Tag: CCO

Categories
Blog

Frankenstein and Compliance: Part 2 – Bride of Frankenstein: When Leaders Know Better

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox takes a deep dive into the first five Frankenstein movies. Over October, he will cover Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. The blog post accompanies the podcast series.

The compliance problem in Frankenstein was innovation without governance. Henry Frankenstein became so focused on whether he could create life that he failed to consider adequately what would happen if he succeeded. He had extraordinary technical capabilities but almost no governance infrastructure around his experiment. There was no meaningful risk assessment, no effective challenge function, no contingency planning, and no clear accountability for the consequences. In Bride of Frankenstein (1935), the compliance problem is different and considerably more troubling. Henry now knows better.

Henry has survived the consequences of his original experiment. He has seen the Monster die and the destruction it caused. He understands that his scientific ambition created risks he could not control. At the beginning of the sequel, Henry appears ready to put his experiments behind him and build a life with Elizabeth. Then Dr. Pretorius arrives.

Pretorius is one of the great characters in the Universal horror canon, but anyone who has spent time in corporate compliance will recognize him. He is intelligent, sophisticated, persuasive, and completely convinced that conventional ethical boundaries should not interfere with extraordinary achievement. More importantly, he understands Henry. Pretorius knows which arguments will appeal to Henry’s ambition and which pressures will overcome his judgment.

This changes the compliance analysis. Henry cannot claim that the risk is unknown. He has already experienced the consequences. The question is whether he has learned from them. That distinction provides the central compliance lesson of Bride of Frankenstein. A significant difference exists between an organization that fails to identify a new risk and one that identifies it, experiences the consequences, and then allows the same underlying conduct to return.

Knowledge Changes the Governance Obligation

Corporate compliance programs generate information. Risk assessments identify vulnerabilities. Internal audits identify control weaknesses. Investigations identify misconduct. Hotline reports identify cultural problems. Due diligence identifies third-party risks. Compliance monitoring identifies patterns that may require further attention. The value of that information depends upon what the organization does with it.

An investigation that establishes what happened but produces no organizational change has limited compliance value. The same is true of an internal audit finding that is administratively closed without determining whether the underlying risk has been reduced. Knowledge must lead to action. This is where Henry fails. He possesses precisely the information that should prevent him from returning to the laboratory. He knows his previous experiment had catastrophic consequences. Nevertheless, Pretorius gradually pulls him back toward the same underlying conduct.

For a CCO, this raises an important question about repeat misconduct. When the same type of compliance problem appears more than once, the organization should ask whether the earlier incident was treated as an isolated event rather than a systemic warning. Questions you might ask include: Did the investigation identify root causes? Were controls changed? Were incentives examined? Was management behavior considered? Was remediation tested? Were lessons incorporated into the next risk assessment? Once an organization knows where a material risk exists, future failures become more difficult to characterize as unforeseeable.

The Pretorius Problem

Pretorius represents a particular type of organizational risk: an influential individual who consistently finds reasons why normal controls shouldn’t apply. Every experienced compliance professional has encountered some version of this problem. A business executive explains that a particular transaction is unique. A salesperson argues that a questionable practice is standard in the local market. A manager insists that due diligence must be completed after onboarding because the customer cannot wait or you will cause the company to miss the quarter’s numbers. None of those statements necessarily establishes misconduct. They should nevertheless cause a compliance professional to ask additional questions.

The danger often comes through rationalization rather than an explicit request to violate the law. The transaction is too important. The amount is too small. The customer relationship is too valuable. The competitor already does it. The process takes too long. The documentation can be completed later. Pretorius works on Henry in much the same way. He does not persuade Henry that the original experiment was harmless. He persuades him that there is a sufficiently compelling reason to cross the boundary again. That is a leadership problem because effective ethical leadership requires executives to recognize when commercial, personal, or organizational pressure is changing their risk tolerance.

When Exceptions Become the Business Process

One of the most important implications for a compliance program is managing exceptions. Most corporate policies need some mechanism for legitimate exceptions. Business circumstances are too complex to assume every rule applies equally in every situation. The problem arises when exceptions become routine.

Consider third-party due diligence. A distributor needs to begin work immediately because of a time-sensitive commercial opportunity. Management approves an exception that lets work begin before diligence is complete. The exception may be entirely defensible. Then another distributor receives the same treatment. Then another. Eventually, business personnel begin viewing due diligence as a process that can routinely be completed after onboarding. The written policy has not changed. The actual control environment has.

The same issue can arise with gifts and entertainment, conflicts of interest, expense approvals, sanctions screening, contracting requirements, AI approvals, cybersecurity requirements, or financial controls. Each exception may have a plausible business explanation. Taken together, the exceptions may demonstrate that the organization has developed an operating practice inconsistent with its stated policy.

Compliance should therefore monitor exceptions as data. How many are being granted? Which business units request them? Which executives approve them? Are the same reasons repeatedly used? Do temporary exceptions become permanent arrangements? A pattern of exceptions can early indicate the normalization of deviance.

Culture Becomes Visible When the Stakes Rise

Bride of Frankenstein also provides an important lesson about corporate culture. Culture is relatively easy to discuss when ethics and commercial objectives don’t conflict. The real test comes when the two appear to diverge.

Suppose Compliance identifies significant concerns about the company’s highest-revenue distributor. What happens next? Suppose an investigation substantiates allegations involving a senior executive responsible for a strategically important business. How does management respond? Suppose an AI application promises significant cost savings, but Legal, Privacy, Information Security, or Compliance recommends delaying deployment for additional testing. Does the company wait? Those decisions reveal more about corporate culture than a values statement.

Henry believes he has changed after the events of Frankenstein. Pretorius tests that belief. Once scientific ambition, pressure, and personal consequences enter the equation, Henry’s commitment to walking away begins to erode. Companies experience the same tension. A business may have strong written values and an extensive compliance program, but employees pay attention to what happens when adherence to those values becomes costly.

This is particularly important for boards. Boards cannot assess culture solely through training completion rates, hotline statistics, or employee surveys. Those metrics can help, but directors should also understand how management handles difficult decisions involving high performers, major customers, significant third parties, and substantial revenue. Culture becomes visible in decisions.

The Monster and the Importance of Organizational Experience

One of the most significant developments in Bride of Frankenstein is the Monster’s evolution. In the original film, he is largely reactive. In the sequel, he begins to learn about human relationships and the world around him. The sequence with the blind hermit is particularly important. The hermit does not judge the Monster by his appearance. He provides food, companionship, music, and kindness. The Monster responds to that environment. For a brief period, we see how different surroundings produce different behavior.

That provides a useful analogy for corporate culture. Employees learn what an organization values through experience. They observe how their supervisors behave. They see who receives promotions and bonuses. They notice whether high performers receive exceptions from policies. They see whether the organization respects or marginalizes people who raise concerns. They learn whether management wants bad news delivered promptly or prefers problems to stay below the surface.

Compliance should therefore pay particular attention to management behavior. Employee surveys, exit interviews, hotline data, investigation trends, turnover information, disciplinary records, and audit findings can help identify business units where the local management culture differs from the company’s stated expectations.

Incentives Can Become the Corporate Pretorius

Pretorius uses Henry’s ambition as leverage. Corporations use compensation and performance systems to influence employee behavior every day. That makes incentives a central compliance issue. A company may tell employees that integrity is its highest priority while evaluating them primarily on revenue, growth, margin, or quarterly performance. Employees will quickly determine which message matters more.

This does not mean financial incentives are inappropriate. Companies exist to generate economic value, and employees should be rewarded for performance. The compliance issue is whether the incentive structure unintentionally encourages excessive risk-taking or undermines controls.

Compliance should understand how significant employee populations are compensated. The Evaluation of Corporate Compliance Programs (ECCP) makes similar inquiries. Should questions include: Are sales targets realistic? Do employees get rewarded for the quality and sustainability of performance, or simply for the amount of revenue generated? Does compliance performance affect bonuses or promotion decisions? Are managers held accountable for control failures within their teams? Can compensation be reduced or recovered following significant misconduct? The goal is alignment. Employees should understand that how results are achieved matters as much as the results themselves.

High Performers Are the Real Test of Accountability

Perhaps the clearest test of ethical culture comes when a high-performing employee violates policy. If the organization disciplines junior employees while protecting commercially valuable executives, employees will understand that there are two compliance systems. One exists in the policy manual. The other exists in practice.

Consistency does not require identical discipline in every case. Facts, intent, seniority, cooperation, prior conduct, and other circumstances can legitimately affect disciplinary decisions. But commercial value should not create immunity. Boards should understand how management handles misconduct involving senior leaders and significant revenue producers. The issue is not whether directors should participate in routine disciplinary decisions. They should not. The governance question is whether accountability applies throughout the organization.

Pretorius operates as though ordinary ethical constraints are for other people. Companies should ensure they do not inadvertently create executives who reach the same conclusion.

The Compliance Lesson

Bride of Frankenstein is ultimately about organizational learning. Companies will make mistakes. Controls will fail. Employees will engage in misconduct. Compliance programs will occasionally fail to identify risks before those risks become problems.

Program effectiveness shows up in what happens next. An investigation should generate knowledge. That knowledge should inform root-cause analysis. Root-cause analysis should drive remediation. Remediation should change controls, incentives, training, supervision, or business processes where necessary. Those changes should then be tested to determine whether they work.

Henry Frankenstein fails because he doesn’t turn knowledge into durable change. He knows what happened the first time. He understands the consequences. Yet Pretorius finds the ambition, pressure, and rationalization needed to pull him back into the laboratory.

That is why Bride of Frankenstein provides such an important compliance lesson. The greatest organizational risk may not be the risk management failed to identify. It may be the risk management already knows about but has learned to tolerate.

The next stage of the Frankenstein story moves the problem forward again. Leadership changes. A new generation arrives. Wolf von Frankenstein did not create his father’s Monster and bears no responsibility for the decisions that originally brought him to life. Then Wolf discovers what he has inherited.

