Tag: Compliance Week

Categories
Blog

AI in the Audit Room: Why a Signature Is Not Evidence of Effective Oversight

Imagine a company with an AI policy—employees complete training. Important outputs supposedly receive human review. The board sees an approval dashboard and assumes it’s managing the risk. Now ask a different question: What evidence shows that the review changed anything?

That is the central compliance challenge in ECI Compliance Week’s AI in the Audit Room. The report was prepared in conjunction with Workiva. The collection translates its AI Governance Framework into an audit program, connecting 14 controls across three tiers to specific tests and supporting evidence. AI-in-the-Audit-Room For Chief Compliance Officers (CCOs), the lesson is straightforward: AI governance must demonstrate how decisions are controlled, challenged, and improved. A policy describes expectations. An approval records an action. Neither, on its own, proves that a control works.

The Oversight Gap Is an Operational Problem

45.2 percent of the respondents reported training or awareness programs, while 33.8 percent reported usage monitoring or logging by IT or security. Separately, the collection reports that approximately one in four executives in Workiva’s 2026 Midyear Executive Benchmark Survey said internal audits had discovered AI errors after outputs reached external stakeholders or board members. Only 11 percent believed their data quality was sufficient for AI use.

These findings should prompt a practical examination of where assurance occurs. Finding an error after distribution is not the same as preventing unsupported information from reaching a decision-maker. Workiva’s separately labeled partner contribution proposes an “assurance architecture” built around governance, traceability, and defensibility. The useful compliance question is whether management can explain what data informed an output, which model produced it, and what an employee authorized.

For an AI-assisted disclosure, that means following the information back to its source rather than accepting a plausible explanation. Ask whether reviewers can retrieve the supporting material and distinguish verified inputs from unsupported assertions. Traceability should make challenges possible before release, not merely explain a failure afterward.

Tier One: Establish Foundations That Can Be Tested

The framework’s first tier contains five controls: an accountable executive, an AI policy, an AI use inventory, employee AI training, and an annual program review. The accompanying audit tests make those familiar concepts concrete. The accountable executive needs authority and budget. The inventory must cover licensed products, AI embedded in existing software, and tools employees adopted independently. Training must reach actual users and match the policy in force. The annual review must produce findings that lead to action.

For the CCO, start with the inventory. Reconcile it against procurement, identity, and expense records, as the framework recommends. Then examine whether each material use has an owner and an appropriate data classification. Do not stop at asking whether training occurred. Ask which users received it and whether the content addressed their activities.

The same discipline applies to program review. A dated report is not the endpoint. Look for assigned remediation, closure dates, and evidence that the organization changed something because of what it learned.

Tier Two: Make Governance Part of Daily Operations

The second tier covers third-party AI due diligence, an AI speak-up channel, incident response, and employee AI use attestation. The third-party control is particularly important. The framework calls for reassessment when AI functionality arrives through a software update, not merely when the original contract is signed. It also calls for identifying the underlying model provider chain and determining whether customer data is used for training.

For compliance teams, that means connecting procurement and vendor oversight to technology change management. The original supplier approval should not be treated as the final assessment of every capability subsequently introduced. The speak-up and incident controls should work together. An employee who identifies troubling output needs a route to someone with AI governance expertise. Where appropriate, a substantive response should lead to investigation, containment, root-cause analysis, and control changes. Employee attestations should also update the inventory rather than disappear into a training database.

My practical recommendation is to test that entire process with a realistic scenario: an approved tool produces an unsupported claim intended for an external report. Determine who receives the concern, who can stop distribution, and what evidence documents the resolution.

Tier Three: Govern the Use Case and the Authority

The third tier addresses pre-deployment approval, human oversight and output monitoring, AI agent access and security, bias and fairness considerations, and external transparency. A critical distinction is that approving a tool is not the same as approving every use of that tool. The framework calls for separate use-case approval records, including cross-functional review for uses affecting financial reporting, customers, or employees.

For agents, the control table calls for unique identities, least-privilege access, defined limits on autonomous action, reconstructable action logs, and a tested way to stop the system. It also calls for testing decisions that affect people and can produce disparate outcomes and for substantiating public statements about AI. Translate these expectations into demonstrations. Ask the system owner to show an agent’s permissions, reconstruct an action, and produce the results of a shutdown test.

Monitoring should also look beyond internal error rates. The framework treats vendor model changes, public incidents, and regulatory shifts as external signals that require scheduled attention. Ask for the record of those signals and the actions taken, not simply the latest system performance report. For transparency, select a public claim and request its evidence file. The test is not whether the statement sounds reasonable. It is whether the organization can support it.

The Signature Problem: Test Judgment, Not Clicks

The collection’s most useful challenge concerns the human review step. Its “signature problem” describes a reviewer who sees a polished answer but lacks the underlying evidence, discarded alternatives, or meaningful ability to challenge the result. Approval becomes easy; disagreement becomes burdensome. The collection proposes three questions: Can the reviewer change the available options? Can the reviewer see enough evidence to disagree? Does disagreement produce a change? 

The report identifies four metrics: approval rate, edit distance on accepted output, time spent per review, and override consequence. Together, these examine whether reviews vary meaningfully, whether edits are captured and evaluated, whether reviewers have time to examine evidence, and whether overrides lead to action.

