Tag: BOD

Categories
Blog

Welcome to Y’All Street: What Compliance Professionals Need to Know

The Texas Stock Exchange has moved from a proposed alternative to an operating market. TXSE completed its initial trading rollout in July 2026, welcomed its first exchange-traded fund listings in September, and announced its first corporate primary listings on October 5. For compliance professionals, those developments create a practical question: what would a TXSE listing require our company to do differently?

The answer begins with a familiar framework. TXSE operates as an SEC-registered national securities exchange. Companies choosing it remain subject to applicable federal securities laws and exchange listing requirements. The important differences involve particular governance structures, operational procedures, transaction approvals, and a proposed change to shareholder voting.

In their Corporate Compliance Insights article, “Y’all Street Plays by Familiar Rules — With a Few Twists,” Blessing Adeyeye and Evelyn Li explain how TXSE combines features of existing exchanges. Their analysis provides a useful starting point for CCOs: evaluate the actual requirements and their implications for your company’s controls.

This comparison addresses ordinary domestic operating companies. Foreign private issuers, controlled companies, partnerships, and other special entities may qualify for exemptions or different requirements. It also compares TXSE with the principal NYSE and Nasdaq markets; NYSE Texas is a separate exchange.

Start with the Company’s Continuing Obligations

An exchange transfer does not eliminate applicable SEC reporting, financial disclosure, insider trading, or Sarbanes-Oxley obligations. Nor does it automatically change the company’s state of incorporation or the law governing directors’ fiduciary duties. Those distinctions matter when a board considers a Texas listing alongside discussions about headquarters relocation or reincorporation. Each decision requires its own analysis.

For the CCO, the immediate responsibility is to identify which obligations arise from federal law, which arise from the exchange, and which arise from corporate law or the company’s governing documents. Combining them into a general discussion about a favorable business environment can obscure significant responsibilities.

Audit committee oversight illustrates the continuing federal foundation. SEC Rule 10A-3 establishes requirements addressing independence, oversight of the external auditor, complaints about accounting and auditing matters, access to advisers, and funding. Those responsibilities remain central to listed-company governance.

A listing decision should therefore prompt a review of whether the company’s reporting and escalation arrangements work in practice. Can employees raise accounting concerns confidentially? Does the audit committee receive significant findings promptly? Can investigators obtain the records they need?

How the Governance Requirements Compare

The following summarizes core requirements, subject to applicable exemptions and transition periods. TXSE’s framework combines Nasdaq-like nomination flexibility with an NYSE-like internal audit requirement.

Governance issue TXSE NYSE Nasdaq
Board independence Generally requires an independent majority Generally requires an independent majority Generally requires an independent majority
Audit committee Generally at least three members, with independence and financial qualifications Generally at least three members, with independence and financial qualifications Generally at least three members, with independence and financial qualifications
Compensation committee Generally at least two independent directors An independent compensation committee is required. Generally at least two independent directors
Director nominations Independent directors or an independent nominations committee Independent nominating/corporate governance committee required Independent directors or an independent nominations committee
Internal audit function Required, subject to applicable exceptions and transition provisions Required, subject to applicable exceptions and transition provisions No general standalone listing requirement
Published corporate governance guidelines No comparable general NYSE-style requirement Required No comparable general NYSE-style requirement
Code of business conduct and ethics Required Required Required

The principal provisions include TXSE Rules 16.405–16.407 and 16.414, NYSE Section 303A, and Nasdaq’s Rule 5600 Series. The article’s comparison is consistent with these core distinctions. For a Nasdaq company considering TXSE, internal audit deserves early attention. Management should determine whether an existing function satisfies the requirement and whether its resources, reporting arrangements, and audit committee access are adequate.

For an NYSE company, TXSE’s nomination structure may offer flexibility. However, flexibility does not establish a business reason to dismantle a functioning committee. The board should evaluate whether its current structure provides effective oversight and clear accountability. The same reasoning applies to governance guidelines. A company may find them valuable for explaining director responsibilities, succession planning, and board practices even where its exchange does not require them.

Transaction Approvals Require a Fresh Review

Shareholder approval requirements are another area where broad similarities can conceal consequential differences. TXSE’s Rule 16.412 generally follows Nasdaq’s approach to acquisition-related issuances, changes of control, equity compensation, and certain large nonpublic issuances. NYSE maintains a parallel framework, but it treats certain transactions and related parties differently.

The familiar “20% rule” is shorthand for a more detailed analysis. Transaction structure, voting power, potential convertible issuances, pricing, and applicable exceptions all matter. Even pricing definitions require attention: TXSE’s relevant minimum-price calculation uses bid prices, while Nasdaq’s uses Nasdaq Official Closing Prices.

Consider a company negotiating an acquisition partly funded with stock. The commercial team may focus on valuation and financing certainty. Compliance and securities counsel should ensure that shareholder approval, exchange consultation, and additional-share requirements enter the timetable before the parties commit to an unrealistic closing date. The practical response is to revise transaction checklists when changing exchanges. Assign responsibility for reviewing equity issuances, compensation arrangements, acquisitions, and changes of control. Require escalation early enough to influence the transaction.

The Voting Proposal Deserves Separate Attention

TXSE’s proposed treatment of uninstructed broker-held shares could create a significant governance difference. As of this writing, it should be treated as a pending proposal. The SEC instituted proceedings in September to determine whether to approve or disapprove it. Under the proposal, a covered TXSE member would allocate uninstructed shares proportionally to instructions received from its participating beneficial owners for each proposal, subject to specified exclusions.

For example, if that broker’s instructed shares were voted 60% for and 40% against a proposal, the covered uninstructed shares would generally follow that distribution. The calculation would occur at the broker level, rather than by applying one company-wide voting percentage. Existing broker-voting rules restrict voting without instructions on director elections, executive compensation, and other significant matters. The TXSE proposal raises questions about how proportional allocation would interact with those protections. Its stated scope concerns primary TXSE listings and excludes securities whose primary listing remains on another exchange.

For issuers, the potential implications include vote forecasting, shareholder engagement, quorum planning, and communications about voting mechanics. Corporate secretaries, counsel, investor relations, and compliance should monitor the proceedings together. For broker-dealer compliance teams, approval could require changes to proxy-processing systems, calculation controls, exclusions, and recordkeeping. Implementation planning should follow the final approved text and effective date.

Listing Compliance Is an Operating Process

The article also identifies TXSE’s mandatory confidential eligibility review and its single listing tier. These features affect planning, particularly for smaller companies evaluating their available markets. Nasdaq’s multiple tiers provide a different eligibility structure. A CCO should help management distinguish initial eligibility from the ability to maintain compliance after admission. Share price, capitalization, distribution, reporting, and governance requirements need continuing monitoring.

Dual listing adds another operational consideration. Teams should identify which obligations remain applicable at each venue and where documented accommodations permit reliance on another exchange’s submissions. Disclosure procedures deserve particular care. NYSE’s 2026 guidance illustrates how detailed these requirements can be: specified material-news releases require advance notice to Market Watch, and supplemental listing applications require exchange authorization before covered issuances. A public SEC filing does not necessarily satisfy a separate exchange-notification obligation.

Before a transfer or additional listing, test a realistic scenario involving an earnings release, director resignation, acquisition announcement, or unexpected compliance deficiency. Confirm the responsible person, required recipients, submission method, deadline, and backup arrangements. That exercise will reveal more than a general certification that the company understands its new obligations.

What CCOs Should Bring to the Board

The board’s listing analysis should connect commercial benefits with implementation costs and governance consequences. Compliance can contribute a concise assessment covering five areas:

  1. Governance gaps. Identify required changes to committee composition, charters, internal audit, policies, and certifications.
  2. Operational readiness. Establish a calendar of filings, notifications, reviews, and escalation deadlines with named owners.
  3. Transaction controls. Update approval procedures for acquisitions, equity issuances, compensation plans, and related-party arrangements.
  4. Rule developments. Track the proxy-voting proposal and other changes through approval and implementation.
  5. Evidence of effectiveness. Test whether personnel can execute the revised procedures and promptly correct deficiencies.

Directors should ask what measurable business benefit the listing decision delivers, which obligations change, and whether management has budgeted for implementation. They should also ask whether proposed governance changes improve oversight or merely reduce formal requirements.

TXSE gives companies another venue through which to access public markets. For compliance professionals, its arrival creates an opportunity to examine how governance commitments translate into daily work. The strongest contribution a CCO can make is a documented assessment that enables the board to choose confidently and management to execute reliably.

Categories
Blog

Anthropic’s IPO: A 90-Day Action Plan for Your Compliance Program

You don’t need to build frontier AI models to learn from the risks examined in this series. If your company purchases AI services, connects them to business systems, or relies on their outputs, those choices belong in your compliance risk assessment. The practical question is what you will do differently on Monday morning.