In Son of Frankenstein, the compliance question becomes one every acquiring company, new CEO, board member, and CCO should understand: You did not create the problem. Once you know it exists, what will you do about it?

Check out Timothy and Fiona’s commentary on the compliance lessons from the Bride of Frankenstein here.

Categories
Blog

Modern Philosophers and Compliance: Part 3 – John Rawls and Fairness in the Corporate Compliance Program

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program, and Simone de Beauvoir and the conditions for ethical action in a corporation. We will review Jürgen Habermas and the governance of speaking up and Hans Jonas and responsibility for the future of corporate compliance. Today we continue with John Rawls and the twin concepts of Institutional Justice and Institutional Fairness in a corporate compliance program.

A compliance program promises how the company will exercise power. Employees are asked to follow rules, disclose concerns, cooperate with investigations, and accept consequences when misconduct is established. In return, they should be able to expect a process whose protections and standards do not depend on their commercial value or proximity to leadership. John Rawls gives compliance professionals a practical way to examine that promise.

In the first two posts, we considered personal responsibility through Hannah Arendt and the conditions for ethical action through Simone de Beauvoir. Today, in Part 3, Rawls brings us to the design of the institution itself. Would employees accept its rules if they did not know which position they would occupy when those rules were applied?

Justice as Fairness and the Corporate Institution

Rawls was an American political philosopher whose A Theory of Justice, published in 1971, developed an account of justice as fairness. His theory addresses society’s basic structure, including the institutions that distribute rights, opportunities, and advantages. It prioritizes equal basic liberties and addresses fair opportunity and the conditions under which economic inequalities can be justified.

A corporation is a different kind of institution. Rawls’s principles cannot simply be converted into an employee handbook. The useful connection is an approach to justification: examine institutional arrangements from a standpoint that limits the influence of personal advantage.

Rawls developed this approach through the original position, a hypothetical situation in which people select principles behind a veil of ignorance. They lack knowledge of their own social position and particular advantages, while retaining general knowledge relevant to institutional design. The restriction prevents them from tailoring principles to their individual circumstances.

In compliance, we can adapt that thought experiment. Imagine designing a disciplinary process without knowing whether you will be a junior employee, a regional executive, a witness, or the person accused. What protections would you require? Which differences in treatment could you defend? The exercise asks policy owners to step outside the interests associated with their current roles.

Designing the Process Before Knowing the Employee

Consider this hypothetical. A multinational company discovers that a regional sales director submitted personal expenses as business entertainment. The investigation establishes that he knowingly mischaracterized the expenses and had received clear training. He has no prior disciplinary record. His business unit produces a significant share of company revenue.

Six months earlier, the company dismissed a junior account manager for knowingly submitting comparable personal expenses. Assume the amounts, evidence of intent, training, and disciplinary history are materially similar, and no relevant legal difference exists. The sales director’s sponsor now recommends a warning because losing him could disrupt customer relationships.

The CCO faces a concrete governance question. Is the proposed distinction consistent with a defensible standard, or has commercial importance become a private exemption? The hypothetical deliberately holds relevant factors constant so that management must address the remaining reason for different treatment.

Apply the veil of ignorance. Would employees endorse a policy under which the consequences for deliberate expense falsification depend on how difficult the offender is to replace? Would leaders accept that principle if they expected to occupy the junior role? Asking those questions before deciding the case makes the underlying rule visible.

The company must still manage business continuity. It can plan customer coverage and succession while determining an appropriate response. Those operational responsibilities should be distinguished from the criteria used to assess misconduct. Otherwise, the need to retain an individual can quietly become the standard for deciding accountability.

The DOJ Connection Through Consistent Discipline

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) explicitly examines whether discipline and incentives are applied fairly and consistently. In Rawlsian terms, these map to what we call Institutional Fairness and Institutional Justice. The ECCP asks whether comparable misconduct received different treatment, why differences occurred, and how consistency is assessed across organizational levels and locations.

That inquiry aligns with the practical question raised by our hypothetical: can the company explain the distinction using relevant facts and established criteria? Rawls supplies a philosophical lens for examining the justification. The ECCP supplies an enforcement framework for scrutinizing actual practice.

Consistency requires judgment. An inadvertent mistake and deliberate concealment can warrant different responses. Supervisory responsibility, repeated misconduct, cooperation, harm, and applicable legal requirements may also matter. The organization should identify the factors it considers and document how they affect the outcome.

Return to the sales director. The decision-makers should examine the earlier case and any genuinely relevant distinctions. They should also consider whether the earlier response was itself appropriate. Fairness does not require repeating an unjustified sanction merely to preserve a record of identical outcomes. If the standard needs correction, the company should explain the correction and, with counsel and human resources, consider its implications for prior cases.

Fair Investigations Protect the Credibility of Findings

Institutional Fairness depends on a credible investigation. An organization cannot justify a consequence through careful reasoning if favoritism, prejudgment, or a refusal to examine contradictory evidence shaped the underlying inquiry.

The ECCP examines whether investigations are independent, objective, appropriately scoped, and documented. Applying Rawls’s thought experiment adds a practical design question: what process would we accept without knowing whether we would make the allegation or have to answer it?

Both positions deserve consideration. A reporter should have a reliable route for raising concerns and protection against retaliation. An accused person should have an appropriate opportunity to respond to material allegations before final findings, subject to legitimate investigative and legal constraints. Witnesses should be treated respectfully, and credibility assessments should rest on evidence.

These are proposed governance safeguards, rather than a claim that Rawls or the ECCP establishes a uniform corporate procedure. Companies must adapt their protocols to the circumstances and applicable law. They should nonetheless be able to explain why any significant departure was necessary and who authorized it.

In our hypothetical, an investigator whose promotion depends on the sales director may face a conflict. An independent assignment can protect the inquiry. The executive sponsor should supply relevant information without controlling findings. Clear roles reduce the opportunity for commercial pressure to influence the factual record before a disciplinary decision is even considered.

Exceptions Need Reasons That Survive Scrutiny

Policies inevitably encounter circumstances their authors did not anticipate. A mature compliance program needs a disciplined method for handling exceptions. The question is whether the justification would apply to another similarly situated person.

Consider a policy requiring advance approval for certain travel. An emergency evacuation and a preferred executive’s scheduling convenience present different reasons for an exception. The decision record should identify the relevant circumstances, the authority approving the departure, and any compensating safeguards. A personal relationship with the approver is not a defensible criterion.

Rawls also used reflective equilibrium, a method of working toward coherence among considered judgments and principles through revision. Applied by analogy, it encourages the CCO to examine difficult cases alongside the stated policy. A recurring, well-founded exception may reveal a defective rule. A convenient exception may reveal unwillingness to enforce a sound one.

The response should follow the evidence. Revise an impractical requirement where warranted, communicate the change, and preserve the underlying control objective. Where the rule is appropriate, address unauthorized departures. Employees should be able to understand how the company reaches these conclusions without needing personal access to influential decision-makers.

Testing Fairness and Reporting It to the Board

Fairness should be examined through case review and data. The ECCP addresses disciplinary transparency and monitors consistency in investigations and discipline. This is Institutional Justice in practice. For the same misconduct, does an employee in Brazil face the same consequences as your top salesperson in the United States? A practical review can compare similar matters while preserving the factual differences needed to interpret outcomes.

Start with a defined category, such as deliberate expense falsification. Compare findings, disciplinary history, role responsibilities, sanctions, and the reasons recorded for departures from the usual approach. Also review investigation duration and decision ownership. An unexplained delay involving an influential leader can warrant scrutiny even before determining a sanction.

Differences in outcomes signal the need for inquiry. Small samples, different legal requirements, and materially different conduct can make aggregate comparisons misleading. A dashboard should help reviewers identify questions that require examination of the underlying cases. It should not assign a fairness score that disguises unresolved factual distinctions.

The board needs visibility into material exceptions and management’s response to unexplained disparities. Directors should ask whether a disciplinary recommendation involving a senior leader was changed, who changed it, and why. The answer should include the relevant evidence and the standard applied, with appropriate protection for confidential information.

Communication with employees also deserves deliberate attention. The company can explain its decision criteria and use carefully anonymized examples without exposing private case details. When confidentiality limits disclosure, explain the process that supports accountability. Leaving employees to infer the rules from departures and rumors weakens the company’s ability to demonstrate fairness.

Five Key Rawls Takeaways for the Compliance Professional

  1. Test policies without assuming your own position. Ask whether you would accept a process as a junior employee, reporter, witness, or accused executive. Use the answers to identify protections that should not depend on influence.
  2. Define the reasons that justify different outcomes. Document relevant distinctions such as intent, responsibility, prior conduct, and legal requirements. Examine claims of commercial indispensability with particular care.
  3. Protect the integrity of the investigation. Identify conflicts, assign appropriate independence, examine contradictory evidence, and provide a fair opportunity to respond. Record the reasons for significant procedural departures.
  4. Review exceptions as evidence about the program. Determine whether they expose a policy defect or selective enforcement. Correct flawed rules transparently and address departures that lack a defensible basis.
  5. Give the board a clear account of consistency. Present material disparities, executive exceptions, and corrective actions with sufficient context to assess them. Use case evidence to explain what aggregate measures cannot resolve.

Rawls gives the compliance professional a demanding question: could we justify this rule before knowing whom it would benefit? For boards, the corresponding test is whether the company applies standards it would defend to employees at every level. The program’s credibility depends on the answers demonstrated in actual decisions.

In Part 4, we will turn to Jürgen Habermas and the role of reasoned dialogue in corporate compliance. Having examined fair institutional rules with Rawls, we will consider how employees can question those rules, challenge decisions, and have their concerns meaningfully considered. That discussion takes us into speak-up culture and the governance of disagreement.

Categories
Innovation in Compliance

Innovation in Compliance: Pamela Gupta on Closing the AI Governance Implementation Gap

Innovation comes in many areas, and compliance professionals need to not only be ready for it but embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovators, thinkers, and creators on the award-winning Innovation in Compliance podcast. In this episode, host Tom welcomes Pamela Gupta, the author of De-Risking AI Adoption: The AI Trust Layer: An AI Governance Playbook.