For CCOs, the fourth metric offers an immediate starting point. The collection recommends examining the last 20 overrides in an AI-assisted process affecting financial statements, customers, or regulators and asking what changed because of each. That exercise gets beyond a completion dashboard. It connects a reviewer’s judgment to remediation, revised instructions, or an adjusted control.

The collection also recognizes the limits of universal human review at scale. It describes moving human judgment into system boundaries, evaluation criteria, exception handling, sampling, and monitoring. It preserves individual review for specified consequential situations, including irreversible outcomes and cases outside anticipated policy boundaries. The practical lesson is not to remove people from oversight. Instead, place human judgment where it can actually influence outcomes, and give reviewers the evidence, authority, expertise, and time to exercise it.

Do Not Overlook the Inference Gap

Shruti Mukherjee’s contribution extends the discussion to AI’s environmental footprint. She distinguishes model training from inference, the recurring activity of running it, and frames the issue as a governance exposure involving ownership, measurement, third-party information, and substantiated claims. Her proposed audit questions are practical: Who owns the energy and water footprint of AI use? Can the organization measure ongoing consumption? What do supplier contracts disclose? Can the company support its environmental statements?

For the CCO, the broader application is to look beyond familiar risk categories. A benefit claimed in a presentation should not become an external assurance without supporting evidence. Where information is unavailable, document the limitation and identify who is responsible for addressing it.

Practical Takeaways: Bring Evidence to the Board

Start with one material AI-assisted process rather than rewriting an enterprise-wide policy. Trace it from the approved use case through source data, output review, escalation, and final distribution. Ask control owners to produce evidence at each stage.

Next, examine the review process itself. Use the collection’s four metrics to identify where approval activity may be substituting for judgment. Follow overrides through to their consequences and assign responsibility for unresolved weaknesses.

Finally, change the board conversation. Report not only how many tools are approved or how many employees are trained, but also what testing found, which controls failed, what management changed, and which risks remain unresolved.

The board should ask whether management knows where AI is used, whether reviewers can meaningfully challenge it, and whether the organization can reconstruct and support significant actions and public claims. This is where compliance connects governance directly to business execution.

The CCO should ask an equally direct question: When someone identifies that the AI is wrong, does the organization merely record the concern, or does it learn and change? That is the difference between an AI governance program that documents approvals and one that demonstrates effective oversight.

Categories
From the Editor's Desk

From the Editor’s Desk: Aaron Nicodemus on the August and September in Compliance Week

In this episode of ‘From the Editor’s Desk,’ Tom Fox visits with Compliance Week editor-in-chief Aaron Nicodemus to discuss highlights from Compliance Week in August, take a look at what is coming down the pike in September in Compliance Week, and discuss the upcoming Third Party Risk Management and Supply Chain Summit in Chicago.

Tom and Aaron review key August coverage and upcoming priorities. They discuss new columnist Ben Mason’s “The Hidden Cost of Compliance Leadership,” outlining five recurring burdens for compliance leaders: independence that is often only theoretical, job risk from doing the role properly (including survey findings that nearly 70% of compliance officers have experienced retaliation), inability to voice doubts internally, the invisibility of effective prevention work, and weak leadership support—creating isolation and prompting ideas for safe forums such as the vetted CW app and event roundtables. Nicodemus highlights his Mayo Clinic whistleblower story alleging AI use may endanger patient privacy and outpace internal guardrails. He also describes a National Conference “Practitioner’s Briefing” distilling six Chatham House themes, previews a September 1MDB case study on enablers, plans AI-governance essays for National Compliance Officers Day, and promotes the Oct. 28–29 Chicago TPRM Summit.

Resources:

Aaron Nicodemus on LinkedIn

Compliance Week

Third Party Risk Management and Supply Chain Summit

Categories
Blog

From Policy to Proof: Six Compliance Priorities for the Next 90 Days

Editor’s note: I am a columnist for Compliance Week.

Compliance Week recently released its Practitioner’s Briefing, which “is crafted as a high-level recap of Compliance Week’s 2026 National Conference (CW 26), held in Washington, D.C., in May. Whether you were there or wished to be, this briefing will bring you up to speed. The briefing captures the six themes that pervaded three days of panel discussion and the networking conversations between them, with practical actions you can implement in the next ninety days.”

The compliance profession is entering the proof era. Policies still matter, but regulators, boards, and employees are asking a harder question: Can the organization demonstrate that its controls operate in practice? That is the central lesson from the Practitioner’s Briefing. Across six themes, the briefing describes a function under pressure from rapid AI adoption, faster whistleblower timelines, redistributed enforcement, expanding third-party exposure, and sharper board expectations.

Today I want to explore the themes and initiatives from the Practitioner’s Briefing. This is not about six disconnected initiatives covered at CW 26. It is an operating model that connects governance, data, accountability, and escalation around existing risks. You can use the next 90 days to produce evidence that the program knows where its risks sit, who owns the controls, how failures surface, and what happens next.

AI Governance: Accountability Must Follow Adoption

AI makes the policy-to-proof gap visible. The Practitioner’s Briefing reports that 83 percent of compliance functions have AI in production, while only 25 percent of leaders are confident in the governance controls. That is not primarily a policy problem. It is an ownership and control-design problem.