Parts I and II examined ten risks arising from Anthropic’s registration statement. Part III translated them into lessons for compliance professionals. Part IV considered the questions its Safety and Risk Committee should ask. This concluding post brings the discussion to your company, with a 90-day plan to turn those lessons into operating decisions and meaningful board oversight.

The objective is a defensible starting point: know your consequential AI uses, assign responsibility, test critical safeguards, and give directors a clear account of unresolved exposure. Ninety days can establish that discipline. Continuing review must sustain it.

Translate the risk into your business

Start with how the technology operates in your environment. Your company may have little control over a provider’s model development, but it can decide what data to supply, which systems to connect, what permissions to grant, and which outputs require verification.

Consider a manufacturer introducing an AI procurement assistant. Initially, it summarizes supplier proposals. Later, it ranks vendors, drafts diligence reports, and prepares payment instructions. Each expansion changes the compliance analysis. A tool that once saved reading time now influences third-party selection and financial controls.

A CCO should connect those changes to existing responsibilities: conflict disclosures, intermediary diligence, restricted-party screening, approval limits, and accurate records. This makes the conversation relevant to procurement, finance, and management. The issue is whether the business process remains controlled as the tool takes on more responsibility.

Days 1–30: Establish visibility and ownership

Convene a working group with procurement, technology, security, privacy, legal, finance, and relevant business leaders. Use existing governance forums where they work. Ask each function to identify AI uses that affect sensitive information, consequential decisions, external communications, or transactions.

Next, combine those discussions with available purchasing records, software inventories, and security information. Include AI features added to existing applications and tools employees obtain outside normal procurement. Explain that disclosure enables assessment and support. Employees need a practical way to surface uncertain uses.

For each consequential use, record the business purpose, accountable executive, provider, information involved, connected systems, permissions, and affected stakeholders. Identify whether the tool advises a person or can act independently. Document known gaps in the inventory so management understands its limits.

Prioritize according to potential harm, applicable obligations, reversibility, and the reach of an error. A public-information drafting tool should receive proportionate review. An agent that changes supplier records or handles confidential investigation material warrants closer scrutiny.

Assign business ownership explicitly. The CCO coordinates the compliance assessment and challenges weaknesses; business leaders remain responsible for their processes. Security, privacy, legal, and technology teams own their respective controls and advice—document who can approve, restrict, or suspend a use and how disagreements escalate.

Day-30 deliverable: A prioritized inventory with accountable owners, immediate safeguards, unresolved questions, and the three to five uses requiring deeper review. Address urgent exposure immediately rather than waiting for the next phase.

Days 31–60: Test the controls that matter

Select the highest-priority workflows and trace an actual transaction or decision from beginning to end. Identify what the AI receives, what it produces, who relies on it, and what can happen before a person intervenes.

In the procurement example, test whether the assistant can recommend a supplier before diligence is complete. Determine whether generated summaries preserve the underlying evidence. Check whether it can change payment details or prepare instructions without independent verification. Use realistic scenarios, including incomplete information and attempts to bypass approval requirements.

Treat human review as a control requiring evidence. Does the reviewer have the source information, time, expertise, and authority to challenge the output? A mandatory approval click provides limited assurance if employees routinely accept recommendations without examination.

Examine the provider relationship alongside internal controls. Ask procurement and counsel to assess data-use terms, retention, incident notification, subcontracting, material service changes, and available assurance information. Document gaps and business consequences. Where negotiating power is limited, consider restricting the use or adding safeguards within your environment.

Test operational resilience. Can the company revoke access, recover necessary records, and continue a critical process if the service fails or becomes unsuitable? Identify dependencies shared across applications. A fallback process needs an owner and an exercise demonstrating that it works.

Translate findings into corrective actions with deadlines and interim protections. Give employees short, role-specific instructions about approved tools, sensitive information, verification, and reporting unexpected behavior. Include a realistic scenario in team training and invite questions about work pressures that encourage shortcuts.

Day-60 deliverable: A documented assessment of selected workflows showing tested controls, failures, limitations, remediation owners, and proposed decisions. Label what remains untested so management does not mistake partial assurance for comprehensive coverage.

Days 61–90: Exercise the response and inform the board

Run a tabletop exercise involving one consequential AI use. For the manufacturer, assume the procurement assistant exposes confidential supplier information and produces unreliable diligence summaries. Ask who detects the problem, limits access, preserves evidence, and determines which decisions require rechecking.

Bring communications, legal, and business leaders into the exercise to support buy-in and internal subject matter expertise. Examine how they assess customer or supplier communications and any applicable notification requirements—test when executives and directors receive notice. Record delays and unclear responsibilities, then assign corrective work.

Retest priority fixes from the previous phase. Internal audit or another qualified reviewer, where appropriate, should challenge management’s conclusion that serious weaknesses have been resolved. For a smaller company, obtain independent expertise selectively where internal capability is insufficient.

Build change review into normal operations. New data connections, expanded permissions, provider updates, and changed business purposes should trigger reassessment proportionate to their significance. Set a recurring cadence to review incidents, exceptions, overdue remediation, and critical dependencies.

Day-90 deliverable: An evidence-based management and board briefing, supported by exercise results and verified remediation. Include a funded plan for remaining work, named owners, and the decisions needed to proceed within approved limits.

Help the board make decisions

Part IV examined Anthropic’s Safety and Risk Committee. Your company should allocate oversight based on its risks, committee responsibilities, and available expertise. A dedicated committee is one possible arrangement. Clear responsibility and coordination are essential, regardless of the structure the board uses.

Prepare a concise briefing around five items: consequential AI uses, material control gaps, testing results, significant incidents or exceptions, and decisions requiring director attention. Explain the business effect of each issue. A request to restrict system access should identify the exposure addressed, operational consequences, and alternatives.

Clarify coordination across audit, risk, compensation, technology, and other relevant responsibilities. Financial reporting concerns, employee incentives, and security incidents may intersect. Establish who leads and how information reaches the full board.

Give directors three questions they can use immediately:

  • Which AI use creates our most significant unresolved exposure, and who owns it?
  • What testing demonstrates that our most important safeguards work, and what remains uncertain?
  • What decision or resource commitment does management need from us today?

Arrange private access for the CCO and relevant control leaders. Preserve records of substantive challenge, decisions, and follow-up. The board should receive enough information to oversee management while management remains accountable for operating the controls.

Measure progress and keep the discipline.

Measure changes in exposure alongside completed activities. Track whether priority uses have tested safeguards, critical permissions have been restricted, serious fixes have been verified, and material changes are reviewed on time. Explain the scope and limitations of each measure.

Compliance teams should apply the same discipline to their own AI tools. Diligence, monitoring, and investigation applications require appropriate confidentiality protections and validation. Check an AI-generated conclusion about misconduct against the underlying evidence before it informs a consequential decision.

The same method can strengthen compliance beyond AI. A weak escalation route, an unsupported product claim, or an untested supplier contingency is a program issue regardless of the technology involved. Ask where each finding may recur across other business units and processes. Use that analysis to update the enterprise risk assessment and internal audit priorities.

Resource decisions should follow the evidence. Identify what existing teams can absorb, where specialist support is necessary, and which planned uses should wait until safeguards are ready. This gives executives a concrete basis for choosing priorities and funding corrective work.

The business value is practical: better-supported decisions, clearer accountability, and fewer avoidable disruptions when technology changes. A company that understands its approved uses and safeguards is better positioned to deploy AI with confidence.

The lesson running through this series is that governance commitments acquire value through daily operating choices. For the compliance professional outside Anthropic, the next step is within reach: identify one consequential workflow, bring its owner into the discussion, and test whether the controls still work. Use the findings to improve the program and give the board a decision it can act upon.

Conclusion

As readers of my blog posts know, I often start on a blog or two, only to get carried away by the subject matter. This week was no exception. Given all the hyperbole around Anthropic, I started only wanting to see if there was anything tangible.

I can remember back in the first decade of this century, in the early days of enterprise-wide risk assessments, consultants would bring us risks such as a meteor or comet strike as a teaching tool. This inevitably bogged business leaders in wildly improbable, sci-fi-level catastrophes. This led many business leaders at the time to take ERM less seriously than they should have if the consultants had been more business-grounded.

The more I studied the Anthropic IPO and wrote this series, the more I saw applicability to what CCOs and compliance professionals need to do today. The compliance professional of 2026 faces different challenges than the compliance professional in 2010, 2015, and certainly anytime pre-pandemic. Even in the 2020’s we have had as much business instability and change from the iterations of the Trump Administration(s).

I want every CCO and compliance professional to understand that the basic principles of compliance still apply, even with the breakneck speed of technological development, and that by using tested principles from the past 20 years, we can continue building the groundwork for compliance. The bottom line is that more effective compliance still means more efficient controls, which lead to greater ROI and profitability.