Pamela Gupta is the founder of Trusted AI™ and an author. She and Tom discuss closing the AI governance implementation gap between high-level frameworks (e.g., NIST AI RMF, ISO 42001) and use-case execution under rapid AI rollout pressure. Gupta argues organizations struggle to translate principles into actionable, risk-based decisions across many stakeholders (security, privacy, legal, audit, business, IT, and data science), leading to either unmanaged risk or stalled innovation. She emphasizes AI-specific risks such as bias, transparency, explainability, and accountability, citing Humana’s nH Predict claims system (alleged bias; 90% reversals), Amazon’s scrapped hiring model, and Air Canada’s chatbot ruling. Gupta outlines her AI TIPS framework (eight pillars, ~80 controls) and contends AI governance can accelerate adoption by defining intake, evidence, and decision processes, even as agentic AI raises risk and uncertainty.

Key highlights:

  • AI Governance Gap
  • Assessing AI Risk
  • Bias and Ethics Ownership
  • Humana Case Study
  • AI TIPS Framework
  • Governance as Accelerator

Resources:

Pamela Gupta on LinkedIn

De-Risking AI Adoption: The AI Trust Layer: An AI Governance Playbook

Website: TrustedAI.AI

Podcast: Trustworthy AI: De-Risk Business Adoption of AI

Trusted AI Feed: TrustedAI.AI/feed/

X/Twitter: @OutsecureCom

LinkedIn: Trusted AI™

YouTube: @trustedai

 Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

My first work of general non-fiction is now out: Deluge Before Dawn, the story of the 2025 flood in Kerr County, Texas, which killed 119 people and devastated a county. It is a story of tragedy, heartbreak, survival, and resilience.

It is available on the following sites:

Amazon.com

Stoney Creek Publishing

Barnes and Noble

Texas A&M University Press

Bookshop.org

Google.Books

Walmart

Categories
Blog

Modern Philosophers and Compliance: Part 2 – Simone de Beauvoir and the Conditions for Ethical Action

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to modern compliance programs. We will look at John Rawls and institutional justice and fairness in a corporate compliance program; Jürgen Habermas and the governance of speaking up; and Hans Jonas and the responsibility for the future of corporate compliance. Today we continue with Simone de Beauvoir and the conditions for ethical action in a corporation.

A company that asks employees to act ethically must examine the conditions under which they make decisions. An employee may understand the code of conduct, recognize a problem, and know how to report it, yet reasonably fear that speaking up will jeopardize a livelihood. That fear is a governance issue. Simone de Beauvoir helps compliance professionals understand why.

In Part 1, Hannah Arendt brought personal responsibility into the corporate approval process. We examined whether individuals exercise judgment when organizational routines encourage deference. Beauvoir takes the discussion further by asking how circumstances affect the ability to act on that judgment. Responsibility matters, and so does the distribution of power around the person expected to exercise it.

For the chief compliance officer, this means examining the distance between what a policy permits and what employees believe they can safely do. A reporting mechanism becomes credible when the company understands that distance and takes concrete steps to reduce it.

Freedom Exists Within Real Circumstances

Beauvoir was a French philosopher whose work explored freedom, responsibility, and oppression. In The Ethics of Ambiguity, published in 1947, she examined human beings as both capable of choosing and constrained by circumstances they did not choose. We pursue our own projects while depending on a world shared with other people. Ethical responsibility includes concern for their freedom as well as our own.

Ambiguity, in this sense, does not make every choice equally acceptable. It describes a condition of human life: we act with limited knowledge and within circumstances we cannot fully control, yet our decisions affect others. We must take responsibility without assuming that a simple formula will resolve every conflict.

In The Second Sex, published in 1949, Beauvoir examined how women were defined in relation to men and constrained by social expectations, institutions, and material dependence. Her analysis of women as the Other challenged the treatment of one group’s experience as the norm against which everyone else was measured.

The compliance application interprets these ideas. Beauvoir did not prescribe hotline procedures or investigation protocols. Her work asks us to attend to people’s actual circumstances. Inside a corporation, that means considering who controls pay, work assignments, advancement, and access to decision-makers. Those relationships can shape whether an employee sees an ethical option as practically available.

The Employee Who Knows How to Report

Consider this hypothetical. A junior procurement analyst discovers that a supplier submitted invoices for services without supporting documentation. Her manager directs her to process them before the reporting period closes. He says the supplier is important and that asking further questions will make the department look uncooperative.

The analyst has completed compliance training. She knows the hotline number. She also knows that the manager controls desirable assignments and will soon recommend whether her temporary position becomes permanent. A colleague who challenged him previously lost important responsibilities. She does not know whether that change was retaliatory, but she understands its warning value.

From headquarters, the reporting system appears accessible. From her position, the choice carries immediate economic consequences. The uncertainty about those consequences affects her decision even before anyone makes an explicit threat.

Beauvoir helps us examine that difference. The analyst retains responsibility for her conduct, while management remains responsible for the conditions it creates. Telling her to demonstrate courage leaves the governance problem unresolved. The company must examine how managerial discretion, employment insecurity, and prior experience shape how controls are used.

For the CCO, this requires asking whose perspective informed the policy. A senior employee with financial security and direct access to legal matters may experience the same reporting procedure very differently from someone whose continued employment depends on the person named in the concern.

The DOJ Connection Through Trusted Reporting

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) examines whether reporting mechanisms are trusted and whether employees feel comfortable using them. It also asks whether organizational practices discourage reporting and whether the company assesses employees’ willingness to raise concerns.

These inquiries create a substantive connection to Beauvoir’s emphasis on circumstances. Publishing a telephone number establishes an available channel. To understand whether employees can use it, you need evidence of their experience. The ECCP’s attention to proactive retaliation prevention reinforces that distinction.

In our hypothetical, the CCO should examine whether the analyst can reach someone outside the manager’s reporting line, whether temporary employees understand the available protections, and how concerns involving powerful managers are routed. The company should also explain the limits of confidentiality. In a small team, the facts themselves may reveal who reported.

An effective response could include an independent contact, a documented protection plan proportionate to the circumstances, and follow-up with the analyst. Those are practical design choices flowing from the identified risk. The organization should explain what it can do and who will act, rather than offer assurances that nobody can reliably deliver.

Whose Experience Shapes the Compliance Program

Beauvoir’s analysis of the Other offers another lesson for policy design. Organizations can mistake the experience of their most influential employees for the experience of the workforce. A policy written around headquarters staff may overlook workers who lack private computer access, work overnight, or depend on a supervisor to interpret company communications.

The ECCP asks about language and other barriers to accessing policies, as well as how the company confirms that employees know where to find them. Compliance professionals can use those questions to investigate whether the program works across different employment conditions.

Review a reporting process with employees who actually use it. Can a warehouse worker obtain guidance without leaving a visible record on a shared terminal? Can an employee working through a staffing agency identify the correct reporting route? Does the policy clearly explain where a concern about a supervisor should go? Answers should inform the process design.

This work requires listening without assuming that a category determines someone’s experience. Employees facing similar constraints may make different choices. The objective is to identify specific barriers and address them. Participation in policy testing gives the company evidence that a headquarters review cannot supply.

Protection Must Extend Beyond the Initial Report

A report begins a period of heightened responsibility for the organization. Once the analyst raises her concern, management decisions about her assignments, evaluation, and employment status may require additional scrutiny. The practical risk extends beyond formal dismissal.

Retaliation can take forms that appear routine when viewed separately: exclusion from meetings, reduced access to training, undesirable shifts, or a sudden change in performance assessments. Such actions require fact-specific investigation. Their occurrence after a report does not automatically establish retaliation, but it can justify closer review.

The ECCP examines retaliation policies, training, complaint handling, and follow-up. It also asks whether investigations are independent, objective, appropriately conducted, and documented [3]. A company should translate those expectations into assigned responsibilities for protecting reporters and assessing concerns about adverse treatment.

In our hypothetical, compliance and human resources could arrange an independent review of material employment decisions concerning the analyst during an appropriate monitoring period. The review should consider existing performance evidence and legitimate business reasons. Protection should preserve fair management processes while reducing the risk that discretionary decisions become instruments of punishment.

The analyst should also have a named contact and a realistic explanation of what follow-up to expect. A company can communicate that it has addressed a concern without disclosing confidential personnel information. Silence after intake can leave a reporter uncertain about both the investigation and personal safety within the organization.

Power Must Be Part of the Investigation

Beauvoir’s perspective also changes the questions investigators ask. If the analyst processed unsupported invoices before reporting, the investigation should establish the instructions she received, how she understood them, the authority she had, and the options she believed were available. Pressure is relevant evidence. It does not predetermine the outcome.

Investigators should examine the manager’s conduct with the same care. Did he discourage inquiry? Had employees raised similar concerns? Did commercial targets reward removing inconvenient checks? Were previous complaints dismissed because his department delivered strong results?

The ECCP examines whether managers encouraged unethical conduct or tolerated greater compliance risk to pursue business objectives. It also addresses consistent discipline and accountability for supervisory failures. These expectations support an investigation that follows power and responsibility through the organization.

A Board should receive enough information to assess whether influential managers are obstructing the program. Relevant reporting might identify repeated concerns within a business unit, unresolved retaliation allegations, or exceptions involving senior personnel. Aggregate results should be interpreted carefully. Few reports can reflect confidence in local management, fear of reporting, or other conditions requiring inquiry.

A useful governance discussion therefore asks what the company knows about the employees least able to challenge authority. The answer should connect employee experience with management action, including who owns unresolved issues and when the board will receive an update.