Start with your AI inventory. A defensible AI register should identify the tool, approved use case, business owner, data involved, vendor, model, access rights, validation method, human reviewer, retention rule, incident path, and kill-switch authority. Tool approval by IT cannot substitute for use-case approval by Legal, Compliance, Privacy, Security, and the accountable business leader. One platform may be acceptable for drafting training content and unacceptable for evaluating employees or third parties.

The NIST AI Risk Management Framework and ISO/IEC 42001 can help organize this work, but a framework is not the control. The control is the approval record, test result, exception log, monitoring evidence, and documented decision. Compliance should also assume that prompts, summaries, transcripts, and agent logs are discoverable business records. Retention and legal hold procedures must catch those artifacts before the first dispute or investigation forces the question.

AI in Compliance Operations: Redesign the Work

The Practitioner’s Briefing draws a useful line between AI enablement and AI theater. Strong programs redesign a workflow around AI. Weak programs bolt AI onto a slow process and call it transformation. Due diligence, regulatory tracking, training development, and self-service policy guidance are sensible starting points because the work can be scoped, tested, and measured.

Each deployment needs acceptance criteria. Validate performance against known outcomes, constrain source material where accuracy matters, monitor drift, require human review for high-risk decisions, and define escalation when the system is uncertain. Measure return on investment first in hours returned to higher-value work. Faster output that creates more review, remediation, or false confidence is not efficiency. It is control debt.

Speak-Up and Investigations: Trust Is the Control

The Practitioner’s Briefing reports that eight in ten US employees witnessed misconduct during the prior year, yet fewer than three-quarters reported it. That gap is not solved by adding another intake channel. It is solved by showing employees that reporting is safe, fair, and consequential.

One of the Practitioner’s Briefing’s most practical recommendations is to audit the career outcomes of the last 20 employees who raised concerns. Review performance ratings, promotions, transfers, compensation, leave, and departures. Patterns in those records may reveal retaliation or career stagnation that hotline statistics will never show. Pair that review with defined post-report monitoring and documented check-ins with reporters.

Speed is now part of program effectiveness. The briefing highlights a 120-day DOJ window to investigate qualifying internal reports and decide whether voluntary self-disclosure is appropriate. CCOs should calendar that period, establish rapid triage, identify decision rights, preserve evidence immediately, and maintain a standing disclosure team. The goal is not a rushed conclusion. The goal is to prevent delay, unclear ownership, or inadequate resources from deciding for the company.

Enforcement Has Shifted, Not Disappeared

Lower federal case counts are not a safe harbor. The Practitioner’s Briefing describes enforcement as redistributed across state Attorneys General, self-regulatory organizations, the False Claims Act, and future matters still inside applicable limitation periods. A quieter headline environment can encourage exactly the wrong management response: reduced staffing, deferred remediation, and lower investment in controls.

The business discipline is straightforward. Monitor the full enforcement ecosystem, not one federal docket. Maintain the strictest applicable standard as the practical global baseline. Preserve the ability to investigate, cooperate, remediate, and disclose. Most importantly, do not confuse a change in enforcement cadence with a change in underlying legal or ethical risk. Today’s control gap may simply be tomorrow’s case.

Third-Party Risk: Manage the Entire Lifecycle

Third-party risk management is no longer a narrow anti-bribery process. The Practitioner’s Briefing places sanctions, forced labor, transnational crime, material support exposure, supply-chain integrity, and embedded AI inside the modern TPRM remit. That expansion requires a move from onboarding diligence to lifecycle control.

Monitor material relationships from selection through offboarding, with risk-based refreshes, event-driven alerts, beneficial ownership checks, adverse media review, and clear remediation ownership. For AI-enabled vendors, procurement should require disclosure of material fourth- and fifth-party dependencies. Contract terms should address model provenance, data lineage, audit rights, incident notice, control changes, and the ability to explain consequential decisions.

List screening alone is increasingly thin protection. High-risk supply chains may require route mapping, chokepoint analysis, and source-verified information reviewed in context by humans. AI can compress the initial diligence cycle, but it does not replace judgment on coercion, shell companies, access payments, or other facts that demand legal and operational analysis.

Board Reporting and Culture: Lead With the Problem

Directors want a compliance report that begins with bad news, explains the risk, and shows the response. That is the board-reporting message in the Practitioner’s Briefing. Activity counts belong in the appendix. The main discussion should address control failures, investigation aging, retaliation indicators, overdue high-risk diligence, AI exceptions, remediation status, and emerging exposure compared with peers.

This approach also supports a Caremark-style oversight record. The board needs credible information systems, timely escalation of red flags, and evidence that management and directors responded. A between-meetings protocol with the audit or risk committee chair is therefore a control, not a courtesy.

Culture is equally operational. The briefing reports that direct managers and immediate colleagues exert the strongest influence on 80 percent of employees, while only 58 percent of organizations evaluate how results were achieved. Compliance should train managers to receive concerns, audit incentives as rigorously as financial controls, and make conduct part of performance and promotion decisions. The real code of conduct is what the organization rewards, tolerates, and corrects.

