Tag: Aly McDevitt

Categories
Blog

Aly McDevitt Week: Part 5 – Ransomware, Crisis Response, and the Compliance Imperative to Move Fast

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

McDevitt took a different but highly effective approach in this case study. Rather than centering the story on a single historical corporate scandal, she crafted an immersive fictional scenario grounded in real-life attacks, expert interviews, and public guidance. Compliance Week made clear that, while the company and its characters are imagined, the legal, operational, and compliance issues are very real. That makes this piece especially valuable for compliance professionals because it is less a postmortem of one company and more a practical field manual for the next crisis.

McDevitt’s story begins where many cyber incidents begin: with a person, not a machine.

A longtime employee, Betsy, receives an “urgent” email that appears to be from her boss. She clicks a malicious link, lands on a phony, internal-looking site, realizes too late that something is wrong, and then makes the mistake that turns a bad moment into a corporate crisis: she does not report it. Her silence gives the attacker time. Within days, the company, Vulnerable Electric (VE), a private utility serving 1.4 million customers with about 600 employees and $250 million in annual revenue, is facing a full-blown ransomware attack.

That is the first lesson, and McDevitt drives it home with precision. Ransomware is often described as a technology problem, but the first failure is frequently human, organizational, and cultural. Betsy clicked. But more importantly, she hesitated, feared blame, and kept quiet. As McDevitt explains through the expert commentary, her biggest mistake was not simply opening the link. It was actively deciding not to report the incident to the proper internal authority.

For compliance officers, that point should sound very familiar. Whether the issue is corruption, harassment, sanctions, safety, or cyber, organizations do not fail only because something bad happens. They fail because people do not feel safe reporting it quickly.

McDevitt also lays out why this issue matters so much now. She notes that ransomware payments in 2020 reached roughly $350 million, a more than 300 percent increase from the prior year, and that proactive prevention is no longer optional. She further situates the case study in the context of critical infrastructure, noting that entities such as utilities are subject to heightened scrutiny and are encouraged to align with the NIST cybersecurity framework. In other words, ransomware is not just an IT nuisance. It is an enterprise risk, a regulatory risk, and in some sectors a national security risk.

Once the attack is recognized, McDevitt shows the company doing something right: it moves into a structured response. The CEO activates the full cyber incident response team, or CIRT, and the war room includes not only technical leaders and legal counsel, but also the chief compliance officer, the head of communications, external incident response professionals, and other essential decision-makers. This is exactly what a mature response should look like. Cyber incidents do not fall under a single function. They are enterprise events.

I particularly appreciated how McDevitt uses the case study to underline the role of compliance. The CCO is not there as decoration. The article makes clear that if employee data has been exfiltrated, the incident constitutes a personal data disclosure with potentially local, state, and international notification consequences, and that compliance and legal personnel should be in the room from the start. That is a crucial point for corporate compliance professionals. Cyber risk management is not separate from compliance. It is now one of compliance’s core operating terrains.

McDevitt also captures the psychology of the first 36 hours. Anthony Ferrante says those hours are extremely stressful for a CEO, who is simultaneously thinking about operations, data, reputation, and people. That observation matters because it explains why preparation before an attack is so important. You do not want your executives inventing a process under duress. McDevitt reports that VE had already created an incident playbook with roles, escalation steps, and a five-part response framework: facts, business impact, root cause, corrective actions, and lessons learned. That is the kind of disciplined structure compliance leaders should insist upon.

Another strength of McDevitt’s reporting is her treatment of communications. Too many organizations still believe communications should be brought in late, after the lawyers and technologists finish their work. McDevitt, through multiple expert voices, makes the opposite case. Communications should have a seat at the table, not at the back wall. The reason is straightforward: stakeholders will forgive many things, but they will not forgive caginess. VE’s communications lead rightly argues that employees and customers should hear from the company first, not from the media or the attacker.

This point becomes even sharper when McDevitt contrasts VE’s approach with the real-life story of “Melvin,” an employee at another firm that remained offline for 10 days with no formal communication and did not disclose the sensitive data breach to employees in a timely or transparent way. That section may be the most important communications lesson in the entire piece. Employees are not bystanders. They are among the primary victims of a data breach, and they know when something is wrong. Silence destroys trust.

Then comes the hard question at the center of nearly every ransomware story: Do you pay?

McDevitt wisely resists easy moralizing. She notes the FBI’s official position is not to pay, because payment fuels the criminal business model and does not guarantee restoration. Yet she also reports the practical view of experienced practitioners: payment is not illegal per se, and companies often face a grim choice among bad options. The anonymous chief compliance officer quoted in the case study says it best: there are no good options, only the least bad option.