Five Key Beauvoir Takeaways for the Compliance Professional

  1. Assess the conditions surrounding ethical choices. Examine who controls an employee’s income, assignments, evaluation, and future opportunities. Use that understanding to identify situations where dependence may discourage questions or reporting.
  2. Test policies with employees in different circumstances. Include workers with limited access to technology, language barriers, insecure employment, or little access to senior leaders. Ask them to demonstrate how they would obtain guidance or report a concern.
  3. Treat reporter protection as an assigned responsibility. Establish independent contacts, appropriate follow-up, and proportionate review of potentially adverse treatment. Explain confidentiality limits and avoid promises the organization cannot keep.
  4. Investigate power alongside individual conduct. Determine what instructions, pressures, and authority shaped decisions. Preserve fair accountability for employees while examining managers’ actions and supervisory responsibilities.
  5. Give the board evidence about barriers to ethical action. Report material retaliation risks, repeated concerns involving influential leaders, and progress on corrective action. Explain what remains uncertain and how the company will investigate it.

Beauvoir’s contribution to compliance is practical: ethical expectations must be considered alongside the conditions in which people are asked to fulfill them. The CCO should ask which employees face the greatest personal cost when they follow the code. The board should ask what management has done to reduce that cost.

In Part 3, we turn to John Rawls and the twin concepts of institutional justice and institutional fairness. After considering responsibility with Arendt and the conditions for ethical action with Beauvoir, Rawls shows a compliance professional how a company can design policies, investigations, and discipline that employees can regard as fair, regardless of their position or influence.

Categories
Blog

Modern Philosophers and Compliance: Part 1 – Hannah Arendt and Personal Responsibility in Corporate Compliance

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We will examine Simone de Beauvoir and the conditions for ethical action in a corporation; John Rawls and institutional justice and fairness in a corporate compliance program; Jürgen Habermas and the governance of speaking up; and Hans Jonas and responsibility for the future of corporate compliance. Today we begin with Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program.

Every approval in a compliance process represents a decision. Someone accepts an explanation, authorizes a payment, resolves a concern, or allows business to proceed. The central question is whether that person understands and takes responsibility for the decision. Hannah Arendt gives compliance professionals a powerful way to examine what happens when organizational routines weaken that connection.

Our examination of ancient and Enlightenment thinkers established the importance of inquiry, ethical habits, institutional order, and evidence. We now turn to twentieth-century philosophy, beginning with responsibility inside complex organizations. Arendt asks us to consider the individual who operates within the system. What happens when that person stops examining the meaning and consequences of the work?

For a Chief Compliance Officer, this question reaches directly into third-party approvals, internal investigations, management conduct, and board oversight. A company can assign responsibilities in a policy while its employees learn to defer judgment to someone else. An effective compliance program must address that gap.

Thinking and Judgment as Compliance Responsibilities

Arendt was a German-born Jewish political thinker who fled Nazi Germany and eventually settled in the United States. Her experiences of persecution and displacement informed her examination of totalitarianism, political life, and personal responsibility. In essays including “Personal Responsibility Under Dictatorship” and “Thinking and Moral Considerations,” she explored the relationship between independent thought, moral judgment, and conduct.

Her account of Adolf Eichmann and the phrase “banality of evil” remain controversial, if not one of the most well-known phrases to describe Nazi Germany. The phrase did not mean that the crimes were ordinary or insignificant. Her interpretation emphasized his failure to think critically about what he was doing, although scholars have challenged her assessment of his motivations. The historical crimes she examined must retain their specificity and gravity.

The compliance application is narrower: institutional roles do not eliminate the need for personal judgment. Arendt was not writing a corporate governance manual. Her work nevertheless provides a basis for asking whether employees examine what their actions enable, particularly when organizational language makes questionable conduct appear routine.

That question builds on Socrates. Socratic inquiry tests assumptions through questioning. Arendt directs our attention to the person who must decide whether to accept the answer and participate in the conduct. For compliance professionals, that is where inquiry becomes responsibility.

When Approvals Divide Responsibility

Consider this hypothetical. A multinational manufacturer proposes hiring an intermediary to help secure business with a state-owned customer. The commission is unusually high. The service description is vague, and the intermediary requests payment to an account outside its home jurisdiction.

Sales confirms the commercial opportunity. Procurement verifies that the vendor record is complete. Legal reviews contractual provisions. Finance checks that the required approvals appear in the payment system. Compliance previously reviewed the intermediary, but the proposed payment arrangement has changed since that review. Each function assumes another has addressed the remaining concern—the payment proceeds.

No single feature establishes bribery. Together, these facts warrant further inquiry. The governance failure is that nobody takes responsibility for obtaining a satisfactory explanation before payment. Each participant can describe a completed task. The organization cannot explain who assessed the unresolved risk.

This is where Arendt becomes useful to the CCO. Division of labor is necessary in a large company. It must be accompanied by clear obligations to recognize concerns, communicate them, and seek an appropriate decision. Otherwise, specialization can allow important facts to disappear between functions.

The practical response is to specify what each approval means. Does the approver confirm budget availability, verify services, resolve due diligence findings, or authorize an exception? What changes require renewed review? Who owns the decision when concerns remain? These questions turn personal responsibility into an operating requirement.

The DOJ Connection Through Gatekeepers and Escalation

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) addresses this issue directly. Under policies and procedures, the ECCP asks about guidance and training for gatekeepers with approval or certification responsibilities. It examines whether they recognize misconduct and understand when and how to escalate concerns.

This is a substantive connection to Arendt’s work, rather than a claim of philosophical influence on DOJ. The compliance question concerns whether an employee’s assigned role includes meaningful judgment. An approval control weakens when its operator understands the mechanics but cannot identify the circumstances that require further review.

Return to our hypothetical. The finance employee should understand whether the changed bank account requires renewed diligence. The business sponsor should explain the services and commercial rationale. Compliance should receive material changes to the information on which its earlier review depended. The final decision should record how identified concerns were resolved.

The CCO can test this through a sample of actual transactions. Interview the approvers. Ask what they believed their approval represented, what information they reviewed, and what would have caused them to stop. Compare those answers with the procedure. The gap between intended and understood responsibility is a control issue that requires attention.

Training Employees to Recognize the Decision

Arendt’s emphasis on thinking also offers a practical lesson for training. Employees need opportunities to examine a situation before organizational habit supplies the answer. A course can explain a prohibition accurately while leaving participants uncertain about how to respond when a manager presents a questionable request as urgent and routine.

The ECCP examines whether training is tailored to relevant employees and risks, whether employees can ask questions, and how the company evaluates learning and training’s effect on behavior or operations.[4] Those inquiries support training that develops judgment within defined responsibilities.

Use the hypothetical intermediary payment as an exercise. Give participants the initial facts, then introduce the changed bank account after approval. Ask them to identify what requires renewed attention, which function should act, and what must happen before payment. Require an explanation for the proposed response.

Include the manager who says the transaction has already been approved. That intervention tests whether employees understand the limits of an earlier decision. The training should leave them with a usable escalation route and a clear account of their authority. Asking people to exercise judgment carries a corresponding obligation to equip them to act.

Leadership Determines Whether Judgment Is Welcome

Employees learn what management expects by watching what happens when someone raises a concern. A company may encourage questions in training while a business leader treats delay as disloyalty. Over time, employees may conclude that completing the transaction is safer than examining it.

The ECCP assesses how senior and middle management demonstrate commitment to compliance. It also examines whether employees feel comfortable reporting concerns and whether the company maintains an effective approach to preventing retaliation.[5] These are relevant tests of the environment in which personal judgment operates.

For the CCO, the practical inquiry should include decisions under pressure. When did a manager support an employee who paused a transaction? What happened to an unresolved concern near quarter-end? Did a policy exception receive appropriate scrutiny when the business sponsor was influential? Such examples help explain whether the stated expectations survive commercial pressure.

Boards also have a role here. The ECCP examines compliance access to governing authorities and opportunities for private discussions. It also cites the Sentencing Guidelines’ expectations concerning governing authority knowledge and oversight.[5] Directors should use that access to ask where management pressure is weakening escalation and whether the compliance function can obtain timely decisions on unresolved concerns.

Investigations Must Examine the Approval Chain

When misconduct emerges, Arendt’s focus on personal responsibility should sharpen the investigation without prejudging anyone’s culpability. The inquiry must establish what individuals knew, what their roles required, what authority they possessed, and how they responded. Participation in a process alone does not establish intentional wrongdoing.

In our hypothetical, investigators should trace the changed payment instructions through the approval chain. Who received them? Did the system alert compliance? Did anyone ask for an explanation? Was a concern overridden, misunderstood, or never transmitted? Those facts distinguish deliberate avoidance from inadequate training, poor system design, or reasonable reliance on incomplete information.

The ECCP asks whether investigations identify system vulnerabilities and accountability failures, including those involving supervisory managers and senior executives. Its remediation questions address failed controls, missed opportunities, and accountability for supervisory failures.[6] An investigation that stops at the person who released the payment may leave the conditions that enabled the problem intact.

Fair accountability therefore requires attention to both conduct and context. Discipline should reflect facts and relevant responsibilities. Remediation should repair the information flows, authority gaps, and incentives that shaped the decision. The organization must be able to explain what it learned and how that learning changes future approvals.

Five Key Arendt Takeaways for the Compliance Professional

  1. Define the responsibility within each approval. Identify what the approver must assess, the evidence required, and the conditions that trigger escalation. Test whether employees understand these obligations in actual transactions.
  2. Train for judgment under realistic pressure. Use scenarios involving changed facts, urgent requests, and influential sponsors. Assess whether employees can explain a concern and identify the appropriate response.
  3. Make challenge operationally possible. Give employees clear escalation routes and appropriate authority to pause decisions. Examine how managers respond when employees use those mechanisms, including whether adverse consequences follow.
  4. Follow accountability through the management chain. Investigate who knew what, who exercised authority, and where supervision failed. Apply fair standards to senior leaders and high performers as well as frontline employees.
  5. Give the board evidence of independent judgment. Report material overrides, unresolved concerns, and lessons from investigations. Explain where employee challenge changed a decision and where management action is still required.