Categories
Blog

Anthropic’s IPO: Top 10 Corporate Compliance Risks, Part II

What does it take to build an effective compliance program around an AI business? In Part I of this series, Tom Fox examined the first five of 10 key risks for compliance professionals identified in Anthropic’s IPO disclosures: AI safety and autonomy, regulatory enforcement, data privacy and cybersecurity, intellectual property, and export controls. Each raises a practical question for CCOs and boards: can management demonstrate that its governance and controls are effective as the technology advances?

The remaining five risks extend that inquiry across the enterprise. Third-party dependencies, bribery and corruption, financial reporting, board oversight, and product representations are familiar responsibilities for compliance professionals. In an AI business, however, those responsibilities must account for powerful commercial partners, rapid international expansion, complex infrastructure dependencies, and claims about technology whose performance can be difficult to validate.

This is where compliance must be embedded in business decisions. Due diligence must inform partner selection. Disclosure controls must support investor communications. Product claims must rest on evidence. Board reporting must give directors enough independent information to challenge management and require corrective action.

6. Third-party risk, strategic partnerships, and supply-chain dependencies

The disclosed risk: Anthropic identifies substantial dependencies involving computing infrastructure, cloud providers, strategic partners, vendors, and commercial intermediaries.

The compliance exposure: Critical third parties may create cybersecurity, data protection, sanctions, operational resilience, concentration, and regulatory compliance risks. A control failure at a cloud provider or commercial partner can become an enterprise-level compliance incident.

The CCO response: Apply risk-based third-party due diligence, contractual control requirements, audit rights, continuous monitoring, concentration-risk assessments, and exit planning for critical suppliers.

The Board question: Which third-party relationships could materially impair the company’s ability to operate lawfully or meet its compliance obligations if they failed?

7. Anti-bribery, corruption, and financial crime

The disclosed risk: Anthropic expressly identifies obligations under the FCPA, UK Bribery Act, anti-money laundering laws, and comparable international requirements. It acknowledges risks arising from third-party intermediaries, government interactions, lobbying, and international expansion.

The compliance exposure: Global sales and government contracting can create opportunities for improper payments, questionable intermediary compensation, conflicts of interest, and corrupt procurement activity. The company acknowledges that it may face liability for third-party misconduct even when it has not expressly authorized the conduct.

The CCO response: Implement risk-based third-party due diligence, beneficial ownership checks, government-interaction controls, transaction monitoring, gifts-and-hospitality procedures, and continuous testing of intermediary payments.

The Board question: Does the anti-corruption program cover the full network of resellers, intermediaries, agents, and other parties involved in global commercialization?

8. Financial reporting, disclosure controls, and public-company readiness

The disclosed risk: Anthropic highlights the difficulty of accurately forecasting revenues, expenses, computing requirements, and business performance. It also acknowledges that certain operational metrics depend on internal methodologies, assumptions, and systems that have not been independently verified.

The compliance exposure: Rapid growth and complex financial arrangements can create significant risks involving revenue recognition, valuation, financial reporting, internal control effectiveness, and potentially misleading investor disclosures. The transition to a public company raises expectations for disclosure controls, audit committee oversight, and Sarbanes-Oxley compliance.

The CCO response: Strengthen disclosure committees, financial control testing, management certifications, data lineage, audit trails, and review of operational metrics included in investor communications.

The Board question: Can management substantiate every material financial and nonfinancial performance metric disclosed to investors?

9. Corporate governance, board oversight, and conflicts of interest

The disclosed risk: Anthropic’s registration statement addresses its distinctive governance structure, long-term public benefit objectives, capital structure, and relationships with investors and strategic partners.

The compliance exposure: Complex governance arrangements may create tensions among shareholder interests, management incentives, public benefit commitments, safety obligations, and commercial pressures.

The CCO response: Establish explicit board-level risk ownership, documented escalation requirements, independent compliance reporting, conflict-of-interest procedures, and regular assessments of governance effectiveness.

The Board question: Does the board receive sufficient independent information to challenge management’s decisions regarding AI safety, regulatory compliance, and commercialization? For directors, the central issue is whether governance mechanisms support meaningful oversight of mission-critical risks, consistent with the principles associated with Delaware’s Caremark oversight doctrine.

10. Consumer protection, product representations, and misleading AI claims

The disclosed risk: Anthropic identifies risks involving model reliability, accuracy, safety, marketing representations, customer expectations, and consumer protection enforcement. Its financial statement disclosures also identify litigation alleging deceptive advertising concerning subscription plans, allegations the company disputes.

The compliance exposure: AI companies may face liability when representations concerning safety, capabilities, reliability, privacy, or performance exceed what testing and operational evidence can support.

This risk is particularly significant when customers rely upon AI outputs for consequential decisions or deploy AI agents with authority to act.

The CCO response: Require legal and compliance review of material AI product claims, retain supporting testing evidence, establish performance validation standards, and monitor customer complaints for indications of misleading representations.

The Board question: Do the company’s public claims about AI safety and performance have documented, independently challengeable evidence to support them?

Part II completes Tom’s compliance-focused ranking of Anthropic’s disclosures with risks six through ten. Their position on the list should not diminish the attention they receive. A failure in any one of these areas can expose weaknesses across the broader control environment. For each, he considers the disclosed risk, the compliance exposure, the CCO response, and the question directors should ask.

Across these ten risks, a common thread emerges: effective AI governance depends on the quality of the company’s underlying compliance program. Third-party oversight, reliable disclosures, independent challenge, and substantiated product claims require accountable owners, tested controls, and timely corrective action. These responsibilities extend to any business incorporating AI into its operations.

Tomorrow in Part III, Tom will translate this risk analysis into five practical lessons for CCOs and business leaders. The focus moves from identifying exposure to managing it: integrating AI into enterprise compliance, adapting traditional controls, overseeing technology dependencies, embedding compliance in product development, and giving boards evidence of effectiveness. For compliance professionals, the next step is to turn these lessons into decisions about how to approve, deploy, monitor, and control AI.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Anthropic’s Board Structure – What Does it Mean for Compliance

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it fully. Looking for hard-hitting compliance insights? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss Anthropic’s S-1 registration statement for a forthcoming IPO, focusing on what it reveals about corporate governance and risk oversight rather than financials.

Kelly notes Anthropic has a seven-member board with three insiders (CEO Dario Amodei, Daniela Amodei, and CFO Christina Rao) and four outsiders, operating through four committees: audit, compensation, nominating/governance, and a safety and risk committee tasked with AI safety, security, and broader legal/regulatory/compliance risks. They question whether a two-member safety and risk committee, chaired by Novartis CEO Vas Narasimhan and joined by Christopher Liddell, has sufficient capacity, and note that the committee has an undisclosed written charter. They also flag uncertainties about Anthropic’s internal compliance/risk leadership and reporting filters, potential amended filings, and a five-member long-term benefit trust (one seat vacant) with influence over nominating outside directors.

Key highlights:

  • Anthropic IPO S-1 overview
  • Board size and committees
  • Risk committee staffing questions
  • CEOs talking about AI risks
  • More filings and disclosure gaps

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds, was recently named one of the Top 25 Regulatory Compliance Podcasts, Top 10 Business Law Podcasts, and Top 12 Risk Management Podcasts. Compliance into the Weeds has been awarded a Davey, Communicator, and W3 Award, all for podcast excellence.

Categories
Blog

Andrew McBride Does it Again: His New Guide on Buying Compliance Technology

Compliance technology has become the operational backbone of the modern ethics and compliance program. When technology works, it can make compliance faster, more consistent, measurable, and embedded in business operations. When it doesn’t, the consequences show up everywhere: spreadsheets, manual workarounds, disconnected data, frustrated employees, and compliance professionals spending time administering technology rather than managing risk.

That makes buying compliance technology more than an IT procurement exercise. It is a compliance program effectiveness issue. One commentator on this aspect of AI for compliance is Andrew McBride, founder of the consulting firm Integrity Bridge LLC. McBride recently released Recommended Practice for Buying & Selling Compliance Technology, based on surveys of compliance technology buyers and vendors. Its findings illuminate a fundamental imbalance in the marketplace. I can safely say this paper is the standard for compliance professionals evaluating and purchasing AI-based technology.

CCOs buy compliance technology infrequently. Vendors sell it every day. That imbalance matters. Compliance teams can be oversold on functionality. Vendors can become trapped in opaque procurement exercises. Business requirements can become disconnected from technical requirements. AI capabilities can be accepted without sufficient governance. Contracts can focus extensively on getting into a system while ignoring how the company will eventually get out. For the CCO, the lesson is straightforward. If you want to run compliance like a business, you must learn to buy compliance technology like a business. This is where McBride comes in.

Start With Strategy, Not Software

As a CCO, start with a documented compliance technology strategy aligned with business operations. McBride sees three operational layers for that strategy.