McDevitt’s two parallel paths, pay and do not pay, are particularly useful because they show that neither choice is clean. In Path A, VE pays $5 million, gets imperfect decryption support, recovers faster, but then faces scrutiny over whether it should have consulted OFAC before payment and whether it may have paid a sanctioned party. In Path B, VE does not pay, endures a longer recovery, suffers a data breach, and still faces reputational and legal fallout. McDevitt’s point is not that one route is right and one is wrong. Her point is that ransomware decision-making is governance under pressure.

That is why the postmortem matters so much. McDevitt closes the case study by emphasizing that the long-term impacts fall into three risk buckets: reputational, legal, and regulatory. She then turns to practical lessons: train the workforce, strengthen spam filters, run tabletop exercises, isolate infected devices immediately, secure backups offline, contact law enforcement quickly, do not rush engagement with the attacker, and communicate with each stakeholder group in a timely and tailored way. She also adds smart recommendations on canary files, forensic retainers, access reviews, logging, threat intelligence monitoring, and industry information sharing.

Finally, McDevitt ends on a note that compliance professionals should not miss. Betsy is not scapegoated. She is thanked for telling the truth and invited to participate in a phishing-resilience campaign for other employees. That is not sentimentality. That is culture. If your response to human error is humiliation, people will hide problems. If your response is accountability plus learning, people will surface them.

That may be the most important compliance lesson of all. Ransomware is a cyber crisis, but surviving it depends on culture, governance, and trust just as much as on technology.

I hope you have enjoyed reading about Aly’s case studies for CW. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 4 – Flex, Scope 3, and the New Frontier of Compliance Beyond the Four Walls

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

Once again, McDevitt showed why strong compliance journalism matters. She did not write a generic ESG success story. She examined how a global manufacturer sought to address a problem largely outside its direct control while still building governance, accountability, and measurable progress around it. For compliance professionals, that is the heart of the story. Flex is not simply trying to improve what happens inside its factories. It is trying to influence what happens across a value chain that is vastly larger than the company itself.

That challenge begins with scale. As McDevitt reports, Flex generates $26 billion in annual revenue, has about 170,000 employees, operates in more than 100 facilities across 30 countries, serves 1,000 customers, and works with 16,000 global suppliers. It is the kind of company that many end users do not recognize by name, but that sits squarely in the middle of countless supply chains. That middle position is precisely what makes the case study so relevant to corporate compliance. Many modern compliance risks do not stop at the company boundary. They sit upstream in sourcing, downstream in product use, and sideways in third-party relationships.

In environmental terms, this means Scope 3 emissions. McDevitt explains that while Scope 1 and Scope 2 emissions are relatively easier to quantify and manage, Scope 3 emissions, meaning indirect emissions across the value chain, are much harder. At Flex, Scope 3 emissions accounted for 99 percent of total gross emissions in 2019, 2020, and 2021. That single fact should get every compliance professional’s attention. If 99 percent of your footprint sits outside your direct operating control, then governance cannot be limited to internal operations. It must extend outward through influence, incentives, transparency, and partnerships.

That is why I find McDevitt’s reporting on Flex so useful. She shows that the company understood the compliance-like problem embedded in sustainability. Scope 3 is not just an environmental accounting challenge. It is a governance challenge. It asks whether a company can establish expectations, escalation paths, reporting systems, and controls for conduct and performance that rely heavily on third parties.

McDevitt presents 2019 as a hinge point for the company. That was the year Revathi Advaithi became Chief Executive Officer (CEO), and the year Flex adopted a more ambitious sustainability posture. Andy Powell, Flex’s Chief Ethics and Compliance Officer, told McDevitt that before Advaithi’s arrival, the culture needed a turnaround, and that her leadership changed the tone at the top and the company culture. For compliance officers, this is a familiar lesson. Every durable transformation begins with tone at the top, but it cannot stop there. Tone only matters when it is translated into goals, structures, and incentives.

Flex did that by making 2019 its baseline year for future targets and by setting three major 2030 goals: cut Scope 1 and 2 emissions by 50 percent from the 2019 base year; ensure 50 percent of preferred suppliers set their own GHG reduction targets by 2025 and 100 percent by 2030; and have 70 percent of specified customers set science-based targets by 2025. In its first year, the company reported a 14 percent reduction in operational emissions and said 29 percent of preferred suppliers and 48 percent of specified customers had already set GHG-reduction or science-based targets.