Arendt helps us see that personal responsibility must remain visible inside institutional processes. The CCO’s task includes designing controls that preserve that responsibility and creating conditions in which employees can exercise it. A useful board question follows: Where could our processes allow every participant to believe that someone else was responsible for examining the risk?

Join us tomorrow in Part 2, as we turn to Simone de Beauvoir and discuss the conditions that make ethical action possible. If Arendt asks individuals to exercise judgment, Beauvoir helps us examine how unequal power, dependence, and vulnerability affect their ability to act on it. That inquiry leads directly to reporting culture, retaliation prevention, and the lived experience of corporate compliance.

Categories
Blog

Frankenstein and Compliance: Part 1 – It’s Alive: Innovation Without Governance

Ed. Note: This month, on my podcast series Popcorn and Compliance, I am taking a deep dive into the first five Frankenstein movies. Over October, I will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolfman. The blog post is a companion to the podcast series.

The most famous moment in Frankenstein (1931) comes when Henry Frankenstein’s experiment succeeds. Electricity surges through his laboratory, the body on the table begins to move, and Frankenstein celebrates what he believes is an extraordinary scientific achievement.

“It’s alive!”

For the corporate compliance professional, however, the critical decisions occurred before Henry ever activated his equipment. He had decided to proceed without an adequate risk assessment, effective oversight, meaningful challenge, or a plan for managing the consequences if his experiment succeeded. Viewed through that lens, Frankenstein is not simply a horror movie about a scientist and the Monster he creates. It is a case study in innovation without governance.

That lesson is especially relevant as companies accelerate the adoption of AI and other emerging technologies. Businesses are appropriately focused on innovation, productivity, efficiency, growth, and competitive advantage. Yet technological capability can develop faster than the governance structures needed to manage the resulting risks. The compliance issue is not whether companies should innovate. They must. The issue is whether governance keeps pace with innovation.

The Business Case Was Clear. The Governance Case Was Not.

Henry Frankenstein has a compelling objective. He believes he can accomplish something no one has accomplished before. He assembles the equipment, obtains the materials, develops the technical capability, and builds a team capable of executing the project. In corporate terms, Henry has a strategy, resources, technical expertise, and executive sponsorship. He lacks an effective governance framework.

Before activating his creation, Henry conducts no meaningful risk assessment. He does not identify potential failure scenarios or establish control requirements. He does not define stopping criteria or determine who has authority to challenge the project. No meaningful contingency plan exists for an adverse outcome. This is precisely where compliance should enter the business process.

An effective compliance function should not first encounter a significant new technology when the business seeks approval immediately before deployment. Compliance needs to participate early enough to understand the business objective, identify the associated risks, and help determine appropriate controls.

That does not mean Compliance should own innovation or assume responsibility for the underlying business decision. Risk ownership should remain with the business. Compliance should help ensure that management understands the legal, regulatory, ethical, and control implications of the decision before significant commitments are made.

For the CCO, this raises a practical question: When does Compliance become involved in our company’s innovation process? If the answer is immediately before launch, the organization may already be too far downstream.

AI Has Made the Frankenstein Problem Immediate

Artificial intelligence makes the Frankenstein governance issue particularly relevant. Companies are deploying AI to analyze information, generate content, assist customer service, support investigations, screen candidates, evaluate transactions, enhance due diligence, identify suspicious activity, and improve decision-making. These applications can generate significant business value. They also raise governance questions that organizations must address before deployment.

Organizations need to understand what data an AI application uses, how it obtained that information, who approved the use case, and which regulatory requirements apply. They should determine how outputs are validated, where human review is required, how confidential information is protected, and what happens when a system produces an unexpected or inappropriate result.

There must also be clear accountability. Someone should own the business risk associated with the use case, and the organization should understand who has authority to suspend or terminate the application if circumstances warrant.

The NIST AI Risk Management Framework provides one useful approach through its Govern, Map, Measure, and Manage functions. ISO/IEC 42001 similarly treats AI through a management-system framework emphasizing governance, accountability, risk management, and continual improvement.

Both approaches reinforce a broader compliance principle: technology risk needs governance throughout the lifecycle. Henry Frankenstein has no lifecycle governance. His approach is essentially to build the system, activate it, and evaluate the consequences afterward. That is not an acceptable corporate control environment.

The Abnormal Brain and the Importance of Validating Inputs

One of the film’s most useful compliance scenes occurs before the Monster comes to life. Henry needs a brain for his creation. His assistant Fritz obtains one, but the intended specimen is destroyed. Rather than report what happened, Fritz substitutes another brain, identified in the film as abnormal, without telling Henry. (Abbey Normal—if you know, you know.) The project therefore proceeds after a critical input has changed without the project leader’s knowledge.

For compliance professionals, the scene provides a useful analogy for third-party risk, supply-chain controls, due diligence, and data governance. Organizations routinely rely on information others provide. A distributor provides beneficial ownership information. A vendor completes a compliance certification. An employee submits an expense report. An acquisition target makes representations during due diligence. A supplier certifies compliance with contractual obligations. An AI application relies upon data obtained from multiple sources.

The relevant control question is not simply whether the required information was received. It is whether the organization appropriately validated important information based on risk. Fritz completed his assignment in the narrowest sense. He returned with a brain. The process failed because nobody verified that he returned with the correct brain. That distinction is important for compliance program effectiveness. A completed checklist demonstrates that an activity occurred. Appropriate validation assures that the control achieved its purpose.

Dr. Waldman and Credible Challenge

Henry is not entirely without oversight. Dr. Waldman understands what Henry is attempting and recognizes the potential danger. He raises objections. Henry proceeds anyway. This takes the film from risk assessment into the effectiveness of the challenge function. Many companies can demonstrate that compliance participated in a significant decision. That does not necessarily establish that a compliance professional had meaningful influence over the outcome. A CCO can attend meetings, review proposals, identify concerns, and recommend additional controls. If commercial leadership can routinely disregard those concerns without escalation, the company may have consultation without credible challenge.

This is why the authority, stature, resources, independence, and access of the compliance function matter. The effectiveness of a corporate compliance program becomes most visible when it disagrees with an important business proposal. Boards should therefore look beyond whether your compliance function was consulted. They should understand what happens when a compliance officer disagrees with the business. They need to ask such questions as: Can the CCO escalate a significant concern? Does the CCO have appropriate access to the Audit Committee or board? Are material disagreements documented? Who has authority to accept significant compliance risk? Can commercial management override a compliance objection without further review?

If a CCO can raise a concern but nobody with decision-making authority has to address it, the organization has created the appearance of challenge without its substance. Dr. Waldman had a voice. He lacked the influence to change the decision.

Maria and the Risk of Unintended Consequences

Next we consider one of the most poignant scenes in the movie. The encounter between the Monster and young Maria provides another important business lesson. This is certainly one of the most unforgettable, and indeed tragic, scenes in all the Frankenstein movies. If you have ever seen it, you will never forget it. A small child, Maria, shows the Monster how flowers float on the lake. He imitates what he observes. When the flowers are gone, he throws Maria into the water, apparently expecting her to float as the flowers did. The consequences are tragic. The Monster recognizes a pattern without understanding its context.

That distinction has obvious relevance for artificial intelligence and automated decision-making. A system may identify patterns, generate recommendations, and produce technically consistent outputs without understanding their broader legal, ethical, or business implications. A technically accurate output can still create an inappropriate result.

This is why human oversight cannot exist merely as language in an AI policy. Companies need to determine where human judgment is required, who provides that judgment, what qualifications reviewers need, when automated recommendations can be overridden, and how significant exceptions are documented.

Management should also understand whether human review is substantive or simply procedural. An employee clicking an approval button after an automated recommendation does not necessarily constitute meaningful oversight. The relevant control question is not simply whether the technology performed as designed. It is whether the resulting decision was appropriate.

Innovation Requires Accountability

Henry eventually discovers that creating something and controlling it require different capabilities. Corporate leaders should understand the same distinction. Management establishes incentive structures, sales strategies, compensation plans, technology deployments, acquisition strategies, third-party relationships, and performance expectations. Those decisions shape employee behavior and create risk. Leadership accountability therefore does not begin only after misconduct occurs. It begins with the decisions that establish the operating environment.

For the CCO, this means integrating compliance risk into strategic business decisions. For management, it means risk ownership remains with the business. For the board, oversight should focus on whether management has reasonable systems to identify, manage, monitor, and escalate significant risks. Compliance does not own a business risk simply because the compliance function identifies it. Management remains responsible for the business decision and the risks it creates.

That principle becomes particularly important with emerging technology. The CCO should contribute expertise regarding regulatory requirements, ethical considerations, controls, monitoring, and escalation. Technology leaders should contribute technical expertise. Legal, Privacy, Information Security, HR, Internal Audit, and other functions may have roles depending on the application. Business leadership remains accountable for the decision to deploy the technology and the resulting business risk.

Practical Actions for the CCO

Frankenstein suggests a practical agenda for compliance leadership. Compliance should move upstream and identify significant business processes where its participation adds the most value before making commitments. Emerging technology, acquisitions, market entry, compensation design, significant third parties, and new products are obvious candidates.

Risk assessment should occur before deployment and should address foreseeable legal, compliance, ethical, operational, and reputational consequences. High-risk inputs supplied by employees, vendors, third parties, acquisition targets, or technology systems should receive risk-based validation.

The organization should also define what credible challenge means in practice. Escalation procedures should be clear when Compliance and business leadership disagree about significant risk.

Finally, treat approval as the beginning of governance rather than its conclusion. Test controls, monitor outcomes, analyze exceptions, and update risk assessments as the business and technology evolve. The objective is not to slow innovation. It is to make innovation governable.

The Compliance Lesson

Frankenstein is not an argument against innovation. It is an argument for governance.

Henry Frankenstein failed not because he attempted something extraordinary. He failed because his technical ambition outpaced his ability to identify, understand, govern, and control the resulting risk.

Companies face the same challenge today. Technology will advance. Business models will change. New markets will open. Competitive pressure will accelerate decision-making. New risks will emerge. Compliance’s role is not to stand outside the laboratory and demand that the electricity be turned off.