A 90-Day Agenda for CCOs

  1. Build the evidence map. Select the highest-risk obligations in AI, investigations, and third-party management. For each one, identify the owner, control, evidence, escalation path, and board metric.
  2. Test AI governance. Reconcile the official AI inventory with procurement records, browser access, expense data, and employee attestations. Review several approved use cases from request through monitoring.
  3. Stress-test investigations. Tabletop a significant internal report against the 120-day decision window. Confirm preservation, privilege, staffing, disclosure authority, and board communication.
  4. Rebuild TPRM around lifecycle risk. Segment critical third parties, define continuous-monitoring triggers, review AI dependencies, and assign remediation deadlines with accountable owners.
  5. Change the board report. Put the three most significant problems first. Add peer comparison, trend data, remediation aging, and decisions required from the board or management.

The Compliance Lesson

The Practitioner’s Briefing is not fundamentally a technology story or an enforcement story. It is a program-effectiveness story. The effective compliance function can identify risk, assign accountability, test controls, learn from failures, and show its work. Policies establish expectations. Evidence establishes credibility. In the next 90 days, that distinction should drive the agenda of every CCO, executive team, and board committee responsible for corporate integrity.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Survey Finds Widespread Retaliation Against Compliance Officers

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the recently released Radical Compliance, Case IQ, and Compliance Week-sponsored survey of more than 325 compliance professionals quantifying retaliation against compliance officers.

Matt reports that 70% say they have suffered retaliation (79% including those unsure), 67% experienced it more than once, and women report slightly higher rates than men. Common retaliation includes exclusion from meetings (64%), being badmouthed (59.5%), and unwanted role changes (49%), while 28% report being fired. Fear is significant: 36% are uncomfortable raising concerns at their current employer, and 48% have been stopped from doing so at some point. Among those reporting retaliation to management, responses are poor: 53% saw no action, 21% saw investigations without remedy, and only 4% felt management supported them. Few go to regulators or sue, though two-thirds of the small group who sued after firing reported satisfactory outcomes. They suggest structural protections such as disclosure of CCO departures, contract/termination safeguards like those in Indian banking rules, and updates to DOJ guidance.

Key highlights:

  • Headline Findings
  • Key Stats Breakdown
  • Types of Retaliation
  • Career Impact Stories
  • Protection Ideas
  • Human Toll and Caveats 

Resources

Matt in Radical Compliance

 Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred the Davey, Communicator, and W3 Awards, all for podcast excellence.

Categories
Great Women in Compliance

Great Women in Compliance: Compliance Week 2026 Highlights with Nick Gallo

Team #GWIC and the #GWICfam were out in full force at the 2026 Compliance Week conference in Washington, DC.  Nick Gallo, a Great Gentleman in Compliance, was gracious enough (or agreed when he was “voluntold”) to be our roving reporter, asking people about their conference highlights, practical takeaways, and about AI in compliance, as that was one key event focus.

The episode also highlights the importance of collaboration, mentorship, and authentic connections in our community, and Compliance Week is such a great reminder of that. From discussions about everything from culture to analytics to celebrating Joe Murphy’s Lifetime Achievement Award, the conference reinforced both the rapid evolution of compliance and the generosity of the people working in it. You will hear the themes of friendships, learning, and shared purpose that continue to define the compliance community from our friends and colleagues.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Surveying Retaliation Against Compliance Officers

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss a new anonymous Radical Compliance survey, launched with Case IQ and Compliance Week, to quantify retaliation against compliance officers who raise compliance concerns to senior management.

The survey asks what misconduct was reported, who retaliated, what forms of retaliation occurred, such as firing, demotion, harassment, budget cuts, blacklisting, and what actions followed. Matt also encourages responses from those who have not experienced retaliation. Tom and Matt have previously discussed anecdotally but have not systematically studied, and plan to publish their findings and host a webinar later in the spring, likely in June. They also discuss potential structural protections informed by data, such as disclosure expectations around CCO departures (e.g., 8-K concepts) and contract/regulatory-approval models like those in India’s banking sector, and suggest that the findings could inform DOJ views on compliance autonomy and effective compliance programs.

Key highlights:

  • Survey Launch Explained
  • Retaliation Questions
  • Why This Study Matters
  • Defining Prevalence
  • Using Findings for Change
  • Final Call to Participate

Resources:

Matt on Radical Compliance

Survey on Retaliation Against Compliance Professionals

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
From the Editor's Desk

From the Editor’s Desk: Aaron Nicodemus Reflections on March and April in Compliance Week

In this episode of From the Editor’s Desk, Tom Fox sits down with Aaron Nicodemus for a lively and insightful look back at the biggest compliance stories from March, while also previewing the trends, enforcement issues, and events set to shape April. They also begin the countdown to the 2026 Compliance Week National Conference in May.

Tom and Aaron break down the fast-moving, policy-driven shifts in U.S. sanctions on Venezuela, Iran, and Russia, and explore how companies are balancing business opportunities with escalating geopolitical and compliance risks amid a volatile oil market. They spotlight Compliance Week’s feature on illegal mining, unpacking its deep connections to financial crime, corruption, and supply chain exposure. The conversation also examines a notable March FCPA declination under the DOJ’s new Corporate Enforcement Policy, focusing on what it signals about voluntary self-disclosure, remediation, cooperation credit, and the Department’s continued emphasis on prosecuting individuals. Along the way, they consider possible aggravating factors, including payments tied to designated criminal or terrorist groups, and what these developments may mean for the future of cross-border enforcement cooperation.