Those numbers matter, but for compliance professionals, what matters more is how Flex operationalized the effort. McDevitt reports that the company did not leave sustainability as a free-floating corporate aspiration. It built governance around it. Barjouth Aguilar, who leads the global sustainability program, described a tight-knit team that tracks a broad range of KPIs across more than 100 sites, runs materiality assessments, designs goals with area owners, conducts site training, and communicates performance across the organization. She emphasized that her team serves as “the connectors,” a phrase every compliance officer will appreciate. The modern compliance function is increasingly a connector function. It brings together legal, operations, procurement, finance, IT, HR, and business leadership around shared risk and accountability.

Flex has also gotten one structural issue right. McDevitt reports that its sustainability program management sits within the company’s LMS, legal, marketing, and security teams, all of which report to the general counsel. Andy Powell said that the arrangement creates tight cross-functional collaboration with the ethics and compliance program because it is “all in the same family”. That is not a trivial point. Too many organizations allow ESG, compliance, procurement, and operations to operate on parallel tracks. Flex’s structure suggests a more mature model, one where sustainability is treated as a governance issue rather than a branding exercise.

McDevitt also highlights the program’s operational discipline. Site-level representatives across more than 100 facilities participate in a sustainability network, report local progress, escalate issues, and use monthly scorecards tied to company-wide goals. This is where the case study becomes particularly instructive for compliance practitioners. Flex is not merely talking about targets. It is using cadence, scorecards, escalation, and localized accountability. In other words, it treats sustainability as a management system.

That is exactly how a compliance officer should think about ESG. The challenge is not just about the announced goal. The challenge is whether the company has a process to monitor performance, surface problems, and drive remedial action.

Another strong section in McDevitt’s reporting concerns greenwashing. Aguilar recommends a three-pronged approach: materiality assessment, data verification, and transparency. This is sound advice for any corporate compliance program. Materiality assessment aligns the strategy with business realities and stakeholder expectations. Verification creates integrity in reported data. Transparency preserves trust, especially when progress falls short. McDevitt notes that Flex has used third-party verification of environmental data through DNV since its 2018 sustainability report. That kind of external validation is increasingly important in a world where ESG claims are scrutinized by customers, investors, regulators, and plaintiffs’ lawyers.

I also appreciated McDevitt’s discussion of how Flex manages suppliers. The company’s supplier-side target focuses on preferred suppliers, about 500 companies out of a total supply base of 16,000, but that group receives 50 percent of Flex’s $7 billion annual spend on commodity sourcing. Some might criticize that as narrow. I think it is practical. Compliance professionals know that risk-based prioritization is not a weakness. It is maturity. You begin where the leverage is greatest.

Flex did not stop with expectations alone. McDevitt reports that it created a yearlong process for suppliers that includes education, webinars, training, disclosures through CDP, follow-up support, and internal review of results. In one year, Flex trained 424 suppliers and 695 supplier personnel. That is what third-party compliance looks like in practice. Not merely contract clauses, but enablement.

There is also a sober realism in the case study that I admire. David Gessler acknowledged that the closer Flex gets to its deadlines, the harder it will be to motivate the remaining suppliers, particularly smaller ones in regions where ESG language may still be foreign or where supplier resources are limited. He also noted that regulatory expectations are moving quickly and that customer demands are already outrunning some of the company’s original plans. That is another useful lesson. A modern compliance program cannot be static. It must evolve as stakeholder expectations, regulations, and commercial realities change.

Finally, McDevitt shows that Flex is thinking not only about suppliers but also about customers and the product lifecycle. The company is trying to help customers design more sustainable products, extend product lifespans, support repair and remanufacturing, and build circular-economy solutions. This matters because the largest share of Flex’s Scope 3 emissions comes from “use of sold products,” which accounted for 93 percent of total Scope 3 emissions in 2021. In plain English, the biggest sustainability issue is not simply what Flex does in manufacturing. It is what happens after the product leaves.

That, to me, is the broader compliance insight. The future of compliance will increasingly require professionals to think in systems, not silos. Whether the topic is anti-corruption, human rights, cyber, AI, or ESG, the key question is no longer only, “What happens inside our company?” It is also, “How do we govern what we influence but do not fully control?”

Aly McDevitt’s Reaching into the Value Chain answers that question with a practical and realistic example. Flex may not control every node of its value chain, but it is building a framework to influence it with structure, data, accountability, and persistence. For compliance professionals, that is a model worth studying.