It is to help ensure that management has assessed the risk, validated critical inputs, established appropriate controls, defined accountability, created meaningful challenge, and determined how the organization will respond if the initiative produces an unexpected result. The best time to build that governance structure is before deployment.

Our next installment moves the compliance analysis forward. In Bride of Frankenstein, Henry no longer faces an unknown risk. He has already experienced the consequences of his original experiment and understands what can go wrong. Then Dr. Pretorius persuades him to return to the laboratory.

The compliance issue is no longer whether leadership identified the risk. It is what happens when leadership knows better, but pressure, ambition, and rationalization push the organization toward the same risk again.

Check out Timothy and Fiona’s commentary on Frankenstein here.

Categories
Blog

When the CEO Has to Go: What Forced Departures Tell Boards and CCOs About Governance

CEO succession is usually discussed as a planning exercise. Boards identify potential successors, develop internal talent, periodically review the succession plan, and prepare for the orderly transition that eventually comes with retirement or another planned departure.

But succession does not always wait for the planning calendar. In an article in the Harvard Law School forum on Corporate Governance, titled Forced CEO Departures, the authors reported on a new study by The Conference Board, developed with ESGAUGE and other collaborators, that examined forced CEO departures among Russell 3000 and S&P 500 companies from 2024 through August 2026. Roughly one in seven CEO succession cases were classified as forced in both 2024 and 2025. In the Russell 3000, 49 forced departures occurred in 2024 and 55 in 2025. The S&P 500 recorded seven and 10, respectively. The forced departure numbers are interesting. The governance implications are more important.

This research on forced CEO departures reminds boards to prepare for unscheduled CEO transitions. For Chief Compliance Officers, the findings raise an equally important question: what information should the compliance function be providing to the board before a leadership problem becomes a leadership crisis?

Forced CEO departures demonstrate that succession planning, executive accountability, corporate performance, investor confidence, culture, and risk oversight cannot be separated into different governance boxes. They ultimately meet in the boardroom. For a Chief Compliance Officer (CCO), they also demonstrate why compliance must function as an organizational sensor capable of identifying patterns that individual incidents may not reveal.

Forced Succession Is a Governance Risk

The report defines a forced departure broadly enough to capture the realities of corporate governance. A departure is forced when evidence indicates that the board, activist investors, an investigation, performance concerns, misconduct, or strategic disagreement materially influenced the timing or terms of the CEO’s exit. Importantly, a departure publicly described as a resignation or retirement may still have been board-driven. That distinction matters.

Boards should not think about CEO succession solely as identifying the person who eventually replaces a successful CEO. Succession planning must also contemplate what happens when the board concludes that the current CEO can no longer lead the organization effectively.

The report’s 2024 and 2025 data make that point. Forced departures represented 14.7 percent and 14.8 percent of Russell 3000 succession cases, respectively. Among the S&P 500, the corresponding figures were 14.3 percent and 15.2 percent. Those figures should change the boardroom conversation.

The question is not simply, “Who succeeds the CEO someday?” It is also, “What happens if we need a new CEO next Monday?”

Performance Is Becoming a Governance Question

Perhaps the most significant finding concerns why CEOs were forced out. Underperformance accounted for 37 percent of Russell 3000 forced departures across the period studied. It increased from 31 percent in 2024 to 44 percent in 2025 and remained the largest category through August 2026. Underperformance, activist pressure, and termination without cause collectively accounted for 70 percent of forced departures during the full period.

For directors, that creates a difficult governance question. When does poor performance become a leadership problem? A single disappointing quarter should not automatically become a referendum on the CEO. External economic conditions, industry disruption, commodity prices, interest rates, geopolitical events, and other factors can affect performance.

Yet boards cannot allow those explanations to become permanent excuses. The report recommends establishing in advance the conditions that trigger a deeper assessment of CEO effectiveness. That assessment should extend beyond financial results to strategic milestones, competitive position, organizational capability, and how the CEO responds to setbacks. That is an important governance discipline. Agreeing on the indicators before the crisis reduces the danger of redefining success after performance deteriorates.

The CCO Has a Different Window Into CEO Effectiveness

Here the compliance function enters the discussion. The report is primarily about CEO succession and board governance. It does not assign the CCO responsibility for evaluating CEO performance. Nor should it. But compliance often sees organizational information through a different lens than Finance, Strategy, HR, or Investor Relations.

A CCO may see whether employees are becoming reluctant to speak up. Compliance may identify retaliation concerns involving senior management. Investigations may reveal recurring management override. Hotline data may show patterns concentrated around particular executives or business units. Third-party reviews may expose pressure to circumvent controls. Internal investigations may demonstrate that employees believe commercial performance is valued more highly than ethical conduct.

One event may mean little. Patterns can mean much more. This is why an effective CCO should not simply report hotline statistics to the board. The CCO should help directors understand what the information may be saying about organizational culture, controls, accountability, and risk.

The question becomes: What does the board need to know to discharge its oversight responsibilities?

That is a very different question from: What compliance information did management ask us to provide?

CEO Accountability and the Control Environment

CCOs should also pay attention to forced CEO departures. The CEO sits at the top of the organization’s control environment. The CEO’s conduct affects incentives, resources, accountability, escalation, management behavior, and whether employees believe controls are genuine requirements or obstacles to business performance.

That means directors assessing leadership should consider more than revenue growth and shareholder returns. They should understand whether management responds appropriately when controls identify problems. Some key questions a CCO might ask include:

Does the CEO support investigations even when they involve high-performing executives? Does management remediate identified weaknesses? Are compliance personnel adequately resourced and empowered? Are executives held accountable consistently? Does information reach the board without being filtered into insignificance?

These questions connect CEO oversight to compliance program effectiveness. They also reinforce why direct access between the CCO and the board or an appropriate board committee matters. The value of that relationship becomes clearest when the information the board needs is information senior management would prefer not to discuss.

Activists May Ask the Questions Boards Should Already Be Asking

The report contains another significant finding.

Among S&P 500 forced departures, activist pressure accounted for five of 10 departures in 2025. Across 2024 through August 2026, activists were associated with eight of 19 forced departures, or 42 percent. The report notes that activist campaigns frequently focus on matters already within the board’s remit, including performance, strategy, capital allocation, portfolio structure, governance, and confidence in management. Forced CEO Departures

There is a governance lesson here. A board should not need an activist investor to tell it which difficult questions to ask. Directors should periodically examine the company through an independent investor lens. Where is performance lagging? Which strategic assumptions have not proved correct? Where has capital allocation failed to produce expected results? What would a sophisticated outsider identify as the company’s vulnerabilities?

For the CCO, there is a parallel exercise. What would a regulator, whistleblower, investigative journalist, plaintiff’s lawyer, or enforcement authority see if they examined the same facts? These perspectives are not substitutes for the board’s business judgment. They are tools for challenging assumptions. Effective oversight requires directors to seek disconfirming information, not just information that supports management’s existing narrative.

Succession Planning Needs a Break-Glass Option

The report recommends that boards maintain an accelerated succession plan alongside traditional succession planning. That distinction is critical. A normal succession plan asks who might become CEO in several years. An accelerated plan asks who takes control tomorrow morning.

The board should know who can provide immediate continuity, which internal executives could become permanent successors, when an external search would be required, and how to retain key executives during the transition. The plan should also address interim authority, compensation, severance arrangements, and employee and investor communications. Compliance should be part of that contingency architecture.

Questions might include: If the departure involves misconduct or an investigation, who controls the investigation after the CEO leaves? Who has authority over document preservation? Who makes disclosure decisions? Who communicates with regulators? What happens if other senior executives are implicated? Does the CCO continue reporting through the same management structure, or should reporting temporarily move directly to the board?

The report itself does not address these questions, but they follow directly from the compliance risks created by an unexpected leadership transition. The worst time to design these protocols is during the crisis.

The Board and CCO Need an Early-Warning System

The larger lesson from the forced-departure data is not that boards should terminate CEOs more quickly. It is that boards should become better prepared to recognize and respond to deteriorating conditions.

The report found no consistent company-size profile for forced turnover. Elevated rates appeared across the revenue spectrum. The more meaningful indicators were company-specific factors, including persistent underperformance, strategic misalignment, and investor scrutiny. Forced CEO Departures

That suggests boards need an integrated early-warning system.

  • Financial performance is one signal.
  • Strategic execution is another.
  • Investor sentiment is another.
  • Compliance and culture data should be another.

The CCO can contribute by identifying trends in allegations, investigations, retaliation, control overrides, disciplinary decisions, third-party exceptions, and other indicators that may reveal stress inside the organization. The board then has the responsibility to connect the dots.

Questions for the Board and CCO

Boards should periodically ask whether they have defined the conditions that would trigger a reassessment of CEO effectiveness; whether they have a genuine emergency succession plan rather than simply a long-term succession plan; whether directors receive information about culture, investigations, controls, and retaliation without inappropriate management filtering; and whether they understand recurring concerns raised by shareholders, employees, auditors, compliance, and other stakeholders.

CCOs should ask different questions. Are we giving the board data or insight? Are recurring issues being presented as isolated events? Are senior executives subject to the same accountability standards as everyone else? Does the CCO have a practical route to the board when senior management itself presents the risk? If the CEO suddenly departed tomorrow because of an investigation, could Compliance continue operating without interruption?

Those can be uncomfortable questions. Yet, they are also precisely the questions effective governance requires. Forced CEO departures are not simply stories about executives losing their jobs. They stress-test the governance system around those executives.

The board’s responsibility is to ensure it can recognize when leadership circumstances have materially changed and act deliberately, not reactively. The CCO’s responsibility is different but complementary: ensure that compliance, culture, control, and investigation information that can inform that judgment reaches the board clearly and promptly.

A board should never discover during a CEO crisis that the warning signs were there all along. A better governance model identifies those signals early, understands what they mean, maintains credible succession alternatives, and establishes decision processes before they are needed. That is not planning for failure. It is planning for effective oversight.