Compliance-owned technology includes platforms compliance directly manages, such as Codes of Conduct, training, whistleblower systems, investigation case management, and workflows for gifts, entertainment, and conflicts.

Compliance-shared technology includes systems operated across functions, such as third-party due diligence, transaction monitoring, and communications monitoring.

Enterprise dependency technology includes compliance systems that may not be owned but depend on ERP, CRM, HRIS, procurement, and financial platforms.

This third category is particularly important. A CCO may believe the company has a third-party risk problem when the real issue is poor vendor master data. Transaction monitoring may generate noise because underlying financial data is inconsistent. Technology strategy therefore begins with understanding the compliance program’s architecture.

Know What Compliance Really Costs

Here, McBride frames the question as, ‘What is the total cost of ownership? ‘How many screening tools are independently licensed by Compliance, Procurement, Finance, Credit, and Legal? How many employees maintain spreadsheets? How many hours are spent chasing approvals or reconciling systems? How much compliance talent is consumed by administration rather than risk management? Those costs matter because an inexpensive system can become extraordinarily expensive once you include the human infrastructure required to run it.

This leads to the recurring question: buy, build, or assemble? Internal IT may propose building custom tools. Sometimes that works, but the calculation must include maintenance, upgrades, staffing, cybersecurity, documentation, and key-person risk. Another option is configuring technology the company already owns. That may reduce licensing costs, but “we already own it” does not mean “it is free.” Configuration, integration, testing, administration, and support still cost money.

Commercial software offers established products and vendor-supported roadmaps, but buying software does not eliminate implementation challenges. Apply the same economic discipline to all three options. Don’t compare the sticker price of commercial software with an internal solution whose real costs have never been calculated.

AI Changes the Conversation

AI is moving into transaction analysis, investigation scoping, interview preparation, monitoring, and other compliance workflows. The opportunity is substantial. So is the governance challenge. The Integrity Bridge research presents an interesting picture. AI use appears widespread, but governance and confidence have not necessarily kept pace. Only about one in four compliance teams surveyed had established a formal governance framework. Fewer than half could articulate how AI demonstrably improved compliance outcomes. Only 41 percent of compliance leaders trusted AI-driven outputs for operational decisions.

At the same time, 84 percent reported efficiency gains, while fewer than half reported actual cost savings. That distinction between efficiency and effectiveness is critical. Doing something faster does not necessarily mean doing it better. The CCO should not simply ask, “Does this product use AI?” The better question is, “What compliance outcome does the AI improve, and how can we demonstrate it?”

AI Governance Starts Under the Hood

“AI-powered” is not a meaningful technical specification. McBride advises that compliance should understand what happens under the hood. Once again, he is spot on. Ask questions such as, “Which model is being used?” What information goes into it? What comes back? Is customer information retained? Can corporate data be used for training? Does a third-party model provider receive the information?

These are compliance governance questions because the data may include investigations, employee information, third-party records, or financial information. The contract should address how that information is handled and establish appropriate restrictions on the use of corporate data and queries.

Next, a series of questions about where the AI can fail. Here McBride suggests: How does the system prevent cross-tenant data leakage? How does it identify unsupported statements, hallucinations, or fabricated citations? What happens when malicious instructions are hidden inside uploaded documents? Most importantly, does the system recognize when it lacks sufficient confidence and escalate the matter to a human?

One of the most important characteristics of compliance AI may not be its ability to answer questions. It may be its ability to recognize when it should not answer them.

Keep Humans in the Control Environment

Agentic AI raises the stakes because technology moves from providing information to taking action. But this requires clear authority boundaries. What systems can the agent access? What records can it change? What decisions can it make? Which actions require approval?

Certain compliance decisions should remain subject to documented human authorization. Closing an investigation, changing third-party screening rules, or approving high-risk onboarding are obvious examples. This is where AI governance becomes internal controls. The organization should demonstrate not merely that humans are theoretically “in the loop,” but where human intervention occurs, who has authority, what approval evidence is retained, and what happens when the AI crosses a defined threshold.

CCOs must also understand AI economics. Traditional platforms may be priced by employees, users, or third parties. AI functionality can introduce consumption pricing tied to tokens, documents, searches, or API calls. Model realistic usage and negotiate appropriate spending caps, alerts, overage controls, and consumption rates.

Turn the RFP Into a Governance Exercise

A good RFP does more than collect vendor responses. It forces the organization to define what it actually needs. McBride highlights vendor frustration with “phantom RFPs,” where an incumbent has effectively been selected, or the process is used primarily to gain renewal leverage. A credible RFP must instead be transparent, disciplined, and operationally grounded.

Start with Procurement. Understand source-to-pay requirements, spending thresholds, cybersecurity reviews, privacy requirements, and contracting procedures before bringing vendors deep into the process. Then give vendors meaningful operational information: employee populations, transaction volumes, existing systems, data maturity, integrations, geographic requirements, and workflow constraints.

Most importantly, force precision into vendor answers. Require vendors to classify functionality as:

  1. Available out of the box.
  2. Available through configuration.
  3. Available through a named third-party integration.
  4. On the roadmap with a committed date.
  5. Not supported.

That discipline can dramatically improve an evaluation and create a record of what was actually promised.

Stop Buying Features. Test Controls.

Feature checklists have limits.

McBride suggests that a better test is a scenario. Suppose a critical third party is added to a sanctions list overnight. Ask the vendor to show exactly what happens. Ask questions such as, “How is the alert generated?” Who receives it? How is it prioritized? Who can override it? How is the matter escalated? What evidence is captured? What appears in the audit trail?

Now you are not evaluating a feature. You are evaluating a control. The same principle applies to sandboxes. A generic vendor sandbox tells you relatively little. Require a guided environment configured around your workflows using synthetic or anonymized data. Make users perform the work. That is where implementation problems begin to reveal themselves.

Look Under the Hood Before You Buy

A beautiful interface can be seductive, but buying compliance technology based primarily on user experience is like buying a house because you like the countertops without checking the plumbing. However, before you make a final selection, conduct due diligence around security controls, hosting, uptime, integrations, implementation resources, and data portability.

Review relevant SOC 2 Type II controls. Speak with peer customers. Consider asking to speak with a customer that recently left the platform. Just as importantly, interview the people who will actually implement the product. The team delivering the sales demonstration may not be the team handling implementation. Know who shows up after the contract is signed.

Begin the Relationship by Planning the Exit

Perhaps the most overlooked element of compliance technology contracting is the exit. Companies spend enormous time determining how information will enter a system and surprisingly little determining how they will get it back. A CSV containing basic fields may not recreate an investigation file or preserve the history of a third-party approval. It may not capture attachments, comments, timestamps, escalations, approvals, or audit trails.

Before signing, define export requirements. Ask questions such as: What formats will be provided? What metadata will be preserved? What happens to attachments? Will the audit trail survive? How long will migration assistance remain available? What will extraction cost? When will the vendor delete remaining copies? Understand how you will leave a compliance technology provider before deciding to join it.

The CCO’s Technology Mandate

Compliance technology doesn’t succeed or fail when Legal finishes negotiating the contract. The outcome is largely determined earlier. Did Compliance understand the business problem? Did it know the true cost of the existing process? Did it understand its data? Did it challenge AI claims? Did it test failure modes and workflows? Did it involve Procurement, IT, Privacy, Security, Legal, and the business at the right points? Did it negotiate for implementation, operation, and exit?

Those questions turn technology procurement into compliance governance. Compliance professionals spend their careers asking businesses to operate with transparency, accountability, documentation, fairness, and integrity. Compliance should bring those same principles into the technology marketplace.

Define what you need. Understand what it costs. Test what the vendor claims. Document what was promised. Build controls around AI. Measure whether the technology improves the program. Make sure you can get your data back when the relationship ends. That is what it means to run compliance like a business.

Practical Takeaways

For the CCO, the mandate is clear: build the strategy before selecting the technology; calculate the Total Cost of Ownership rather than the license cost; treat AI as a governance and internal controls issue; test workflows rather than watch demonstrations; diligence the implementation team; and negotiate data portability and exit before signing.

For boards and senior management, the oversight question is equally straightforward: What compliance risk is this technology addressing, how will management measure whether it improves program effectiveness, and what controls govern its use?

The answer tells you much more than whether Compliance has purchased the latest technology. It tells you whether the organization is building a technology architecture that can support an effective compliance program.

If you do not follow Andrew McBride on LinkedIn, you should. He is leading the discussion on the practical aspects of putting the right AI tool in place for you and your organization. His organization will be displaying at this week’s SCCE CEI, so drop by the Integrity Bridge and find out why I think he is the go-to guy in this area.

Categories
Blog

Does Your Board Have the Expertise and Independence to Oversee Compliance

A board can have impressive credentials and still lack the experience needed to challenge management on the company’s most significant compliance risks. Directors may understand finance, strategy, and operations in broad terms while struggling to recognize how misconduct could arise within a particular business model. Effective oversight requires relevant knowledge and the willingness to use it when the answers become uncomfortable.

