Categories
Blog

Is there a FEPA Future in Venezuela?

For U.S. compliance professionals, few jurisdictions raise as many red flags as Venezuela. Decades of entrenched corruption, state capture of key industries, economic collapse, weak rule of law, and the legacy of PdVSA have made the country a case study in what happens when corruption becomes systemic rather than episodic. Now that geopolitical and energy realities are shifting, some U.S. companies are again evaluating whether and how to reenter the Venezuelan market.

Against that backdrop, the passage of the Foreign Extortion Prevention Act (FEPA) represents one of the most significant developments in anti-corruption enforcement in nearly half a century. The question compliance officers are now asking is a practical one: can FEPA actually be used to prevent bribery and corruption for U.S. companies returning to Venezuela, or is it merely a symbolic addition to an already strained enforcement framework?

The answer, as with most compliance questions, is nuanced. FEPA is not a silver bullet. But when properly understood and operationalized, it can meaningfully change the risk calculus for companies operating in high-extortion environments like Venezuela.

The Historic Gap in the FCPA

For decades, the compliance community has lived with a fundamental asymmetry in U.S. anti-corruption law. The Foreign Corrupt Practices Act is a supply-side statute. It criminalizes the offering or payment of bribes by U.S. companies and individuals, but it does not criminalize the demand for those bribes by foreign officials. This gap has long distorted incentives on the ground.

In jurisdictions such as Venezuela, bribery is rarely framed as a voluntary transaction. It is far more often presented as a demand, a condition of doing business, or even a threat, as in the case of extortion. Officials do not ask politely. They delay permits, block shipments, threaten arrests, or endanger employee safety. Until FEPA, U.S. law largely treated this as background noise rather than a prosecutable offense.

FEPA directly addresses that gap by criminalizing the solicitation or acceptance of bribes by foreign officials from U.S. persons or companies. In doing so, it finally targets the demand side of corruption and aligns U.S. law more closely with how bribery actually operates in high-risk countries.

Why Venezuela Is the Ultimate Test Case

If FEPA can work anywhere, it should work in Venezuela. The country’s corruption ecosystem is characterized by pervasive extortion across customs, energy, transportation, security, immigration, and tax authorities. Payments are often demanded not to gain an advantage but to avoid harm. This distinction matters. In Venezuela, the compliance challenge is not simply rogue employees paying bribes. It is employees facing credible threats to liberty, safety, or health. FEPA explicitly recognizes this reality by treating extortion by a foreign official as a criminal act rather than merely a compliance failure by the company.

That framing gives compliance officers something they have long lacked: a legal backbone to support a firm refusal posture. Companies can now say, with credibility, that the demand itself is illegal under U.S. law and subject to DOJ enforcement, even if the official is located abroad.

Extortion, Facilitation, and the Compliance Trap

One of the most dangerous compliance traps in Venezuela has always been the mislabeling of extortion payments. Under the FCPA, facilitation payments occupy a narrow and controversial exception. Extortion payments, however, were never facilitation payments. They were survival payments. FEPA eliminates any lingering ambiguity. Extortion payments involving threats to life, liberty, or health are now clearly illegal, not merely discouraged. This forces compliance programs to confront uncomfortable operational realities.

Policies must explicitly distinguish facilitation from extortion. Employees must be trained that the company will support them if they are threatened, but that any such payment must be immediately documented, accurately recorded, and escalated. Book and record accuracy becomes critical. Mischaracterizing extortion as a routine expense is now a standalone risk under FEPA, not merely an FCPA accounting issue.

FEPA as a Deterrent Tool, Not Just an Enforcement Tool

One of the most overlooked aspects of FEPA is its potential deterrent effect. The statute introduces the possibility of DOJ investigations targeting foreign officials, including public naming and reporting requirements. For officials who interact with U.S. companies, this creates reputational and diplomatic risk that did not previously exist. In Venezuela, where many officials rely on international travel, financial access, and political legitimacy, even the threat of U.S. scrutiny can matter. FEPA does not require immediate extradition to have an impact. The mere existence of a credible enforcement pathway can alter behavior at the margins.

For compliance officers, this means FEPA can be used proactively. Risk assessments should explicitly incorporate FEPA exposure. Third-party due diligence should assess patterns of extortion, not just a history of bribery. Contractual language should reference the reporting obligations for extortion. Training should include scenario-based exercises where employees practice refusing demands and escalating threats.

The Limits of FEPA in Venezuela

None of this should be overstated. FEPA will not cleanse Venezuela of corruption. Extradition of Venezuelan officials is unlikely. Local enforcement cooperation will be minimal. Many officials operate with de facto immunity. But compliance effectiveness has never depended on perfect enforcement. It depends on shifting incentives, setting expectations, and protecting employees. FEPA strengthens all three. From a DOJ perspective, FEPA also changes cooperation dynamics. Companies that proactively document extortion demands, preserve evidence, and report credible threats may be viewed very differently from companies that quietly pay and rationalize. In a Venezuela reentry scenario, that distinction could be outcome-determinative.

What Compliance Officers Should Do Now

For companies considering Venezuela, FEPA must be embedded into program design from day one. This includes updating anti-corruption policies, revising travel and security protocols, enhancing incident reporting mechanisms, and briefing boards on the new enforcement landscape. Most importantly, compliance officers must be realistic. FEPA does not eliminate the need for robust internal controls. It heightens the consequences of getting them wrong. Venezuela will remain a high-risk jurisdiction regardless of statutory innovation.