Join us tomorrow as we conclude our 5-blog-post tribute to Aly McDevitt by reviewing her case study on a Ransomware attack and a corporate response. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 3 – Lafarge, Syria, and When “Business Continuity” Becomes Criminality

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

In this case study, Aly took a scandal that could easily be reduced to a shocking headline and showed how misconduct often grows incrementally, decision by decision, concession by concession, until a company crosses a line it can no longer explain away. As McDevitt framed it, Lafarge’s collapse into criminal conduct was not sudden. What began as “local concessions” in a war zone ended in terrorist financing, a guilty plea, and a historic compliance disaster.

For the corporate compliance professional, that is where this story starts. Not with ISIS. Not with the guilty plea. Not even with Syria’s descent into civil war. It starts with a corporate mindset that treats business continuity as a value higher than legal and ethical boundaries.

McDevitt lays out the core facts with devastating clarity. Lafarge built a $680 million cement plant in the Jalabiyeh region of Syria in 2010, just as the Arab Spring began to reshape the region. The plant, Lafarge Cement Syria, was strategically important, but it also operated in an increasingly unstable environment. By 2011, political unrest in Syria had become a violent conflict. By 2012, the area around the plant was plagued by kidnappings, hijackings, and the killing of a contractor at a checkpoint. Most companies would view those developments as bright red stop signs. Lafarge saw them as obstacles to manage.

That is the first major lesson of the case study. The most dangerous compliance failures often arise not from ignorance of risk but from a conscious decision to keep operating despite it. McDevitt shows that while other companies pulled out of Syria, Lafarge kept the plant running and shifted management of Syrian operations to Cairo after evacuating European employees. That decision set the stage for the next step: negotiating through intermediaries with armed factions to permit continued operations. By then, the moral and legal slope was already slippery. The question was no longer whether the company faced risk. The question was how much compromise leadership was willing to tolerate to avoid writing off a major investment.

McDevitt’s reporting is especially effective because it captures the gradualism of the wrongdoing. She writes that Lafarge executives did not wake up one day and decide to fund terrorists. It happened slowly, one deal after another, as the company tried to preserve operations in a deteriorating war zone. This is a point every compliance professional should sit with. Catastrophic misconduct often results from the accumulation of rationalized, smaller acts. Each one is framed as temporary, practical, or necessary. Each one moves the line. Eventually, there is no line left.

The Justice Department ultimately found that Lafarge routed about $5.92 million in illicit payments to the al-Nusra Front and ISIS. In 2022, Lafarge pleaded guilty in the United States to providing material support to terrorist organizations, the first case of its kind against a corporation in the U.S. Former Deputy Attorney General Lisa Monaco said the company “paid millions of dollars to both terrorist groups and benefited from their brutality to the tune of $70 million in revenue,” and the company paid $778 million in fines and forfeitures as part of the plea agreement.

That number alone should command the attention of boards and executive teams. Lafarge tried to avoid the business pain of shutting down a troubled asset and ended up paying more than the original investment in penalties, while also suffering deep reputational damage, legal exposure in multiple jurisdictions, and criminal proceedings against former executives. There is a brutal irony in that outcome. The Syrian plant accounted for less than 1% of Lafarge’s total sales at the time of the Holcim merger, yet the consequences of non-compliance proved vastly disproportionate to the asset’s commercial importance. That is the second lesson. The smaller the business rationale, the less defensible the compliance compromise.

McDevitt also explains why the U.S. Department of Justice had jurisdiction. Lafarge used U.S.-based email services to avoid using company email addresses, and some payments linked to terrorist groups were made in U.S. dollars through New York banks. This should resonate with every multinational company. Jurisdiction in modern enforcement is not limited by headquarters location. It is created through systems, currency flows, communications infrastructure, and business touchpoints. In a global company, you can be hauled into a U.S. enforcement action because you used the plumbing of U.S. commerce.

McDevitt’s account also reveals something even more troubling. By September 2013, Lafarge executives were already acknowledging the reality in their own meeting minutes, stating that it was becoming harder and harder to operate without directly or indirectly negotiating with networks designated as terrorists by international organizations and the United States. That line should stop every compliance officer in their tracks. At that moment, the risk was no longer ambiguous. It was known, articulated, and documented. The failure thereafter was not one of detection. It was one of the decision-making processes.

And that brings us to the heart of the compliance lesson. Once a company understands the legal and ethical nature of the risk, the compliance function is not merely to record the issue. The job is to create a decision architecture that can force the right outcome, even when business leadership hates it.