Categories
Innovation in Compliance

Innovation in Compliance: Doni Hoti on Embedding Advertising Compliance Into Content Creation

Innovation comes in many areas, and compliance professionals need to not only be ready for it but also embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom welcomes Doni Hoti, co-founder and CEO of Adclear.

Hoti brings a fascinating perspective on embedding compliance directly into content creation. He begins with the shift in advertising and marketing compliance from a slow, “checkpoint” back-office function to an embedded, revenue-enabling capability. Hoti explains that modern content creation involves many stakeholders and must move at near-real-time speed, while enforcement risk and the cost of losing customer trust keep rising. He describes how AI has broken traditional review models by increasing both content volume and speed expectations and how Adclear uses horizon scanning across global regulators, agentic AI, and company-specific policies to deliver more deterministic, auditable compliance guidance tied to rulebooks. Fox and Hoti then turn to third-party and affiliate challenges, regulator-ready documentation and audit trails, and business outcomes such as reduced review SLAs, scalable approvals, and revenue uplift, with marketing increasingly owning the process alongside legal and compliance.

Key highlights:

  • Compliance Disconnect
  • Trust and Shopfront
  • Embed Compliance
  • Third-Party Risks
  • AI as Solution
  • Audit Trail Proof

Resources:

Adclear

Doni Hoti on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

My first work of general non-fiction is now out: Deluge Before Dawn, the story of the 2025 flood in Kerr County, Texas, which killed 119 people and devastated a county. It is a story of tragedy, heartbreak, survival, and resilience.

It is available on the following sites:

Amazon.com

Stoney Creek Publishing

Barnes and Noble

Texas A&M University Press

Bookshop.org

Google.Books

Walmart

This week only, the Kindle e-book version is available for $0.99 on Amazon.

Categories
Blog

De-Risking AI Adoption Through Accountability and Effective Governance

A company can publish thoughtful AI principles, appoint a governance committee, and still struggle to answer a basic question: who can stop an AI system when its behavior creates unacceptable business risk? For chief compliance officers and boards, that question reaches the heart of program effectiveness. Policies establish expectations. The real test comes when someone must decide, enforce a boundary, and show what happened.

Pamela Gupta addresses that challenge in De-Risking AI Adoption: The AI Trust Layer: An AI Governance Playbook. Her central argument is that trustworthy AI requires an operating model connecting ownership, controls, deployment decisions, monitoring, and evidence. The book provides a structure for translating responsible AI commitments into repeatable business practices. For compliance professionals, its value lies in explaining how governance can support adoption while keeping accountability attached to the people making consequential decisions.

Making Trust Operational

Gupta defines trustworthy AI through three practical capabilities: people can understand the behavior to expect and its limits, verify what actually occurred, and identify an accountable person when something goes wrong. This moves the discussion toward demonstrable performance.

That approach should resonate with any CCO who has examined the distance between a written procedure and actual business conduct. An AI policy may require human oversight. Whether that oversight works depends on the reviewer’s information, competence, time, and authority to intervene. A human approval step has limited value if the organization rewards automatic acceptance or discourages challenges.

The compliance application is straightforward. For each significant AI use case, identify the business purpose, potential harm, responsible owner, operating limits, and evidence needed to evaluate performance. These questions belong at the beginning of development and procurement, when the answers can still shape the system.

Eight Pillars of AI Governance

The book organizes its methodology around AI TIPS™, Gupta’s framework of eight interconnected pillars: cybersecurity, privacy, ethics and bias, transparency, explainability, regulations, audit, and accountability. Together, they address the different ways AI can create enterprise exposure.

The connections matter. Security controls may protect information against unauthorized access while leaving questions about discriminatory outcomes unresolved. Transparency can establish which data and processes a system uses, while explainability addresses whether people can understand and challenge a particular decision. Independent assurance requires evidence from across these activities.

Gupta also presents mappings to established frameworks and standards, including the NIST AI Risk Management Framework and ISO/IEC 42001. Her purpose is to connect enterprise controls and evidence across multiple governance expectations.

For a compliance team, the practical lesson is to coordinate existing expertise. Privacy, security, legal, risk, audit, and business leaders each hold part of the answer. The CCO can help connect their work through common requirements, escalation procedures, and documented decisions. Business owners must remain answerable for the systems they deploy.

Accountability Must Carry Authority

Accountability receives special treatment throughout the book. Under Gupta’s methodology, a critical accountability failure blocks deployment regardless of the aggregate governance score. A system needs a named owner with authority to accept risk and stop its operation. Consequential uses also require appropriate human override and redress mechanisms.

This is a useful challenge to governance committees that distribute responsibility so broadly that no individual can decide. Participation in a committee does not automatically establish authority over a business process.

CCOs should translate this principle into explicit decision rights. Who approves the use case? Who accepts the remaining risk? Who authorizes exceptions? Who can suspend operation? Who addresses harm to an affected customer or employee? Document and understand those answers before an incident forces the organization to discover whether its governance arrangements work.

Governance Throughout the Lifecycle

Gupta’s gated lifecycle makes these responsibilities actionable. It follows AI from concept and planning through data preparation, development, independent validation, deployment, continuing monitoring, and retirement. Decision gates establish criteria for moving forward and identify the people authorized to approve or refuse progression.

Independent validation is particularly important. The team building a system should face review capable of challenging its assumptions and testing whether performance meets the intended use. Deployment readiness also includes monitoring, incident response, rollback capability, and operational procedures.

For compliance professionals, the lesson extends beyond initial approval. A system’s exposure can change when it receives new data, serves a different population, gains additional permissions, or undergoes a material modification. Gupta calls for defined triggers that return systems to validation.

Apply the same discipline to exceptions. Record the rationale, compensating controls, approver, remediation owner, and expiration date. An exception should remain visible until it is resolved. Retirement deserves similar attention, including appropriate data disposition and preservation of evidence needed to explain earlier decisions.

Measuring Whether Controls Work

The Trust Index gives Gupta’s framework a common measurement approach. It combines control implementation, control effectiveness, residual risk exposure, and compliance status into pillar scores and an overall assessment. The methodology assigns the greatest combined emphasis to whether controls exist and whether they work.

For boards, this creates a way to discuss changes in governance performance and direct attention toward unresolved weaknesses. Gupta also distinguishes inherent risk from current risk after controls. An inherently consequential use case does not become inconsequential because its controls improve.

The compliance implication is to examine the evidence supporting the number. Directors should understand significant weaknesses, testing results, exceptions, and corrective actions. A dashboard becomes useful when it supports decisions about resources, restrictions, and remediation. The underlying assessment must remain open to challenge, especially where a favorable aggregate score could obscure a serious problem in one area.

Governing AI That Takes Action

The book’s treatment of agentic AI deserves senior executives’ attention. An AI system that can invoke tools, modify records, send communications, or initiate transactions introduces questions about delegated business authority. Evaluating the model’s outputs covers only part of that exposure.

Gupta describes an agentic control plane that governs identity, permissions, tools, memory, delegation, observation, and intervention. A central principle is that consequential boundaries must operate outside the agent’s own reasoning. Written instructions alone cannot reliably limit what credentials and connected tools permit.

Consider a compliance application: an agent assisting with third-party onboarding. Management should distinguish permission to summarize diligence materials from permission to approve a supplier, alter payment information, or release a blocked transaction. Each capability requires deliberate authorization and appropriate controls.

Internal controls professionals know this lesson. Delegated authority needs defined limits, traceable actions, and effective intervention. Automation increases the importance of those disciplines because actions can occur faster than a person can review them.

Data and Third Parties Remain Central

Gupta also emphasizes the information an AI system uses when it acts. Policies, customer records, retrieved documents, and stored memory shape its behavior. Even a system operating within its permissions can make a harmful decision when its information is outdated or inappropriate.

For compliance teams, this means governing the sources behind AI advice. An assistant answering employee questions should use approved, current policies with identifiable owners and version histories. Access restrictions should continue to apply when information enters a retrieval system.

Third-party oversight must also reach beyond the primary model provider. Gupta examines tools, connectors, and packaged agent capabilities as supply-chain dependencies. She adds a business continuity question: what happens if a critical model becomes unavailable? Organizations should identify affected processes, evaluate alternatives, and test fallback arrangements before disruption forces an improvised response.

Evidence the Board Can Use

Gupta’s evidence-by-design approach connects the entire operating model. Significant decisions and actions should generate records as work occurs: approvals, validation results, system versions, permissions, relevant context, interventions, and monitoring outcomes. Those records should support reconstruction of a consequential action.

For boards, reporting should connect this evidence to oversight. Which systems carry the greatest exposure? Which controls have failed testing? Which exceptions remain unresolved? What has management restricted, delayed, or rejected? What decisions require board attention?

The CCO’s contribution is to make this reporting actionable and consistent with operational reality. Evidence should reveal where management needs to intervene and whether previous corrective actions achieved their intended result.

A useful starting exercise is to select one consequential AI decision and trace it from initial authorization to its outcome. Ask the owner to produce the supporting evidence. Any missing link identifies a concrete improvement for the governance program to address.

Practical Steps for CCOs and Boards

Gupta recommends starting with an honest readiness assessment and a manageable set of high-impact use cases, then expanding proven governance practices. Apply that approach through five actions:

  1. Inventory consequential AI systems, their owners, permissions, and dependencies.
  2. Establish authority for approval, exceptions, escalation, and suspension.
  3. Test controls against actual business risks and affected populations.
  4. Capture decision evidence during ordinary operations.
  5. Give the board visibility into unresolved exposure and remediation.

The business lesson from De-Risking AI Adoption is that effective governance makes responsible adoption repeatable. For CCOs and boards, the immediate task is to make accountability observable in how AI is approved, operated, challenged, and improved.