Looking ahead, Tom and Aaron preview the 2026 Compliance Week National Conference, taking place May 6–8 in Washington, DC, including awards finalists, anticipated remarks from DOJ and SEC officials, and timely sessions on AI, whistleblowers, and emerging compliance challenges. They also highlight the conference’s expanded commitment to new voices and share an early look at the Third Party Risk Management & Supply Chain Summit, coming October 26–28 in Chicago.

 

 Resources:

Aaron Nicodemus on LinkedIn

Compliance Week

Categories
Blog

Aly McDevitt Week: Part 5 – Ransomware, Crisis Response, and the Compliance Imperative to Move Fast

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

McDevitt took a different but highly effective approach in this case study. Rather than centering the story on a single historical corporate scandal, she crafted an immersive fictional scenario grounded in real-life attacks, expert interviews, and public guidance. Compliance Week made clear that, while the company and its characters are imagined, the legal, operational, and compliance issues are very real. That makes this piece especially valuable for compliance professionals because it is less a postmortem of one company and more a practical field manual for the next crisis.

McDevitt’s story begins where many cyber incidents begin: with a person, not a machine.

A longtime employee, Betsy, receives an “urgent” email that appears to be from her boss. She clicks a malicious link, lands on a phony, internal-looking site, realizes too late that something is wrong, and then makes the mistake that turns a bad moment into a corporate crisis: she does not report it. Her silence gives the attacker time. Within days, the company, Vulnerable Electric (VE), a private utility serving 1.4 million customers with about 600 employees and $250 million in annual revenue, is facing a full-blown ransomware attack.

That is the first lesson, and McDevitt drives it home with precision. Ransomware is often described as a technology problem, but the first failure is frequently human, organizational, and cultural. Betsy clicked. But more importantly, she hesitated, feared blame, and kept quiet. As McDevitt explains through the expert commentary, her biggest mistake was not simply opening the link. It was actively deciding not to report the incident to the proper internal authority.

For compliance officers, that point should sound very familiar. Whether the issue is corruption, harassment, sanctions, safety, or cyber, organizations do not fail only because something bad happens. They fail because people do not feel safe reporting it quickly.

McDevitt also lays out why this issue matters so much now. She notes that ransomware payments in 2020 reached roughly $350 million, a more than 300 percent increase from the prior year, and that proactive prevention is no longer optional. She further situates the case study in the context of critical infrastructure, noting that entities such as utilities are subject to heightened scrutiny and are encouraged to align with the NIST cybersecurity framework. In other words, ransomware is not just an IT nuisance. It is an enterprise risk, a regulatory risk, and in some sectors a national security risk.

Once the attack is recognized, McDevitt shows the company doing something right: it moves into a structured response. The CEO activates the full cyber incident response team, or CIRT, and the war room includes not only technical leaders and legal counsel, but also the chief compliance officer, the head of communications, external incident response professionals, and other essential decision-makers. This is exactly what a mature response should look like. Cyber incidents do not fall under a single function. They are enterprise events.

I particularly appreciated how McDevitt uses the case study to underline the role of compliance. The CCO is not there as decoration. The article makes clear that if employee data has been exfiltrated, the incident constitutes a personal data disclosure with potentially local, state, and international notification consequences, and that compliance and legal personnel should be in the room from the start. That is a crucial point for corporate compliance professionals. Cyber risk management is not separate from compliance. It is now one of compliance’s core operating terrains.

McDevitt also captures the psychology of the first 36 hours. Anthony Ferrante says those hours are extremely stressful for a CEO, who is simultaneously thinking about operations, data, reputation, and people. That observation matters because it explains why preparation before an attack is so important. You do not want your executives inventing a process under duress. McDevitt reports that VE had already created an incident playbook with roles, escalation steps, and a five-part response framework: facts, business impact, root cause, corrective actions, and lessons learned. That is the kind of disciplined structure compliance leaders should insist upon.

Another strength of McDevitt’s reporting is her treatment of communications. Too many organizations still believe communications should be brought in late, after the lawyers and technologists finish their work. McDevitt, through multiple expert voices, makes the opposite case. Communications should have a seat at the table, not at the back wall. The reason is straightforward: stakeholders will forgive many things, but they will not forgive caginess. VE’s communications lead rightly argues that employees and customers should hear from the company first, not from the media or the attacker.

This point becomes even sharper when McDevitt contrasts VE’s approach with the real-life story of “Melvin,” an employee at another firm that remained offline for 10 days with no formal communication and did not disclose the sensitive data breach to employees in a timely or transparent way. That section may be the most important communications lesson in the entire piece. Employees are not bystanders. They are among the primary victims of a data breach, and they know when something is wrong. Silence destroys trust.

Then comes the hard question at the center of nearly every ransomware story: Do you pay?

McDevitt wisely resists easy moralizing. She notes the FBI’s official position is not to pay, because payment fuels the criminal business model and does not guarantee restoration. Yet she also reports the practical view of experienced practitioners: payment is not illegal per se, and companies often face a grim choice among bad options. The anonymous chief compliance officer quoted in the case study says it best: there are no good options, only the least bad option.