For the chief compliance officer, that makes board capability a practical program issue. The quality of oversight influences the questions management must answer, the resources compliance receives, and what happens when a concern conflicts with a commercial priority. Today we examine board composition in the article Measuring Board Fit — Evidence from Elliott’s Campaign at Norwegian Cruise Line, from the Harvard Law School Forum on Corporate Governance. Their analysis uses AI to compare directors’ professional backgrounds with company strategy and with one another. It offers a starting point for a broader compliance question: Does this board have the expertise and independent judgment to oversee the risks this company actually faces?

Look Beyond the Skills Matrix

DesJardine and Mertens argue that conventional skills matrices can conceal meaningful differences in experience. Two directors may receive the same designation for operations or risk management while bringing very different capabilities to the boardroom.

The compliance application is straightforward. A risk management designation should prompt further inquiry into the nature, relevance, and recency of that experience. Has the director overseen a business using intermediaries in difficult markets? Has the director managed the integration of acquired companies? Examined an investigation involving senior leadership? Challenged a compensation structure that encouraged questionable conduct? No director needs to possess every capability. The board and its committees do need an informed basis for questioning management across the company’s priority risks.

The CCO can help define that basis. Translate the risk assessment into the experience and understanding needed for oversight. Where third-party conduct creates substantial exposure, explain the commercial relationships, payment practices, and escalation decisions directors need to understand. This gives the nominating and governance committee a more useful description than a generic request for compliance expertise.

Read the Norwegian Findings Carefully

The authors apply their method to Norwegian Cruise Line Holdings before and after Elliott Investment Management’s campaign, comparing its board with those of three cruise industry peers. They report that the company’s board-to-company similarity score increased from 0.382 to 0.396 following the changes. Average director-to-board similarity declined from 0.729 to 0.701, which they interpret as more distinct professional perspectives.

Those results describe changes in the authors’ measures of professional alignment and overlap. They do not establish that the reconstituted board became more effective at compliance oversight, that individual directors exercised greater independence, or that misconduct risk declined. That distinction matters for CCOs. An assessment can identify questions about composition without answering how directors perform. A board with relevant backgrounds still needs reliable information, sufficient time, and the resolve to follow an issue through. The practical response is to combine an examination of credentials with evidence of the board’s oversight process.

Examine Independence Through the Oversight Process

The authors acknowledge that their method cannot assess integrity, interpersonal skills, or willingness to challenge a chief executive. Those limitations point directly to the independent judgment compliance oversight requires. Consider a hypothetical board discussion about a distributor generating substantial revenue while repeatedly failing to provide requested ownership information. Management recommends extending the relationship during further review. A director with relevant experience may recognize how significant the missing information is. The next question is whether the board presses management to explain the proposed safeguards, decision authority, and consequences of continued delay.

The CCO should help create the conditions for that discussion. Present the facts, uncertainties, available options, and recommendation clearly. Identify who owns the decision and what would trigger escalation. Provide access to the underlying analysis where needed.

Direct access to the responsible committee and opportunities for discussion without management present can support candid oversight. Follow-up is equally important. An unresolved concern should return with updated evidence and a clear account of management’s actions. A difficult question has value when the governance process ensures it receives an adequate answer.

Make Expertise Usable Through Better Information

Even an experienced director can struggle with reports that emphasize activity while obscuring unresolved risk. Assess board capability and reporting quality together. A presentation may show that due diligence reviews are complete without explaining the exceptions approved. Investigation statistics may omit repeated issues within one business unit. Remediation updates may describe actions as finished without showing whether the revised controls work.

A CCO should organize reporting around decisions and consequences. Explain the issue, the evidence, management’s response, and what remains unresolved. When a commercial objective conflicts with a compliance recommendation, make that tension clear. Directors can then apply their experience to a concrete problem. Does the proposed response address the cause? Is the responsible executive accountable for delivery? What evidence will show that the correction is working? These questions help convert professional knowledge into oversight of program effectiveness.

Preserve Perspectives That Challenge Assumptions

The authors examine both alignment with company strategy and similarity among directors. That combination highlights a tension: a board needs relevant experience while retaining perspectives that question the organization’s assumptions. For compliance, industry familiarity can help a director spot questionable practices. It can also leave accepted business conventions insufficiently examined. Experience from another sector may expose weaknesses in customer treatment, escalation, or control ownership that insiders have normalized.

A CCO should therefore avoid equating a closely matched background with superior judgment. Ask what the board needs to understand and where a different perspective could improve its questions. Director education can help close specific knowledge gaps. Sessions built around the company’s actual processes, anonymized matters, and emerging business changes can give directors a better foundation for challenge. Persistent gaps may also warrant discussion of committee expertise or board recruitment, with those decisions remaining with the appropriate governance bodies.

Use AI Assessment as a Diagnostic Input

DesJardine and Mertens use contextualized word embeddings, a technique that turns text into numerical representations, to compare professional and company profiles. The approach can surface similarities that broad categories miss. For a board considering such analysis, the CCO and governance team should ask what information supports each profile and what the resulting score actually measures. Public biographies and media coverage provide an incomplete record of a director’s contributions. The volume and character of available material may differ substantially between candidates.

Company disclosures also describe the organization through a particular lens. Similarity to that description does not necessarily establish the expertise needed to address an overlooked risk or challenge an unsuccessful strategy. Use the output to inform interviews, reference discussions, and committee deliberations. Ask how sensitive the result is to source selection and whether the underlying evidence supports the interpretation. Record significant limitations. A numerical score should help the board investigate a capability question; appointment and evaluation decisions require accountable human judgment.

Action Steps for the CCO

Bring a practical assessment of oversight capability to the next discussion with the committee chair:

  1. Map priority risks to oversight knowledge. Identify what directors need to understand about the company’s business practices, controls, and escalation decisions.
  2. Provide evidence of capability gaps. Work with the corporate secretary and general counsel to inform education and composition discussions, using specific examples rather than broad labels.
  3. Strengthen the conditions for independent challenge. Establish clear access, candid reporting, and follow-up arrangements for unresolved concerns, including matters involving senior management.
  4. Test the usefulness of board reporting. Ensure directors can see material exceptions, recurring issues, remediation evidence, and decisions requiring their attention.
  5. Apply scrutiny to AI assessments. Examine source quality, missing information, and the limits of similarity measures before incorporating results into governance decisions.

Effective compliance oversight depends on directors who understand the company’s risks and are prepared to question how management addresses them. The CCO can strengthen that oversight by making capability needs explicit and ensuring the board receives the evidence needed to exercise its judgment.

Categories
Blog

Dolly Parton and the Compliance Value of a Life Well Governed

Dolly Parton died this week. Her death closed one of the most remarkable careers in American entertainment, but it did not close the institutions, ideas, and expectations she built. For corporate compliance professionals, that durability is what makes her story more than a tribute. It becomes a lesson in how values can be converted into governance. Today I want to honor Parton, what she did, and what she stood for, and perhaps hope that her life will inspire all of us to be just a little better.

Parton was one of twelve children. Parton began singing on local radio and television as a child and appeared at the Grand Ole Opry at thirteen. She wrote her first song at age 6. She moved to Nashville after high school, established herself as a songwriter, and became a national star through The Porter Wagoner Show. She then built a solo career that crossed country, pop, film, television, theater, publishing, tourism, and philanthropy. She recorded more than fifty albums, wrote roughly 3,000 songs, won ten Grammy Awards, and created works such as “Jolene,” “I Will Always Love You,” and “9 to 5” that became part of the American vocabulary. One of the most amazing facts I learned while researching this piece was that “Jolene” and “I Will Always Love You” were written on the same day. How is that for creative inspiration?

Parton did not run a corporate compliance program, and her career should not be forced into that frame. Yet she demonstrated something every CCO and Board of Directors needs to understand: culture becomes credible when stated values, hard decisions, operating systems, and visible conduct reinforce one another over time. Her public identity rested on kindness, independence, dignity, humor, and respect. She repeatedly made those commitments tangible in contracts, businesses, philanthropy, and crisis response.

Her entrepreneurship deserves equal attention. Parton moved from performer to owner, producer, publisher, and partner, most visibly through Dollywood and the enterprises built around it. The portfolio was diverse, but it was not random. Music, storytelling, family entertainment, Appalachian identity, hospitality, and community investment all reinforced a coherent promise. Compliance professionals should recognize the governance advantage of that clarity. Diversification creates new legal, operational, third-party, and reputational risks, but a stable purpose helps leaders decide which opportunities fit, which controls must travel with the business, and which deals to decline.