McDevitt reinforces this through the voice of Marcia Narine Weldon, who said, “business continuity can’t be an excuse for abandoning core legal and ethical principles” and even more pointedly, “When you’re dealing with potential terrorism financing, neutrality isn’t an option. You either stop it or you become complicit”. That is exactly right. There are categories of risk where compromise is not prudent; balancing is complicity. Terrorist financing sits squarely in that category.

Another important aspect of McDevitt’s case study is the timeline of internal response. Holcim, after its merger with Lafarge, became aware in 2016 of allegations that Lafarge had negotiated with ISIS and made payments to it. The head of compliance informed the Chief Legal and Compliance Officer that outside counsel had been engaged for legal analysis, and the board’s finance and audit committee directed an investigation. This sequence shows what a post-discovery escalation should look like. But it also highlights a painful truth: escalation after the fact is not the same as prevention. The best board briefing in 2016 could not undo the wrong choices made years earlier.

For compliance leaders, the Lafarge matter is therefore a case study in the limits of retrospective governance. Once the organization has crossed the line into criminal conduct, the role of compliance shifts from prevention to damage containment.

McDevitt weaves this throughout the piece with precision. She does not sensationalize the conduct. She shows how a company operating in a volatile, high-risk environment allowed ethics and compliance to take a back seat to business survival. That is what makes the article so valuable. It reminds us that in high-pressure environments, compliance is not a support function sitting politely on the sidelines. It is the adult in the room. Sometimes that means telling management to shut down an operation. Sometimes it means escalating to the board. Sometimes it means resigning rather than participating in the unambiguously wrong.

In the end, Inside a Dark Pact is one of Aly McDevitt’s strongest cautionary tales because it strips away comforting myths. It tells us that smart people can rationalize the indefensible. It tells us that local concessions can become global crimes. And it tells us that when a company places asset preservation above values, it may preserve neither.

Join us tomorrow when we review Aly’s piece on Flex and its ESG journey. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 2 – VW, Dieselgate, and the Long Road from Fear to Integrity

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

In this story, Aly’s reporting did what the best compliance journalism always does: it moved beyond the headline scandal to examine the operating mechanics of cultural repair. McDevitt did not simply retell Dieselgate. She walked through how Volkswagen tried to recover from one of the great corporate compliance failures of modern times through a U.S. monitorship, structural reform, and a sustained effort to replace fear with integrity.

For the corporate compliance professional,  Coming Clean is more than a case study about emissions cheating. It is a case study on whether a company permeated by misconduct can rebuild trust in a credible, measurable, and durable way.

McDevitt begins with the plain truth. Dieselgate was not the act of a single rogue employee or a single bad executive. The defeat device was developed, installed, and concealed by many. Volkswagen’s diesel vehicles used software that sensed when emissions testing was underway and shifted performance to produce compliant results; during normal operations, emissions controls underperformed, resulting in nitrogen oxide pollution up to 40 times above permitted levels, according to U.S. officials. In total, Volkswagen sold approximately 590,000 such vehicles in the United States and roughly 11 million worldwide.

That alone would have made this a historic scandal. But the deeper compliance failure was cultural. McDevitt reports that the company did not come clean voluntarily. It admitted wrongdoing only after regulatory pressure forced the issue. As she recounts, former New York Attorney General Eric Schneiderman alleged that hundreds of senior executives and engineers knew what was happening and that no one was willing to say, “Maybe we should not do this” or “This is against the law,” a devastating indictment of the company’s ethical environment.

That is the first lesson for compliance officers. Compliance breakdowns at this scale are rarely caused by one missing policy. They come from pressure, silence, and a culture that normalizes rationalization.

Volkswagen’s business ambition played a central role. McDevitt notes that the company’s push to become the world’s most successful automaker was accompanied by an integrity deficit, unrealistic goals, and a culture of fear. Later in the case study, she connects this to Strategy 2018, a corporate objective that sought market dominance and, in many observers’ view, created unbearable pressure to deliver results. This is an old lesson, but it remains evergreen. When growth goals are decoupled from ethics, misconduct begins to look like problem-solving.

Volkswagen’s 2017 guilty plea resulted in $4.3 billion in criminal and civil penalties and a three-year U.S. monitorship. McDevitt rightly focuses on the monitorship not as a humiliation ritual, but as an instrument of recovery. Former Deputy Attorney General Larry Thompson was appointed independent compliance monitor and auditor, and Hiltrud Werner became the executive on the Volkswagen side responsible for integrity, legal affairs, and much of the internal reform effort.