McDevitt’s two parallel paths, pay and do not pay, are particularly useful because they show that neither choice is clean. In Path A, VE pays $5 million, gets imperfect decryption support, recovers faster, but then faces scrutiny over whether it should have consulted OFAC before payment and whether it may have paid a sanctioned party. In Path B, VE does not pay, endures a longer recovery, suffers a data breach, and still faces reputational and legal fallout. McDevitt’s point is not that one route is right and one is wrong. Her point is that ransomware decision-making is governance under pressure.

That is why the postmortem matters so much. McDevitt closes the case study by emphasizing that the long-term impacts fall into three risk buckets: reputational, legal, and regulatory. She then turns to practical lessons: train the workforce, strengthen spam filters, run tabletop exercises, isolate infected devices immediately, secure backups offline, contact law enforcement quickly, do not rush engagement with the attacker, and communicate with each stakeholder group in a timely and tailored way. She also adds smart recommendations on canary files, forensic retainers, access reviews, logging, threat intelligence monitoring, and industry information sharing.

Finally, McDevitt ends on a note that compliance professionals should not miss. Betsy is not scapegoated. She is thanked for telling the truth and invited to participate in a phishing-resilience campaign for other employees. That is not sentimentality. That is culture. If your response to human error is humiliation, people will hide problems. If your response is accountability plus learning, people will surface them.

That may be the most important compliance lesson of all. Ransomware is a cyber crisis, but surviving it depends on culture, governance, and trust just as much as on technology.

I hope you have enjoyed reading about Aly’s case studies for CW. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 3 – Lafarge, Syria, and When “Business Continuity” Becomes Criminality

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

In this case study, Aly took a scandal that could easily be reduced to a shocking headline and showed how misconduct often grows incrementally, decision by decision, concession by concession, until a company crosses a line it can no longer explain away. As McDevitt framed it, Lafarge’s collapse into criminal conduct was not sudden. What began as “local concessions” in a war zone ended in terrorist financing, a guilty plea, and a historic compliance disaster.

For the corporate compliance professional, that is where this story starts. Not with ISIS. Not with the guilty plea. Not even with Syria’s descent into civil war. It starts with a corporate mindset that treats business continuity as a value higher than legal and ethical boundaries.

McDevitt lays out the core facts with devastating clarity. Lafarge built a $680 million cement plant in the Jalabiyeh region of Syria in 2010, just as the Arab Spring began to reshape the region. The plant, Lafarge Cement Syria, was strategically important, but it also operated in an increasingly unstable environment. By 2011, political unrest in Syria had become a violent conflict. By 2012, the area around the plant was plagued by kidnappings, hijackings, and the killing of a contractor at a checkpoint. Most companies would view those developments as bright red stop signs. Lafarge saw them as obstacles to manage.

That is the first major lesson of the case study. The most dangerous compliance failures often arise not from ignorance of risk but from a conscious decision to keep operating despite it. McDevitt shows that while other companies pulled out of Syria, Lafarge kept the plant running and shifted management of Syrian operations to Cairo after evacuating European employees. That decision set the stage for the next step: negotiating through intermediaries with armed factions to permit continued operations. By then, the moral and legal slope was already slippery. The question was no longer whether the company faced risk. The question was how much compromise leadership was willing to tolerate to avoid writing off a major investment.

McDevitt’s reporting is especially effective because it captures the gradualism of the wrongdoing. She writes that Lafarge executives did not wake up one day and decide to fund terrorists. It happened slowly, one deal after another, as the company tried to preserve operations in a deteriorating war zone. This is a point every compliance professional should sit with. Catastrophic misconduct often results from the accumulation of rationalized, smaller acts. Each one is framed as temporary, practical, or necessary. Each one moves the line. Eventually, there is no line left.

The Justice Department ultimately found that Lafarge routed about $5.92 million in illicit payments to the al-Nusra Front and ISIS. In 2022, Lafarge pleaded guilty in the United States to providing material support to terrorist organizations, the first case of its kind against a corporation in the U.S. Former Deputy Attorney General Lisa Monaco said the company “paid millions of dollars to both terrorist groups and benefited from their brutality to the tune of $70 million in revenue,” and the company paid $778 million in fines and forfeitures as part of the plea agreement.

That number alone should command the attention of boards and executive teams. Lafarge tried to avoid the business pain of shutting down a troubled asset and ended up paying more than the original investment in penalties, while also suffering deep reputational damage, legal exposure in multiple jurisdictions, and criminal proceedings against former executives. There is a brutal irony in that outcome. The Syrian plant accounted for less than 1% of Lafarge’s total sales at the time of the Holcim merger, yet the consequences of non-compliance proved vastly disproportionate to the asset’s commercial importance. That is the second lesson. The smaller the business rationale, the less defensible the compliance compromise.

McDevitt also explains why the U.S. Department of Justice had jurisdiction. Lafarge used U.S.-based email services to avoid using company email addresses, and some payments linked to terrorist groups were made in U.S. dollars through New York banks. This should resonate with every multinational company. Jurisdiction in modern enforcement is not limited by headquarters location. It is created through systems, currency flows, communications infrastructure, and business touchpoints. In a global company, you can be hauled into a U.S. enforcement action because you used the plumbing of U.S. commerce.