Independence Before Applause

Parton understood the difference between access to power and surrender to it. She left Porter Wagoner in 1974 to build an independent career, expressing gratitude for the partnership without allowing it to define her future. She later declined an opportunity for Elvis Presley to record “I Will Always Love You” when his manager demanded a share of the publishing rights—saying no cost her an extraordinary short-term opportunity. Retaining ownership preserved the long-term value of her work, especially when Whitney Houston’s recording became a worldwide success. Business Insider called it “her smartest business move.”

That decision should resonate with compliance leaders. Independence is not a paragraph in a charter. It is the authority to resist pressure when revenue, status, or a powerful executive makes acquiescence attractive. A CCO needs direct access to the board, control over investigative escalation, sufficient resources, and protection against retaliation. Chuck Watson once said, “Sometimes the best deal is the one you don’t make.” A board should test whether that independence works when it is expensive, inconvenient, and unpopular. If compliance can say no only when nothing important is at stake, it is not independent.

Purpose Made Operational

Parton’s philanthropy offers an equally powerful lesson in program effectiveness. She created the Dollywood Foundation in 1988 to improve educational outcomes in her home county. Its Buddy Program paired students and offered a financial incentive for graduation; the dropout rate for the participating classes fell from 35 percent to 6 percent. In 1995, inspired by her father’s inability to read and write, she launched the Imagination Library. What began in Sevier County became a network operating across five countries that has delivered more than 300 million free books to young children.

This was not the purpose of branding. It was purpose translated into a defined population, a repeatable delivery model, local partnerships, funding, data, and measurable results. That is the same transition the Department of Justice asks companies to make when it evaluates whether a compliance program is well designed, adequately resourced, and working in practice. A value in the code of conduct must become an owner, a control, an escalation path, testing, and remediation. Intent is the beginning of a compliance program, not proof of one.

Listen to the People Who Experience Power

Parton’s film and song “9 to 5” gave popular form to workplace realities many employees already knew: power can be abused, unfairness can become routine, and people with the least authority often carry the greatest burden. The song endured because it recognized the lived experience behind organizational charts. It made a workplace issue visible without turning the people affected into abstractions.

Compliance programs fail when they listen only upward. Hotline statistics, exit interviews, culture surveys, investigation themes, retaliation allegations, and manager-level trends must reach leaders in a form that supports action. Boards should ask whether employees believe they can speak without losing status, opportunity, or employment. They should also ask whether the organization learns from weak signals before they become red flags. A speak-up system is not effective because a telephone number exists. It is effective when people trust the process and see consistent, fair outcomes.

Trust Earned Through Response

Parton’s businesses remained closely connected to the community that formed her. Dollywood became Sevier County’s largest employer, while its stated operating culture emphasizes hospitality, authenticity, collaboration, and respect. The company supports employee development, including tuition assistance. When wildfires devastated East Tennessee, Parton helped organize direct support for affected families. During the COVID-19 pandemic, her $1 million gift established a Vanderbilt research fund that supported work connected to the Moderna vaccine.

The compliance lesson is that reputation is a lagging indicator of accumulated conduct. Trust is built before a crisis through thousands of ordinary decisions about employees, customers, communities, and counterparties. A crisis tests it through the speed, fairness, transparency, and competence of the response. A company cannot purchase credibility with a campaign after years of contrary conduct. The best crisis communication remains a well-governed response supported by facts, accountable owners, and visible follow-through.

A Board Agenda Worthy of the Lesson

Parton’s legacy was unusually broad, but its organizing logic was simple. Know what matters. Protect it when pressure arrives. Build systems that carry values beyond the founder. Listen to people whose voices are easiest to overlook. Measure whether the work changes outcomes. Repeat the conduct long enough that stakeholders can rely on it.

  • For directors, that logic produces five practical questions. What principles will the company not trade away for a transaction or quarterly target?
  • Does the CCO possess real independence, resources, information, and access?
  • Which data prove that stated values operate at the employee and third-party level?
  • Are speak-up and investigation systems producing trust, learning, and remediation?
  • When the company faces a crisis, can the board see decisions, owners, deadlines, testing, and closure rather than a record showing only that management made a presentation?

Dolly Parton understood that a carefully created image can open a door, but only character and performance can keep it open for seven decades. Compliance leaders often describe their goal as building a culture of integrity. Her career reminds us what that requires: independent judgment, operational discipline, attention to the less powerful, measurable impact, and consistency when no applause is guaranteed. That is not only a fitting business lesson from her life; it is a demanding standard for every organization that wants to be trusted.

Categories
Blog

Boeing, Caremark, and the Evidence of Good-Faith Oversight

On August 13, 2026, the Delaware Court of Chancery dismissed claims arising from the January 2024 Alaska Airlines door-plug blowout. A door plug left Boeing’s factory without four securing bolts, the FAA grounded the aircraft, and investigations identified production and quality problems. Yet corporate trauma did not establish bad-faith board oversight. The question was what the directors knew, what systems delivered that information, and how the company responded. For a Chief Compliance Officer, that distinction is the heart of the case. Boeing showed what evidence of conscientious oversight can look like. The Boeing Derivative Litigation, Consol. C.A. No. 2024-1210-MTZ (Del. Ch. Aug. 13, 2026) (the “Opinion”).

This decision continues the evolution of the Caremark Doctrine and details what Boards of Directors need to consider to meet their obligations under the Caremark Doctrine. For compliance professionals, this case should be studied for not only its substantive analysis but also for how you will need to train.

Caremark Still Asks Two Hard Questions

Caremark liability is rooted in the duty of loyalty and bad faith, not negligence or a poor outcome. Directors may face liability if they fail to implement a reporting system or if they establish one but consciously fail to monitor it, preventing themselves from learning about problems that require attention. The required state of mind is an intentional dereliction of duty or conscious disregard of known responsibilities. A flawed effort is not the same as no good-faith effort.

That standard should not become a message that directors are protected unless they do nothing. Directors must demonstrate how they tried. Fiduciaries who implement and attend to a reasonable board-level reporting system meet the baseline duty. Even for mission-critical operations, “Caremark does not demand omniscience.” The Board’s task is therefore not perfect foresight. It is disciplined attention.

The Record That Protected the Board

The most useful part of the Opinion for compliance professionals is its description of Boeing’s governance machinery. The board met at least every two months, and airplane safety was discussed at every meeting. Management provided commercial-airplane updates on safety, quality, operational performance, and production targets. A Chief Aerospace Safety Officer delivered global safety updates twice each year.

Boeing also had an Aerospace Safety Committee with directors experienced in engineering, manufacturing, aerospace, aviation, or safety. It met at least 23 times from January 2022 through July 2024. Reporting included safety risk registers, in-service safety reports, Speak Up updates, and special-attention reports. Significant safety incidents or regulatory actions were to be reported to the board or committee within 24 hours or as soon as reasonably practicable. The Audit Committee separately monitored internal controls, legal compliance, the DOJ deferred prosecution agreement, and FAA obligations.

After the door plug incident, the Aerospace Safety Committee met within a day, met again twice during the following week, and arranged an onsite factory inspection. That record did not erase the operational failure. It demonstrated an active reporting and response system.

An analysis from the law firm of Sullivan & Cromwell, whose authors’ firm represented Boeing and the defendants, makes the same point: mission-critical reporting, clear committee mandates, escalation channels, and contemporaneous records can be decisive when a court examines good faith. “Delaware Court of Chancery Reinforces Limits on Oversight Liability; Stresses Importance of Conscientious Board Oversight,” Harvard Law School Forum on Corporate Governance (the “S&C Analysis”).

Train Directors to Distinguish Red from Yellow

Plaintiffs characterized dozens of reports on manufacturing and safety risks as ignored red flags. The Court rejected that theory because it threatened to convert the “volume and depth” of reporting from a best practice into evidence of disloyalty. As the defendants put it, “If everything is a red flag, then nothing is.”

Recurring adverse information is not harmless, but the board must classify and connect it. A Caremark red flag must put directors on notice that the company is violating law or headed toward specific corporate trauma. It must also connect to the misconduct that caused the loss. General operational risks under active remediation may instead show that reporting is functioning. The Court described yellow flags involving operational risk, management responses, or matters insufficiently tied to the door-plug incident.

Board training should therefore require directors to ask three questions whenever adverse information arrives: Is this a business risk or a legal compliance risk? What is management doing about it? What facts would require escalation, independent verification, or a change in strategy?

Business Judgment Has a Boundary

The Opinion also distinguished business risk from positive law. Production schedules and the management of ordinary operational risk generally receive business-judgment deference. Directors, however, have no discretion to cause the company to violate the law knowingly.

The plaintiffs argued that Boeing’s production goals favored profits over safety. The Court found no particularized allegation that the targets themselves violated the law or that directors pursued a lawbreaking strategy. The record also showed that Boeing adjusted targets, delayed production increases, and evaluated staffing, quality, supply chain, and factory-health risks. Those actions supported an inference of good-faith business judgment, not conscious disregard.

