intervention protects employees and fosters a positive organizational culture.

Insider threats can occur in a variety of situations. AI can identify employees at risk of engaging in unethical behavior by analyzing communication patterns, tone, or frequency changes. An example might be where a sudden shift in tone or reduced communication volume might signal employee disengagement or dissatisfaction, common precursors to misconduct. Addressing underlying issues reduces the likelihood of insider threats.

Balancing Privacy with Compliance

This is an area where compliance professionals should tread carefully, as deploying AI in employee monitoring is a double-edged sword. While it enhances compliance capabilities, it can also raise concerns about privacy and trust. Employees may feel surveilled or micromanaged, leading to reduced morale and potential legal challenges if monitoring practices need to be more transparent and lawful. Compliance professionals should work towards several key goals to strike the right balance.

You should be transparent and communicate openly about using AI tools for monitoring. The compliance function should communicate these tools’ purpose, scope, and benefits, emphasizing their role in promoting ethical behavior and a safe workplace. Data collection should be limited to only relevant communications, avoiding personal channels or non-business-related interactions. You must set clear boundaries on what is analyzed and ensure monitoring aligns with applicable data privacy laws, such as GDPR or CCPA.

Cross-collaboration in this area is critical. Your compliance function should collaborate with legal and HR departments to ensure AI deployment complies with labor laws, privacy regulations, and organizational policies. Using this approach focuses on anomalies, not individuals. Design AI systems to flag patterns or trends rather than targeting individual employees unless clear indicators of misconduct emerge. At all costs, you must avoid “guilt by algorithm“ by ensuring human oversight in reviewing AI-generated alerts. Finally, work to audit AI systems regularly. You continuously review and refine AI tools to ensure they remain unbiased, effective, and compliant with developing laws and regulations.

Building Trust: An Ethical Framework for AI Monitoring 

Trust is the cornerstone of any compliance program, extending to AI monitoring tools. By embedding ethical considerations into AI deployment, compliance teams can build credibility while minimizing pushback from employees.

  1. Fairness. Ensure that AI models are free from biases that might disproportionately flag certain groups or individuals. For example, NLP tools should be tested to avoid language biases tied to gender, race, or cultural differences.
  2. Accountability. Establish clear lines of accountability for AI-generated insights. If an alert leads to an investigation, document how the decision was made and what steps were taken to ensure fairness.
  3. Proportionality. Use AI tools proportionately, focusing on high-risk areas rather than engaging in blanket surveillance. Tailored monitoring reduces privacy concerns and demonstrates good faith.
  4. Employee Education. Provide training sessions to help employees understand how AI monitoring works and benefits them by creating a safer, more ethical workplace.

Meeting DOJ Expectations with AI 

The DOJ’s 2024 Evaluation of Corporate Compliance Programs highlights data analytics’s importance in assessing behavioral risks. AI-powered employee monitoring aligns with these guidelines by enabling continuous monitoring, targeted interventions, and data-driven decision-making. AI provides real-time insights into employee behavior, ensuring that risks are identified and addressed promptly. AI helps compliance teams allocate resources effectively by focusing on specific risk areas. AI tools offer objective, actionable data to support compliance investigations and risk assessments. These are now standard DOJ expectations, and compliance teams should document their use of AI tools, including the rationale, implementation process, and outcomes. Regular reviews ensure these tools remain effective and compliant with legal standards.

AI as an Enabler, not a Replacement

AI’s potential to enhance compliance through employee behavioral analytics is immense, but always remember the human in the loop. AI allows organizations to detect risks proactively, respond swiftly to emerging issues, and foster a culture of accountability and integrity. However, AI is not a substitute for human judgment. It is a tool that supports, rather than replaces, the expertise of compliance professionals. By deploying AI thoughtfully and balancing innovation with ethical considerations, organizations can create a safer, more ethical workplace while meeting regulatory expectations. Compliance is not simply about rules but about building a culture where employees feel supported and empowered to do the right thing. AI can help us achieve this goal only if we use it responsibly.

Categories
Blog

AI in Compliance: Part 2, Leveraging AI for Third-Party Risk Management

We continue our week-long look at the use of AI in compliance. Today, we consider third parties. Third-party relationships remain one of the most significant areas of risk for corporate compliance programs. From supply chain partners to distributors and everything in between, third parties act as the face of your organization in many jurisdictions, making their actions, and any misconduct, your problem. To mitigate these risks, companies traditionally relied on periodic due diligence and reactive responses. But in today’s fast-moving and increasingly interconnected world, such approaches fall short.

This is where artificial intelligence (AI) can revolutionize third-party risk management. With AI tools, compliance teams can shift from static, checklist-driven processes to dynamic, continuous monitoring systems. In this post, we’ll explore how AI enhances third-party risk management by screening, monitoring, and evaluating third parties in real time and how it helps meet the DOJ’s 2024 Evaluation of Corporate Compliance Programs (2024 ECCP) expectations for robust, data-driven compliance practices.

The DOJ’s 2024 ECCP places a strong emphasis on using data analytics and continuous monitoring to strengthen compliance programs. These expectations are included with the requirements of a proactive risk management and data-driven compliance. AI allows compliance teams to manage a large volume of third-party relationships efficiently and effectively. To fully align with DOJ expectations, companies should document their use of AI tools, including how they support risk assessments and monitoring activities. Regular audits of AI systems can ensure they remain effective and compliant with legal standards.