Categories
Blog

Andrew McBride Does it Again: His New Guide on Buying Compliance Technology

Compliance technology has become the operational backbone of the modern ethics and compliance program. When technology works, it can make compliance faster, more consistent, measurable, and embedded in business operations. When it doesn’t, the consequences show up everywhere: spreadsheets, manual workarounds, disconnected data, frustrated employees, and compliance professionals spending time administering technology rather than managing risk.

That makes buying compliance technology more than an IT procurement exercise. It is a compliance program effectiveness issue. One commentator on this aspect of AI for compliance is Andrew McBride, founder of the consulting firm Integrity Bridge LLC. McBride recently released Recommended Practice for Buying & Selling Compliance Technology, based on surveys of compliance technology buyers and vendors. Its findings illuminate a fundamental imbalance in the marketplace. I can safely say this paper is the standard for compliance professionals evaluating and purchasing AI-based technology.

CCOs buy compliance technology infrequently. Vendors sell it every day. That imbalance matters. Compliance teams can be oversold on functionality. Vendors can become trapped in opaque procurement exercises. Business requirements can become disconnected from technical requirements. AI capabilities can be accepted without sufficient governance. Contracts can focus extensively on getting into a system while ignoring how the company will eventually get out. For the CCO, the lesson is straightforward. If you want to run compliance like a business, you must learn to buy compliance technology like a business. This is where McBride comes in.

Start With Strategy, Not Software

As a CCO, start with a documented compliance technology strategy aligned with business operations. McBride sees three operational layers for that strategy.

Compliance-owned technology includes platforms compliance directly manages, such as Codes of Conduct, training, whistleblower systems, investigation case management, and workflows for gifts, entertainment, and conflicts.

Compliance-shared technology includes systems operated across functions, such as third-party due diligence, transaction monitoring, and communications monitoring.

Enterprise dependency technology includes compliance systems that may not be owned but depend on ERP, CRM, HRIS, procurement, and financial platforms.

This third category is particularly important. A CCO may believe the company has a third-party risk problem when the real issue is poor vendor master data. Transaction monitoring may generate noise because underlying financial data is inconsistent. Technology strategy therefore begins with understanding the compliance program’s architecture.

Know What Compliance Really Costs

Here, McBride frames the question as, ‘What is the total cost of ownership? ‘How many screening tools are independently licensed by Compliance, Procurement, Finance, Credit, and Legal? How many employees maintain spreadsheets? How many hours are spent chasing approvals or reconciling systems? How much compliance talent is consumed by administration rather than risk management? Those costs matter because an inexpensive system can become extraordinarily expensive once you include the human infrastructure required to run it.

This leads to the recurring question: buy, build, or assemble? Internal IT may propose building custom tools. Sometimes that works, but the calculation must include maintenance, upgrades, staffing, cybersecurity, documentation, and key-person risk. Another option is configuring technology the company already owns. That may reduce licensing costs, but “we already own it” does not mean “it is free.” Configuration, integration, testing, administration, and support still cost money.

Commercial software offers established products and vendor-supported roadmaps, but buying software does not eliminate implementation challenges. Apply the same economic discipline to all three options. Don’t compare the sticker price of commercial software with an internal solution whose real costs have never been calculated.

AI Changes the Conversation

AI is moving into transaction analysis, investigation scoping, interview preparation, monitoring, and other compliance workflows. The opportunity is substantial. So is the governance challenge. The Integrity Bridge research presents an interesting picture. AI use appears widespread, but governance and confidence have not necessarily kept pace. Only about one in four compliance teams surveyed had established a formal governance framework. Fewer than half could articulate how AI demonstrably improved compliance outcomes. Only 41 percent of compliance leaders trusted AI-driven outputs for operational decisions.

At the same time, 84 percent reported efficiency gains, while fewer than half reported actual cost savings. That distinction between efficiency and effectiveness is critical. Doing something faster does not necessarily mean doing it better. The CCO should not simply ask, “Does this product use AI?” The better question is, “What compliance outcome does the AI improve, and how can we demonstrate it?”

AI Governance Starts Under the Hood

“AI-powered” is not a meaningful technical specification. McBride advises that compliance should understand what happens under the hood. Once again, he is spot on. Ask questions such as, “Which model is being used?” What information goes into it? What comes back? Is customer information retained? Can corporate data be used for training? Does a third-party model provider receive the information?

These are compliance governance questions because the data may include investigations, employee information, third-party records, or financial information. The contract should address how that information is handled and establish appropriate restrictions on the use of corporate data and queries.

Next, a series of questions about where the AI can fail. Here McBride suggests: How does the system prevent cross-tenant data leakage? How does it identify unsupported statements, hallucinations, or fabricated citations? What happens when malicious instructions are hidden inside uploaded documents? Most importantly, does the system recognize when it lacks sufficient confidence and escalate the matter to a human?

One of the most important characteristics of compliance AI may not be its ability to answer questions. It may be its ability to recognize when it should not answer them.

Keep Humans in the Control Environment

Agentic AI raises the stakes because technology moves from providing information to taking action. But this requires clear authority boundaries. What systems can the agent access? What records can it change? What decisions can it make? Which actions require approval?

Certain compliance decisions should remain subject to documented human authorization. Closing an investigation, changing third-party screening rules, or approving high-risk onboarding are obvious examples. This is where AI governance becomes internal controls. The organization should demonstrate not merely that humans are theoretically “in the loop,” but where human intervention occurs, who has authority, what approval evidence is retained, and what happens when the AI crosses a defined threshold.

CCOs must also understand AI economics. Traditional platforms may be priced by employees, users, or third parties. AI functionality can introduce consumption pricing tied to tokens, documents, searches, or API calls. Model realistic usage and negotiate appropriate spending caps, alerts, overage controls, and consumption rates.

Turn the RFP Into a Governance Exercise

A good RFP does more than collect vendor responses. It forces the organization to define what it actually needs. McBride highlights vendor frustration with “phantom RFPs,” where an incumbent has effectively been selected, or the process is used primarily to gain renewal leverage. A credible RFP must instead be transparent, disciplined, and operationally grounded.

Start with Procurement. Understand source-to-pay requirements, spending thresholds, cybersecurity reviews, privacy requirements, and contracting procedures before bringing vendors deep into the process. Then give vendors meaningful operational information: employee populations, transaction volumes, existing systems, data maturity, integrations, geographic requirements, and workflow constraints.

Most importantly, force precision into vendor answers. Require vendors to classify functionality as:

  1. Available out of the box.
  2. Available through configuration.
  3. Available through a named third-party integration.
  4. On the roadmap with a committed date.
  5. Not supported.

That discipline can dramatically improve an evaluation and create a record of what was actually promised.

Stop Buying Features. Test Controls.

Feature checklists have limits.

McBride suggests that a better test is a scenario. Suppose a critical third party is added to a sanctions list overnight. Ask the vendor to show exactly what happens. Ask questions such as, “How is the alert generated?” Who receives it? How is it prioritized? Who can override it? How is the matter escalated? What evidence is captured? What appears in the audit trail?

Now you are not evaluating a feature. You are evaluating a control. The same principle applies to sandboxes. A generic vendor sandbox tells you relatively little. Require a guided environment configured around your workflows using synthetic or anonymized data. Make users perform the work. That is where implementation problems begin to reveal themselves.

Look Under the Hood Before You Buy

A beautiful interface can be seductive, but buying compliance technology based primarily on user experience is like buying a house because you like the countertops without checking the plumbing. However, before you make a final selection, conduct due diligence around security controls, hosting, uptime, integrations, implementation resources, and data portability.

Review relevant SOC 2 Type II controls. Speak with peer customers. Consider asking to speak with a customer that recently left the platform. Just as importantly, interview the people who will actually implement the product. The team delivering the sales demonstration may not be the team handling implementation. Know who shows up after the contract is signed.

Begin the Relationship by Planning the Exit

Perhaps the most overlooked element of compliance technology contracting is the exit. Companies spend enormous time determining how information will enter a system and surprisingly little determining how they will get it back. A CSV containing basic fields may not recreate an investigation file or preserve the history of a third-party approval. It may not capture attachments, comments, timestamps, escalations, approvals, or audit trails.

Before signing, define export requirements. Ask questions such as: What formats will be provided? What metadata will be preserved? What happens to attachments? Will the audit trail survive? How long will migration assistance remain available? What will extraction cost? When will the vendor delete remaining copies? Understand how you will leave a compliance technology provider before deciding to join it.

The CCO’s Technology Mandate

Compliance technology doesn’t succeed or fail when Legal finishes negotiating the contract. The outcome is largely determined earlier. Did Compliance understand the business problem? Did it know the true cost of the existing process? Did it understand its data? Did it challenge AI claims? Did it test failure modes and workflows? Did it involve Procurement, IT, Privacy, Security, Legal, and the business at the right points? Did it negotiate for implementation, operation, and exit?

Those questions turn technology procurement into compliance governance. Compliance professionals spend their careers asking businesses to operate with transparency, accountability, documentation, fairness, and integrity. Compliance should bring those same principles into the technology marketplace.

Define what you need. Understand what it costs. Test what the vendor claims. Document what was promised. Build controls around AI. Measure whether the technology improves the program. Make sure you can get your data back when the relationship ends. That is what it means to run compliance like a business.

Practical Takeaways

For the CCO, the mandate is clear: build the strategy before selecting the technology; calculate the Total Cost of Ownership rather than the license cost; treat AI as a governance and internal controls issue; test workflows rather than watch demonstrations; diligence the implementation team; and negotiate data portability and exit before signing.

For boards and senior management, the oversight question is equally straightforward: What compliance risk is this technology addressing, how will management measure whether it improves program effectiveness, and what controls govern its use?

The answer tells you much more than whether Compliance has purchased the latest technology. It tells you whether the organization is building a technology architecture that can support an effective compliance program.

If you do not follow Andrew McBride on LinkedIn, you should. He is leading the discussion on the practical aspects of putting the right AI tool in place for you and your organization. His organization will be displaying at this week’s SCCE CEI, so drop by the Integrity Bridge and find out why I think he is the go-to guy in this area.