For directors, the training point is not that every production decision is insulated. The board should understand where business discretion ends, and legal obligation begins. Compliance should identify the applicable mandates, show how they enter board reporting, and specify which thresholds require action rather than monitoring.

Books and Records Are Part of the Control Environment

The plaintiffs obtained extensive books and records describing committee responsibilities, recurring reports, risk metrics, remediation, and post-incident response. The record used to challenge the directors also demonstrated their engagement.

This is not a reason to create defensive minutes. It is a reason to create accurate, decision-useful records. Minutes should capture material questions, requested follow-up, commitments, and unresolved issues. Dashboards should show trends and control effectiveness, not merely activity. Closed items should include validation. Elevate persistent issues rather than repeatedly relabeling them. As the S&C Analysis observes, contemporaneous records can be critical because the court examines what the board received, whether it signaled obvious illegality or specific trauma, and how directors and management responded.

Five Questions For Your Board

  1. Mission-critical risk. Which legal, safety, compliance, cybersecurity, or operational risks could threaten the company’s viability, customers, or license to operate? The board should identify these risks based on the company’s industry, regulatory obligations, business model, and risk profile. Directors should understand which controls address each mission-critical risk and which executives are accountable for operating them. Compliance should periodically test whether the board’s risk priorities remain aligned with changing regulations, business operations, and emerging threats.
  2. Reporting architecture. Which committee owns each risk, what information reaches it, and through which escalation channel? Committee charters should assign clear oversight responsibility and prevent material risks from falling into gaps between the board and its committees. Directors should receive decision-useful information, including trends, control failures, remediation progress, and emerging exposure, rather than raw operational data. The reporting architecture should also define when management must escalate an issue from a committee to the full board.
  3. Red-flag discipline. What criteria distinguish ordinary variance, a yellow flag requiring remediation, and a red flag requiring Board action? Management and the board should establish objective escalation thresholds based on legal exposure, customer harm, financial impact, recurrence, control failure, and the possibility of significant corporate trauma. Yellow flags should receive documented remediation plans, accountable owners, deadlines, and continuing monitoring. Red flags should trigger prompt board attention, independent inquiry where appropriate, and documented decisions about containment, investigation, disclosure, and corrective action.
  4. Response evidence. Do minutes and dashboards show questions, decisions, owners, deadlines, testing, and closure, or only that a presentation occurred? Board records should demonstrate that directors engaged with material information, challenged management assumptions, and requested appropriate follow-up. Dashboards should track remediation through completion and include evidence that corrective actions were tested for effectiveness. Minutes should accurately capture the substance of your Board’s oversight without becoming defensive narratives or sanitized accounts of difficult discussions.
  5. Speak-up integrity. Can employees raise concerns without retaliation, and does the board receive meaningful information about allegations, investigations, trends, and corrective action? Directors should understand how reports are received, triaged, investigated, escalated, and resolved across the organization. Board reporting should address substantiation rates, recurring allegations, investigation delays, retaliation claims, root causes, and remediation effectiveness. Your Board should also evaluate whether employees trust the reporting system and whether management responds consistently regardless of the seniority or business importance of the individuals involved.

Boeing continues to provide a wealth of lessons learned for compliance professionals. The Delaware Court Opinion reminds us that the Caremark Doctrine offers neither immunity nor a checklist safe harbor. It reminds boards that the Caremark Doctrine is tested through evidence of good-faith effort. Compliance must build that effort into governance before the next crisis and ensure the record shows that directors received, understood, challenged, and followed through on critical information.

Categories
Blog

Private Company, Public Risk: Building Defensible AI Governance Before the Rules Arrive

For private companies, the central question about artificial intelligence is no longer whether the technology is in the business. It is whether anyone can explain where it is, what it does, what data it touches, and who is accountable when it fails.

That is the warning in “AI Governance for Private Companies,” by Hillary Flynn, Drew Morales, and Courtney Hugger of Wellington Management, which was recently posted in the Harvard Law School Forum on Corporate Governance. The authors report that nearly three in four companies plan to deploy agentic AI within two years, while only one in five has a mature governance model for autonomous agents. That is not merely a technology gap. It is a governance gap.

Private ownership does not make AI risk private. The consequences arrive through customers, employees, regulators, investors, lenders, insurers, and business partners. A company may not yet face a single comprehensive AI law, but it can still face a privacy complaint, contract dispute, cyber incident, customer loss, or damaged valuation. For compliance professionals, governance should precede scale.

Private Does Not Mean Exempt

Private companies are moving quickly because AI can increase productivity, improve customer service, accelerate analysis, support coding, and help a growing company scale. The article also identifies a critical lesson from Wellington’s portfolio companies: the largest barriers are often organizational, not technical. Companies making the strongest progress combine AI investment with employee training, clear governance, and defined expectations.

This is where the Chief Compliance Officer can reframe the discussion. AI governance is the discipline that allows useful experimentation without unmanaged legal and business exposure. The goal is not a thick policy on a shared drive. The goal is an operating system for accountable decisions.

The European Union AI Act is being implemented in phases through 2027, with expectations around transparency, human oversight, documentation, risk management, monitoring, and AI literacy. In the United States, NIST guidance, ISO standards, sector rules, state laws, and customer requirements are shaping expectations, even without a federal AI statute. A private company can therefore face AI governance demands through a contract or transaction long before a regulator knocks on the door.

Begin With the Business Objective

One of the article’s strongest recommendations is also one of the simplest: start with the business problem, not the AI tool. This is precisely what Carl Hahn has consistently maintained: always ask, “What is the Business Value?”Teams should define the desired outcome before selecting a model or vendor. Is it lower cost, faster response, better quality, increased revenue, fewer errors, or reduced risk?

Governance cannot evaluate an undefined promise. A measurable objective gives management a basis for deciding whether the use case works and whether its benefits justify its risks. It also creates stopping rules. Approval should identify what failure, customer impact, control breakdown, or scope change will trigger redesign, escalation, suspension, or retirement.

Compliance should insist on this discipline, particularly when an AI use case affects payments, eligibility, claims, pricing, employment, healthcare, education, financial products, or customer communications. Those are not ordinary software deployments. They are decisions and interactions with consequences for real people.

Inventory First, Then Tier the Risk

A company cannot govern what it cannot see. The foundation is an inventory of models, vendors, internal tools, embedded features, customer-facing systems, employee-built applications, and known shadow AI. It does not need to be perfect. It needs an owner, an update process, and enough information to support risk decisions.

Each use case should then be placed into a risk tier. Relevant factors include data sensitivity, degree of autonomy, importance of the business process, impact on customers or employees, regulatory exposure, ability to explain the result, and ease of reversing an error. Low-risk uses can follow a streamlined path. High-impact uses should receive enhanced testing, documented approval, human oversight, monitoring, and senior-level escalation.

Risk tiering prevents two failures. Treating every use as equally dangerous overwhelms review and encourages employees to route around it. Treating every use as ordinary technology leaves consequential applications without meaningful controls. Good governance applies greater rigor where potential harm is greater.

Put a Name Next to the Risk

Every AI system should have a business owner who remains accountable for its outcome. Accountability cannot be delegated to the model, the data science team, or the vendor. The owner should understand the intended purpose, approved users, permitted data, performance standard, escalation route, and circumstances under which the system must be paused.

Higher-risk applications should receive cross-functional review involving the business, product, engineering, legal, compliance, privacy, cybersecurity, procurement, and risk functions. This does not require a new bureaucracy. It requires a repeatable process with recorded approvals and clear responsibility.

Agentic AI raises the stakes because the risk moves from a wrong answer to a wrong action. Permissions should be limited, high-stakes actions should require human approval, and activity should be logged. Test override and shutdown mechanisms. The chatbot manipulated into agreeing to sell a vehicle for one dollar shows how weak boundaries turn a novelty into an operational event.

Treat Vendors as Part of the System

Most private companies will rely on external models, platforms, and software. That makes AI governance inseparable from third-party risk management. Traditional security questionnaires are not enough. Diligence should address how vendors use data, whether customer data trains models, how model changes are communicated, what transparency is available, how performance is tested, who bears liability, and whether data and workflows can be moved if the relationship ends.

The company should monitor model updates, service degradation, changes in terms, and features that expand access or autonomy. A tool approved for summarization should not silently become authorized to send messages, approve transactions, or alter customer records.

Monitor the System in Practice

AI governance does not end at approval. Model updates, new data, and user behavior can alter performance. Companies should monitor accuracy, reliability, bias, drift, misuse, repeated failures, and customer impact. An incident protocol should define how to pause the system, preserve evidence, escalate, remediate harm, and communicate with affected stakeholders.