McDevitt’s account also reveals something even more troubling. By September 2013, Lafarge executives were already acknowledging the reality in their own meeting minutes, stating that it was becoming harder and harder to operate without directly or indirectly negotiating with networks designated as terrorists by international organizations and the United States. That line should stop every compliance officer in their tracks. At that moment, the risk was no longer ambiguous. It was known, articulated, and documented. The failure thereafter was not one of detection. It was one of the decision-making processes.

And that brings us to the heart of the compliance lesson. Once a company understands the legal and ethical nature of the risk, the compliance function is not merely to record the issue. The job is to create a decision architecture that can force the right outcome, even when business leadership hates it.

McDevitt reinforces this through the voice of Marcia Narine Weldon, who said, “business continuity can’t be an excuse for abandoning core legal and ethical principles” and even more pointedly, “When you’re dealing with potential terrorism financing, neutrality isn’t an option. You either stop it or you become complicit”. That is exactly right. There are categories of risk where compromise is not prudent; balancing is complicity. Terrorist financing sits squarely in that category.

Another important aspect of McDevitt’s case study is the timeline of internal response. Holcim, after its merger with Lafarge, became aware in 2016 of allegations that Lafarge had negotiated with ISIS and made payments to it. The head of compliance informed the Chief Legal and Compliance Officer that outside counsel had been engaged for legal analysis, and the board’s finance and audit committee directed an investigation. This sequence shows what a post-discovery escalation should look like. But it also highlights a painful truth: escalation after the fact is not the same as prevention. The best board briefing in 2016 could not undo the wrong choices made years earlier.

For compliance leaders, the Lafarge matter is therefore a case study in the limits of retrospective governance. Once the organization has crossed the line into criminal conduct, the role of compliance shifts from prevention to damage containment.

McDevitt weaves this throughout the piece with precision. She does not sensationalize the conduct. She shows how a company operating in a volatile, high-risk environment allowed ethics and compliance to take a back seat to business survival. That is what makes the article so valuable. It reminds us that in high-pressure environments, compliance is not a support function sitting politely on the sidelines. It is the adult in the room. Sometimes that means telling management to shut down an operation. Sometimes it means escalating to the board. Sometimes it means resigning rather than participating in the unambiguously wrong.

In the end, Inside a Dark Pact is one of Aly McDevitt’s strongest cautionary tales because it strips away comforting myths. It tells us that smart people can rationalize the indefensible. It tells us that local concessions can become global crimes. And it tells us that when a company places asset preservation above values, it may preserve neither.

Join us tomorrow when we review Aly’s piece on Flex and its ESG journey. I am a columnist for Compliance Week.

Categories
Blog

Aly McDevitt Week: Part 2 – VW, Dieselgate, and the Long Road from Fear to Integrity

This week, I want to pay tribute to my former Compliance Week colleague, Aly McDevitt, who announced on LinkedIn that she was retiring from CW to become a full-time mother. I wrote a tribute to Aly, which appeared in CW last week. To prepare to write that piece, I re-read her long-form case studies, which she wrote over the years for CW. They are as compelling today as when she wrote them. This week, I will be paying tribute to Aly by reviewing five of her pieces. The schedule for this week is:

Monday: A Tale of Two Storms

Tuesday: Coming Clean

Wednesday: Inside a Dark Pact

Thursday: Reaching Into the Value Chain

Friday: Ransomware Attack: An immersive case study of a cyber event based on real-life scenarios

In this story, Aly’s reporting did what the best compliance journalism always does: it moved beyond the headline scandal to examine the operating mechanics of cultural repair. McDevitt did not simply retell Dieselgate. She walked through how Volkswagen tried to recover from one of the great corporate compliance failures of modern times through a U.S. monitorship, structural reform, and a sustained effort to replace fear with integrity.

For the corporate compliance professional,  Coming Clean is more than a case study about emissions cheating. It is a case study on whether a company permeated by misconduct can rebuild trust in a credible, measurable, and durable way.

McDevitt begins with the plain truth. Dieselgate was not the act of a single rogue employee or a single bad executive. The defeat device was developed, installed, and concealed by many. Volkswagen’s diesel vehicles used software that sensed when emissions testing was underway and shifted performance to produce compliant results; during normal operations, emissions controls underperformed, resulting in nitrogen oxide pollution up to 40 times above permitted levels, according to U.S. officials. In total, Volkswagen sold approximately 590,000 such vehicles in the United States and roughly 11 million worldwide.

That alone would have made this a historic scandal. But the deeper compliance failure was cultural. McDevitt reports that the company did not come clean voluntarily. It admitted wrongdoing only after regulatory pressure forced the issue. As she recounts, former New York Attorney General Eric Schneiderman alleged that hundreds of senior executives and engineers knew what was happening and that no one was willing to say, “Maybe we should not do this” or “This is against the law,” a devastating indictment of the company’s ethical environment.

That is the first lesson for compliance officers. Compliance breakdowns at this scale are rarely caused by one missing policy. They come from pressure, silence, and a culture that normalizes rationalization.

Volkswagen’s business ambition played a central role. McDevitt notes that the company’s push to become the world’s most successful automaker was accompanied by an integrity deficit, unrealistic goals, and a culture of fear. Later in the case study, she connects this to Strategy 2018, a corporate objective that sought market dominance and, in many observers’ view, created unbearable pressure to deliver results. This is an old lesson, but it remains evergreen. When growth goals are decoupled from ethics, misconduct begins to look like problem-solving.