One of McDevitt’s great strengths in this piece is her attention to the relationship between monitor and company. Too often, practitioners think of monitorships as adversarial. Volkswagen’s experience suggests something more nuanced. Werner explicitly framed the monitor as an investment in Volkswagen’s future, not merely a punishment for its past, and she stressed that having someone on-site who knew the required standard was a positive element of reform. That is a practical insight. External oversight works best when the organization treats it as a pathway to transformation rather than a box-checking burden.

McDevitt also highlights the mechanics of making that relationship work. Volkswagen held a pre-monitorship “boot camp” in May 2017 to accelerate understanding, create transparency, and build human relationships between the monitor team and company personnel. Werner’s takeaway was one every compliance professional should write down: do not focus only on process; focus on people, too. I find that insight especially powerful because compliance functions often overinvest in control language and underinvest in trust architecture.

That same lesson appears in Volkswagen’s Project Management Office. McDevitt reports that the company created a neutral PMO to coordinate the monitorship across departments, manage over 1 million pages of documents and more than 8,000 meetings, and connect the monitor team to knowledgeable personnel across the enterprise. The PMO was not clerical support. It was organizational muscle. It mirrored the monitor’s work streams, established clear lines of contact, and brought together 80 staff from the first, second, and third lines of defense. That is another lesson worth underlining. In a major remediation project, project management is not ancillary to compliance. It is compliance.

McDevitt then turned to one of the most significant reforms: a single Code of Conduct for all employees across all 12 brands and companies, the first such common code in Volkswagen’s history. Hiltrud Werner described it as the company’s first stable anchor for culture. The Code was not meant to be an abstract statement. It included case studies and examples, and the training was updated to include “Dieselgate Lessons Learned” on compliance, integrity, culture, realism, personal responsibility, and speak-up expectations. Every employee and all board members received training on those lessons. For compliance professionals, this is exactly right. If your code cannot explain what went wrong in your own organization, then it is not yet a living document.

McDevitt’s reporting on Together4Integrity (T4I) is especially useful for practitioners. T4I emerged from the ashes of the failed growth-at-all-costs model and was built on two pillars: designing processes and positively influencing them, and inspiring employees to do the right thing out of conviction. It was not a one-size-fits-all rollout. Volkswagen recognized that a global organization with strong local identities needed both centralized standards and local ownership.

I particularly appreciated how McDevitt showed the practical texture of this effort. Local managers were empowered to choose engagement formats, from discussion breakfasts to integrity activities designed to reduce the distance between managers and employees and support a more open speak-up culture. Stephanie Davis, Volkswagen Group of America’s CECO, put it plainly: serious topics cannot be so scary that employees refuse to engage with them. Demystifying the work is part of the work.

The company also understood that culture had to be measured. This is perhaps the most practical part of McDevitt’s analysis. Volkswagen used perception workshops and its annual Stimmungs barometer survey to assess whether employees believed integrity was possible within their organizational units, identify weak areas, and build risk-based action plans. Werner reported that these measures showed year-over-year improvement, and the company used them to target workshops and resources where risk was greatest.

This is where many companies still fall short. They conduct training and communications, but they do not build a credible measurement framework for whether culture is actually changing. Volkswagen’s approach, as McDevitt presents it, offers a more mature model.

She also addresses the root causes of silence. Volkswagen identified “chimney careers,” or promotion paths entirely within one silo, as a structural factor that discouraged speaking up, as employees became too dependent on a single chain of command. That diagnosis is remarkably important. Speak-up culture is not only about hotline posters or anti-retaliation language. It is also about mobility, organizational design, and whether employees believe dissent will end their careers.

Finally, McDevitt looks at trust. Internally, Volkswagen viewed the increase in non-anonymous whistleblower reports as evidence that fear had begun to recede. In 2020, the company received 2,800 whistleblower tips, 90 percent of which were non-anonymous, a figure Werner said was unusually high and a signal that employees no longer felt the same degree of fear. Externally, regaining customer trust was slower and more difficult. Volkswagen repositioned around electric vehicles, carbon neutrality, and Electrify America, but Werner candidly admitted that rebuilding credibility was still a long process.

That candor may be the final lesson. After a scandal of this magnitude, a campaign cannot restore trust. It is restored by years of disciplined conduct, transparent accountability, and evidence that the company has truly understood what went wrong. Aly McDevitt’s Coming Clean is therefore not simply a story about Volkswagen. It is a guide to the difficult middle stage of compliance work: what happens after the plea, after the headlines, after the first promises. That is where the real labor begins.