This is where AI governance meets familiar compliance principles. The DOJ’s Evaluation of Corporate Compliance Programs asks whether a program works in practice. COSO emphasizes control activities, information, monitoring, and accountability. NIST’s AI Risk Management Framework helps organizations govern, map, measure, and manage AI risk. ISO/IEC 42001 offers a management-system approach. A company should select a coherent baseline and produce evidence that its controls operate.

A Practical Agenda for Boards and CCOs

Establish ownership. Name an executive accountable for AI governance and identify the board committee that will oversee material AI risk.

Build the inventory: capture sanctioned tools, embedded vendor capabilities, customer-facing uses, agentic applications, and known shadow AI.

Tier the use cases. Apply enhanced review where AI affects sensitive data, consequential decisions, critical operations, or autonomous action.

Strengthen the vendor process. Add AI-specific diligence, contractual protections, change controls, exit planning, and ongoing monitoring.

Test the failure plan. Confirm that the company can detect a harmful outcome, stop the system, preserve evidence, assign responsibility, and remediate the impact.

The author’s bottom line is the right one for compliance leaders: the winners will not necessarily be the companies that deploy AI fastest. They will be the companies that combine innovation with accountability, customer awareness, and disciplined execution. For a private company, defensible AI governance is not preparation for some distant regulatory future. It is how management protects value today.

Categories
Blog

From Policy to Proof: Six Compliance Priorities for the Next 90 Days

Editor’s note: I am a columnist for Compliance Week.

Compliance Week recently released its Practitioner’s Briefing, which “is crafted as a high-level recap of Compliance Week’s 2026 National Conference (CW 26), held in Washington, D.C., in May. Whether you were there or wished to be, this briefing will bring you up to speed. The briefing captures the six themes that pervaded three days of panel discussion and the networking conversations between them, with practical actions you can implement in the next ninety days.”

The compliance profession is entering the proof era. Policies still matter, but regulators, boards, and employees are asking a harder question: Can the organization demonstrate that its controls operate in practice? That is the central lesson from the Practitioner’s Briefing. Across six themes, the briefing describes a function under pressure from rapid AI adoption, faster whistleblower timelines, redistributed enforcement, expanding third-party exposure, and sharper board expectations.

Today I want to explore the themes and initiatives from the Practitioner’s Briefing. This is not about six disconnected initiatives covered at CW 26. It is an operating model that connects governance, data, accountability, and escalation around existing risks. You can use the next 90 days to produce evidence that the program knows where its risks sit, who owns the controls, how failures surface, and what happens next.

AI Governance: Accountability Must Follow Adoption

AI makes the policy-to-proof gap visible. The Practitioner’s Briefing reports that 83 percent of compliance functions have AI in production, while only 25 percent of leaders are confident in the governance controls. That is not primarily a policy problem. It is an ownership and control-design problem.

Start with your AI inventory. A defensible AI register should identify the tool, approved use case, business owner, data involved, vendor, model, access rights, validation method, human reviewer, retention rule, incident path, and kill-switch authority. Tool approval by IT cannot substitute for use-case approval by Legal, Compliance, Privacy, Security, and the accountable business leader. One platform may be acceptable for drafting training content and unacceptable for evaluating employees or third parties.

The NIST AI Risk Management Framework and ISO/IEC 42001 can help organize this work, but a framework is not the control. The control is the approval record, test result, exception log, monitoring evidence, and documented decision. Compliance should also assume that prompts, summaries, transcripts, and agent logs are discoverable business records. Retention and legal hold procedures must catch those artifacts before the first dispute or investigation forces the question.

AI in Compliance Operations: Redesign the Work

The Practitioner’s Briefing draws a useful line between AI enablement and AI theater. Strong programs redesign a workflow around AI. Weak programs bolt AI onto a slow process and call it transformation. Due diligence, regulatory tracking, training development, and self-service policy guidance are sensible starting points because the work can be scoped, tested, and measured.

Each deployment needs acceptance criteria. Validate performance against known outcomes, constrain source material where accuracy matters, monitor drift, require human review for high-risk decisions, and define escalation when the system is uncertain. Measure return on investment first in hours returned to higher-value work. Faster output that creates more review, remediation, or false confidence is not efficiency. It is control debt.

Speak-Up and Investigations: Trust Is the Control

The Practitioner’s Briefing reports that eight in ten US employees witnessed misconduct during the prior year, yet fewer than three-quarters reported it. That gap is not solved by adding another intake channel. It is solved by showing employees that reporting is safe, fair, and consequential.

One of the Practitioner’s Briefing’s most practical recommendations is to audit the career outcomes of the last 20 employees who raised concerns. Review performance ratings, promotions, transfers, compensation, leave, and departures. Patterns in those records may reveal retaliation or career stagnation that hotline statistics will never show. Pair that review with defined post-report monitoring and documented check-ins with reporters.

Speed is now part of program effectiveness. The briefing highlights a 120-day DOJ window to investigate qualifying internal reports and decide whether voluntary self-disclosure is appropriate. CCOs should calendar that period, establish rapid triage, identify decision rights, preserve evidence immediately, and maintain a standing disclosure team. The goal is not a rushed conclusion. The goal is to prevent delay, unclear ownership, or inadequate resources from deciding for the company.

Enforcement Has Shifted, Not Disappeared

Lower federal case counts are not a safe harbor. The Practitioner’s Briefing describes enforcement as redistributed across state Attorneys General, self-regulatory organizations, the False Claims Act, and future matters still inside applicable limitation periods. A quieter headline environment can encourage exactly the wrong management response: reduced staffing, deferred remediation, and lower investment in controls.

The business discipline is straightforward. Monitor the full enforcement ecosystem, not one federal docket. Maintain the strictest applicable standard as the practical global baseline. Preserve the ability to investigate, cooperate, remediate, and disclose. Most importantly, do not confuse a change in enforcement cadence with a change in underlying legal or ethical risk. Today’s control gap may simply be tomorrow’s case.

Third-Party Risk: Manage the Entire Lifecycle

Third-party risk management is no longer a narrow anti-bribery process. The Practitioner’s Briefing places sanctions, forced labor, transnational crime, material support exposure, supply-chain integrity, and embedded AI inside the modern TPRM remit. That expansion requires a move from onboarding diligence to lifecycle control.

Monitor material relationships from selection through offboarding, with risk-based refreshes, event-driven alerts, beneficial ownership checks, adverse media review, and clear remediation ownership. For AI-enabled vendors, procurement should require disclosure of material fourth- and fifth-party dependencies. Contract terms should address model provenance, data lineage, audit rights, incident notice, control changes, and the ability to explain consequential decisions.

List screening alone is increasingly thin protection. High-risk supply chains may require route mapping, chokepoint analysis, and source-verified information reviewed in context by humans. AI can compress the initial diligence cycle, but it does not replace judgment on coercion, shell companies, access payments, or other facts that demand legal and operational analysis.

Board Reporting and Culture: Lead With the Problem

Directors want a compliance report that begins with bad news, explains the risk, and shows the response. That is the board-reporting message in the Practitioner’s Briefing. Activity counts belong in the appendix. The main discussion should address control failures, investigation aging, retaliation indicators, overdue high-risk diligence, AI exceptions, remediation status, and emerging exposure compared with peers.

This approach also supports a Caremark-style oversight record. The board needs credible information systems, timely escalation of red flags, and evidence that management and directors responded. A between-meetings protocol with the audit or risk committee chair is therefore a control, not a courtesy.

Culture is equally operational. The briefing reports that direct managers and immediate colleagues exert the strongest influence on 80 percent of employees, while only 58 percent of organizations evaluate how results were achieved. Compliance should train managers to receive concerns, audit incentives as rigorously as financial controls, and make conduct part of performance and promotion decisions. The real code of conduct is what the organization rewards, tolerates, and corrects.

A 90-Day Agenda for CCOs

  1. Build the evidence map. Select the highest-risk obligations in AI, investigations, and third-party management. For each one, identify the owner, control, evidence, escalation path, and board metric.
  2. Test AI governance. Reconcile the official AI inventory with procurement records, browser access, expense data, and employee attestations. Review several approved use cases from request through monitoring.
  3. Stress-test investigations. Tabletop a significant internal report against the 120-day decision window. Confirm preservation, privilege, staffing, disclosure authority, and board communication.
  4. Rebuild TPRM around lifecycle risk. Segment critical third parties, define continuous-monitoring triggers, review AI dependencies, and assign remediation deadlines with accountable owners.
  5. Change the board report. Put the three most significant problems first. Add peer comparison, trend data, remediation aging, and decisions required from the board or management.

The Compliance Lesson

The Practitioner’s Briefing is not fundamentally a technology story or an enforcement story. It is a program-effectiveness story. The effective compliance function can identify risk, assign accountability, test controls, learn from failures, and show its work. Policies establish expectations. Evidence establishes credibility. In the next 90 days, that distinction should drive the agenda of every CCO, executive team, and board committee responsible for corporate integrity.