AI: The Compliance Professional’s New Ally

The compliance risks tied to third parties are well-documented:  bribery and corruption, reputational damage, and legal and regulatory violations. AI excels at handling exactly the complexity of third-party management entails. It can process vast amounts of data from multiple sources, identify patterns, and provide actionable insights in real-time. Let’s break down how AI can be used at each stage of the third-party lifecycle.

  • Initial Screening.

Traditional screening processes rely on questionnaires and public database checks—important but limited in scope. AI-powered tools enhance this step in a variety of ways. By aggregating diverse data sources, AI systems can pull information from public records, news outlets, litigation databases, social media platforms, and proprietary sources. Through the use of natural language processing (NLP) algorithms, you can detect hidden risks through the analysis of news articles, blogs, or social media posts to uncover potential red flags, such as allegations of fraud, regulatory violations, or ethical misconduct. Finally, with scored risk profiles, AI models assess the likelihood of misconduct based on factors such as geographic risk, industry norms, and historical behavior. This risk scoring allows compliance teams to prioritize their efforts.

  • Onboarding Due Diligence

The onboarding phase is critical for setting the tone of the relationship and understanding the potential risks. AI can assist you in a variety of ways. With automated document review, AI tools can process contracts, certifications, and policies submitted by third parties, flagging inconsistencies or missing information. One area that continues to bedevil due diligence is the identification of Beneficial Ownership. By cross-referencing corporate records, AI can reveal ultimate beneficial owners, including individuals who might otherwise remain hidden. Machine learning (ML) models trained on historical compliance data can predict the likelihood of future misconduct, enabling proactive risk mitigation strategies through predictive insights. The bottom line is that by ensuring a thorough onboarding process, AI helps organizations comply with DOJ guidance, which emphasizes the importance of understanding third-party relationships.

  • Continuous Monitoring

A one-time due diligence exercise is no longer sufficient. The 2024 ECCP made clear the need for ongoing monitoring to ensure that third-party relationships remain compliant. AI facilitates this mandate by offering real-time alerts, where AI-driven systems can monitor news feeds, regulatory databases, and other sources 24/7, sending alerts when a third party is implicated in a legal issue, sanctions violation, or reputational scandal. One of the more challenging areas for compliance professionals has in around transaction monitoring. Here, AI can analyze financial transactions involving third parties, flagging anomalies that might indicate fraud or corruption. Finally, in the area of behavioral analytics, AI tools can track changes in a third party’s behavior, such as a sudden increase in high-risk transactions or shifts in geographic focus. These patterns often signal emerging risks. The bottom line is that with continuous monitoring, companies can address potential problems before they escalate into full-blown compliance failures.

  • Periodic Risk Re-Evaluation

AI ensures that risk assessments are dynamic, reflecting changes in the external environment and the third party’s circumstances. As far back as 2020, the DOJ told compliance professionals that risk assessments should be performed with your organization’s risk change, so a periodic risk re-evaluation directly aligns with the DOJ’s expectations. Key AI capabilities in this area include geopolitical risk analysis, using AI to evaluate the impact of geopolitical events, such as sanctions, trade disputes, or political instability, on third-party relationships. Your industry trends are something the DOJ has been talking about for at least 10 years, and AI systems can monitor regulatory developments and industry trends, helping organizations anticipate new compliance risks. Perhaps most excitedly are the customizable risk models you can create with AI. This would allow compliance teams to adjust risk assessment models based on evolving business needs, ensuring that evaluations remain relevant and actionable.

Overcoming Challenges in AI Implementation

While the benefits of AI are clear, implementing these tools effectively requires careful planning and preparation in several areas. First is your data quality. The old adage of GIGO (Garbage In, Garbage Out) has been replaced by BIBO (Best Input, Best Output). Here, AI is only as effective as the data it analyzes. Organizations must invest in robust data governance practices to ensure accuracy, completeness, and consistency.

Transparency is a key issue for compliance in using AI, and it was directly addressed in the 2024 ECCP. The black-box nature of AI decision-making can be a concern. Compliance teams should work with internal teams and vendors to ensure algorithms are interpretable and results are explainable. AI tools must integrate seamlessly with existing compliance systems to avoid creating silos or inefficiencies. While the US is far behind the rest of the world in data privacy laws, GDPR and others still apply to any internationally facing organization. This means companies must deploy AI responsibly, respecting privacy laws and ensuring that monitoring does not cross ethical boundaries.

The Future of Third-Party Compliance

AI is transforming third-party risk management from a reactive, one-size-fits-all process into a dynamic, data-driven discipline. By leveraging AI tools for screening, onboarding, monitoring, and reassessment, compliance professionals can manage third-party risks with unprecedented precision and agility. However, as with any powerful tool, AI must be used thoughtfully. By focusing on data quality, transparency, and ethical considerations, organizations can harness the full potential of AI while maintaining trust and accountability.  At the end of the day, a best practices compliance program is not simply about checking the box; rather, it is about creating a system that evolves with the risks it manages. AI is that system’s next evolution.