Join us tomorrow, where we review Aly’s piece on Lafarge in Syria. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 1 – Carnival and the Hard Truth About Crisis-Tested Compliance

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

Please note that I will leave her seminal (in my opinion) piece, The Banks Behind the Epstein Enterprise, for a later piece.

In A Tale of Two Storms, it is worth noting at the outset that McDevitt did more than recount a corporate crisis. She captured a company trying to rebuild itself under the eye of a court-appointed monitor just as COVID-19 exploded into a global emergency. As Compliance Week explained, what began as a long-form examination of Carnival’s environmental misconduct and attempted compliance redemption became a far bigger story when one of its ships became an early incubator of the virus outside China.

For the compliance professional, that pivot is the first lesson. A program is not truly tested in the conference room. It is tested when an old crisis collides with a new one.

McDevitt opens at a moment of eerie transition. On February 20, 2020, Carnival was already dealing with a COVID-19 outbreak aboard the Diamond Princess, even as Compliance Week toured the company’s new ethics and compliance function in Miami. That juxtaposition framed the whole case study. Carnival was not simply managing a public health disaster. It was doing so while still carrying the baggage of a long, embarrassing, and very expensive history of environmental misconduct.

That history mattered. Carnival had pleaded guilty in federal court in both 2002 and 2017 to illegal discharges of oily waste and to falsification of records, and the Department of Justice viewed the pattern as evidence of a systemic problem in ethics and culture. This was not a one-off control failure. It was a story of repeated misconduct, insufficient structural reform, and an organization that had not yet fully learned how to turn compliance into culture.

McDevitt shows that the real inflection point came in 2019, after Carnival paid another $20 million for violating the terms of its probation and was ordered to implement corporate structural changes under a tight deadline, with a possible $10 million-per-day late penalty. That is when Carnival hired Peter Anderson as its first chief ethics and compliance officer and began to centralize what had long been fragmented compliance functions.

The importance of that move cannot be overstated. A common problem in large organizations is that compliance is spread across subject-matter silos, each with its own language, priorities, and reporting lines. McDevitt reports that before August 2019, Carnival did not have a centralized ethics and compliance department; environmental, general compliance, and health and safety functions worked independently across its operating companies. That fragmentation is often sold internally as efficiency or business autonomy. In practice, it can become a breeding ground for inconsistent controls, weak escalation, and cultural drift.

Anderson’s mandate was broader than legal remediation. He was brought in to unite the program, strengthen trust, improve information flow, and build a sustainable culture of compliance. McDevitt’s reporting around Anderson is especially valuable because she does not present him as a silver-bullet hero. Rather, she portrays him as an architect trying to build structure, process, and cultural credibility simultaneously.

His four pillars, as reported by McDevitt, were prevention, detection, response, and correction. That framework remains highly useful for any chief compliance officer. It reminds us that compliance is not just about policies or investigations. It is about understanding risk, identifying issues early, responding quickly, and then conducting real root cause analysis so the same failure does not recur. This became critically important once COVID hit.

One of the sharpest observations in McDevitt’s reporting comes from Carnival’s Gerry Ellis, who described the pandemic not as a pure compliance issue but as “compliance with the regulatory aspect of health” in a rapidly shifting battlefield of contradictory requirements across jurisdictions. That is a familiar challenge to modern compliance teams. Whether the issue is sanctions, AI governance, cyber, ESG, or public health, the hardest problems often come when the rules are changing in real time, across borders, with high operational stakes.

The brutal optics of timing also complicated Carnival’s crisis response. McDevitt details how the company faced allegations that it had sufficient warning signs yet continued operating for too long, even as infections spread across multiple vessels. Carnival defended its timing, noting that public health guidance was still evolving and that government advisories had not yet been fully escalated. That explanation may be understandable, but for compliance officers, the point is not merely whether management can defend its judgment after the fact. The point is whether the organization had the governance structure to make fast, documented, risk-based decisions while conditions changed by the hour.

McDevitt’s deeper contribution is to connect the pandemic response to the compliance rebuild already underway. She reports that Carnival’s pre-pandemic investments in a centralized program, better risk assessment, improved training, stronger communications, and closer engagement with the monitor helped the company absorb the shock of COVID more effectively than it otherwise could have. In other words, compliance did not solve the pandemic. But it provided muscle memory. That may be the most important lesson in the entire case study.