Volkswagen’s 2017 guilty plea resulted in $4.3 billion in criminal and civil penalties and a three-year U.S. monitorship. McDevitt rightly focuses on the monitorship not as a humiliation ritual, but as an instrument of recovery. Former Deputy Attorney General Larry Thompson was appointed independent compliance monitor and auditor, and Hiltrud Werner became the executive on the Volkswagen side responsible for integrity, legal affairs, and much of the internal reform effort.

One of McDevitt’s great strengths in this piece is her attention to the relationship between monitor and company. Too often, practitioners think of monitorships as adversarial. Volkswagen’s experience suggests something more nuanced. Werner explicitly framed the monitor as an investment in Volkswagen’s future, not merely a punishment for its past, and she stressed that having someone on-site who knew the required standard was a positive element of reform. That is a practical insight. External oversight works best when the organization treats it as a pathway to transformation rather than a box-checking burden.

McDevitt also highlights the mechanics of making that relationship work. Volkswagen held a pre-monitorship “boot camp” in May 2017 to accelerate understanding, create transparency, and build human relationships between the monitor team and company personnel. Werner’s takeaway was one every compliance professional should write down: do not focus only on process; focus on people, too. I find that insight especially powerful because compliance functions often overinvest in control language and underinvest in trust architecture.

That same lesson appears in Volkswagen’s Project Management Office. McDevitt reports that the company created a neutral PMO to coordinate the monitorship across departments, manage over 1 million pages of documents and more than 8,000 meetings, and connect the monitor team to knowledgeable personnel across the enterprise. The PMO was not clerical support. It was organizational muscle. It mirrored the monitor’s work streams, established clear lines of contact, and brought together 80 staff from the first, second, and third lines of defense. That is another lesson worth underlining. In a major remediation project, project management is not ancillary to compliance. It is compliance.

McDevitt then turned to one of the most significant reforms: a single Code of Conduct for all employees across all 12 brands and companies, the first such common code in Volkswagen’s history. Hiltrud Werner described it as the company’s first stable anchor for culture. The Code was not meant to be an abstract statement. It included case studies and examples, and the training was updated to include “Dieselgate Lessons Learned” on compliance, integrity, culture, realism, personal responsibility, and speak-up expectations. Every employee and all board members received training on those lessons. For compliance professionals, this is exactly right. If your code cannot explain what went wrong in your own organization, then it is not yet a living document.

McDevitt’s reporting on Together4Integrity (T4I) is especially useful for practitioners. T4I emerged from the ashes of the failed growth-at-all-costs model and was built on two pillars: designing processes and positively influencing them, and inspiring employees to do the right thing out of conviction. It was not a one-size-fits-all rollout. Volkswagen recognized that a global organization with strong local identities needed both centralized standards and local ownership.

I particularly appreciated how McDevitt showed the practical texture of this effort. Local managers were empowered to choose engagement formats, from discussion breakfasts to integrity activities designed to reduce the distance between managers and employees and support a more open speak-up culture. Stephanie Davis, Volkswagen Group of America’s CECO, put it plainly: serious topics cannot be so scary that employees refuse to engage with them. Demystifying the work is part of the work.

The company also understood that culture had to be measured. This is perhaps the most practical part of McDevitt’s analysis. Volkswagen used perception workshops and its annual Stimmungs barometer survey to assess whether employees believed integrity was possible within their organizational units, identify weak areas, and build risk-based action plans. Werner reported that these measures showed year-over-year improvement, and the company used them to target workshops and resources where risk was greatest.

This is where many companies still fall short. They conduct training and communications, but they do not build a credible measurement framework for whether culture is actually changing. Volkswagen’s approach, as McDevitt presents it, offers a more mature model.

She also addresses the root causes of silence. Volkswagen identified “chimney careers,” or promotion paths entirely within one silo, as a structural factor that discouraged speaking up, as employees became too dependent on a single chain of command. That diagnosis is remarkably important. Speak-up culture is not only about hotline posters or anti-retaliation language. It is also about mobility, organizational design, and whether employees believe dissent will end their careers.

Finally, McDevitt looks at trust. Internally, Volkswagen viewed the increase in non-anonymous whistleblower reports as evidence that fear had begun to recede. In 2020, the company received 2,800 whistleblower tips, 90 percent of which were non-anonymous, a figure Werner said was unusually high and a signal that employees no longer felt the same degree of fear. Externally, regaining customer trust was slower and more difficult. Volkswagen repositioned around electric vehicles, carbon neutrality, and Electrify America, but Werner candidly admitted that rebuilding credibility was still a long process.

That candor may be the final lesson. After a scandal of this magnitude, a campaign cannot restore trust. It is restored by years of disciplined conduct, transparent accountability, and evidence that the company has truly understood what went wrong. Aly McDevitt’s Coming Clean is therefore not simply a story about Volkswagen. It is a guide to the difficult middle stage of compliance work: what happens after the plea, after the headlines, after the first promises. That is where the real labor begins.

Join us tomorrow, where we review Aly’s piece on Lafarge in Syria. I am a columnist for Compliance Week.