The company also understands that the tone at the top must be reinforced through resource allocation. Even amid severe financial pressure, Carnival preserved a larger share of its ethics and compliance team than many other departments, continued environmental investments, and developed a Pause Priorities Plan to sustain compliance momentum during the shutdown. Compliance officers should take note. A company reveals its real priorities not by slogans but by budget, staffing, visibility, and follow-through.

There are other practical insights here as well. McDevitt recounts how Carnival moved from a blame-oriented investigative mindset to “incident analysis” and learning, with Anderson explicitly stating that incidents should be viewed as assets for improvement. She also reports the company’s emphasis on “speak up,” leadership engagement, culture measurements, and the need to make captains and shipboard leaders receptive to challenge from below. That is a direct answer to one of the oldest compliance questions: how do you build trust in high-hierarchy environments where people fear speaking up?

Yet McDevitt does not let Carnival off the hook. The court-appointed monitor remained skeptical, top leadership had to be pushed to engage more deeply, environmental violations persisted, and Judge Patricia Seitz openly questioned whether Carnival was building a robust system that could function without the court’s “training wheels”. That skepticism is healthy. It underscores a hard truth every compliance professional knows: a redesigned program is not the same thing as an effective one. The real test is whether the organization behaves differently over time.

In the end, A Tale of Two Storms is not simply a cruise industry story. Aly McDevitt uses Carnival to show what happens when compliance reform is forced to mature in public, under enforcement pressure, and amid operational chaos. Her reporting demonstrates that while a crisis can expose weakness, it can also accelerate the transition from paper program to operational discipline.

For compliance leaders, that is the heart of the matter. You do not get to choose when your second storm arrives. You only get to choose whether your program is strong enough to meet it.

Join us tomorrow as we move to Aly’s piece on Volkswagen and its journey regarding its corporate soul after its emissions testing scandal. I am a columnist for Compliance Week.

Categories
From the Editor's Desk

From the Editor’s Desk – Compliance Week’s Insights and Reflections for September and into October 2025

In this episode of ‘The Editor’s Desk’ podcast, hosts Tom Fox and Aaron Nicodemus delve into key compliance issues featured in Compliance Week.

Tom and Aaron discuss top stories from Compliance Week in September, and provide a preview of upcoming content and events. They delve into a three-part case study on Lafarge’s bribery payments to terrorist groups in Syria, exploring its implications for companies operating in high-risk regions. They also discuss a resurfaced case study involving Jeffrey Epstein, JPMorgan Chase, and Deutsche Bank. The episode also highlights Ruth Prickett’s report on digital wallets in Europe, as well as the related compliance and data privacy issues. Additionally, they cover trends in FCPA enforcement, healthcare compliance with a focus on the FCA, immigration issues, and the importance of proactive compliance programs. The episode wraps up with insights into the upcoming ‘Inside the Mind of the CCO‘ survey and the January conference on AI and data analytics in compliance.

Resources:

Aaron Nicodemus on LinkedIn

Compliance Week

Categories
Greetings and Felicitations

Aly McDevitt on Ransomware Case Study, Part 2

Welcome to the Greetings and Felicitations, a podcast where I explore topics which might not seem to be directly related to compliance but clearly influence our profession. In this episode, we conclude a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week. We take a deep dive into her recent series case study on a ransomware attack on a fictional company. Highlights include:

·      Who are hackers? What is a cyber incident response playbook and how does each person handle their roles in the event of a ransomware attack?
·      How and when should stakeholders be notified? Who and what type of notification should be made?
·      What goes into the decision to pay? What are the pros and cons of each path?
·      What are some key lessons for companies from the story?
·      A hint of what Aly may have in store for future articles and series.
Resources
Ransomware case study in Compliance Week
Aly McDevitt

Categories
Greetings and Felicitations

Aly McDevitt on Ransomware Case Study, Part 1

Welcome to the Greetings and Felicitations, a podcast where I explore topics which might not seem to be directly related to compliance but clearly influence our profession. In this episode, we begin a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week. We take a deep dive into her series case study on a ransomware attack on a fictional company. Highlights include:

·      Why this subject matter for a deep dive?
·      The research that went into the piece. How many people interviewed and how long was the research process?
·      Writing style. Locked yourself in a room and not come out until its done or more collaborative process with an editor?
·      Story Synopsis- how common is Betty’s mistake?
·      What is the role of the CIRT and MSSP? How critical was VE’s preparation to its ability to respond?
Resources
Ransomware case study in Compliance Week
Aly McDevitt