Five Key Takeaways for the Compliance Professional

1. FEPA Changes the Risk Conversation, Not Just the Law

FEPA fundamentally alters how compliance officers should frame corruption risk in high-extortion jurisdictions like Venezuela. It is no longer only about preventing improper employee payments. It is now about recognizing, documenting, and escalating illegal demands by foreign officials. This allows compliance to move from a defensive posture to a principled refusal backed by U.S. law.

2. Extortion Must Be Explicitly Addressed in Policies and Training

Companies can no longer afford vague language that blurs the distinction between facilitation payments and extortion. Compliance programs must clearly define extortion as illegal, explain how it differs from facilitation payments, and provide step-by-step guidance for employees facing threats to health, safety, or liberty. Scenario-based training is no longer optional in Venezuela risk operations.

3. Books and Records Exposure Has Increased Under FEPA

Accurate documentation is now a frontline compliance control. Any payment made under duress must be recorded precisely and transparently. Mischaracterizing extortion payments as routine expenses or facilitation payments creates a separate and serious compliance failure. Accounting controls, escalation protocols, and audit reviews must be aligned accordingly.

4. FEPA Should Be Embedded in Risk Assessments and Third-Party Due Diligence

Venezuela reentry assessments should explicitly evaluate extortion risk, not merely bribery history. Third parties, customs brokers, security providers, and logistics partners are often the point of pressure. FEPA requires compliance officers to assess whether business partners operate in ways that expose the company to extortion demands and reporting failures.

5. FEPA Strengthens Compliance’s Role as a Strategic Advisor

FEPA gives compliance professionals a credible legal framework to advise management and the board on when and how business can be conducted safely. It reinforces the message that walking away from certain transactions is not risk aversion but risk management. In Venezuela, FEPA can help compliance professionals draw clearer red lines and protect both the company and its people.

The Bottom Line

So, could FEPA be used to prevent bribery and corruption for U.S. companies returning to Venezuela? Not entirely. But it can materially reduce risk, empower employees, and change how companies engage with corrupt systems. For the first time, U.S. law squarely acknowledges what compliance professionals have always known: bribery often begins with a demand. By criminalizing that demand, FEPA gives companies a stronger legal and ethical foundation to say no.

In a country like Venezuela, that may be the most important compliance tool of all.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 28 – The Importance of Data Governance

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 28 episode, we look into the crucial importance of data governance in the realms of compliance and cybersecurity.

Key highlights:

  • The Role of Data Governance in Compliance and Cybersecurity
  • Data Governance and ESG
  • Understanding Data Privacy Laws

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Great Women in Compliance

Great Women in Compliance: A Next-Gen Video of Ethics and Compliance

In this episode of the Great Women in Compliance Podcast, Lisa Fine and Sarah Hadden (Gen X) are joined by Rebecca Anker and Emily Frank for an engaging conversation on what the next generation needs from ethics and compliance. Rebecca, Gen-Z, and Emily, a millennial, share candid insights shaped by their experiences as part of the emerging workforce.

The discussion explores the real-life impact of generational influences—from questioning hierarchy and outdated practices to prioritizing transparency, usability, and minimizing the traditional reliance on hierarchy. Rebecca and Emily discuss how the rising stars in the profession are taking the evolution to a collaborative, service-oriented function that partners with the business and clearly explains the why behind policies and decisions to new levels.

They also discuss current topics, including creative, shorter training approaches, balancing regulatory requirements with innovation, responsible AI use, and rethinking speak-up programs. They discuss why language matters, why “whistleblower” may no longer resonate, and how normalizing the act of raising concerns can strengthen speak-up culture across generations.

The episode wraps with practical advice from Rebecca and Emily for more “seasoned” compliance professionals to stay curious and engage with new voices and ideas. It is exciting to see where they and their peers will take the profession. 

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 27 – The Compliance Function in an Organization

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 27 episode, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence.

Key highlights:

  • DOJ’s Expectations for Compliance Programs
  • Funding and Resources for Compliance
  • Compliance Program Structure and Authority

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Blog

How Compliance Should Show Up Before the Crisis

Recently, my colleague Matt Kelly wrote a blog post about retaliation against Chief Compliance Officers (CCOs). Matt and I explored it in an episode of the podcast Compliance into the Weeds. Matt’s post and our discussion crystallized one of the frustrations of the CCO role: compliance is often experienced solely by senior management as a late-arriving messenger of bad news. When compliance walks into the room, something has already gone wrong. The tone changes. Defenses go up. Trust narrows.

Yet the most consequential moments for a CCO are precisely those situations where the stakes are highest. A potential regulatory disclosure. A decision about whether to notify a government agency. A moment where delay, missteps, or poor coordination can turn a manageable issue into an enterprise-level crisis. If compliance is only visible in those moments, the relationship with the CEO and executive leadership team is already at a disadvantage.

Interestingly, in our podcast, we explored a technique which might be termed “coaching management ahead of time”. Matt picked up the strategy of using a training borrowed from the cyber world of incident training for a cyber-attack. I see this as a very powerful way not only to communicate compliance but also to train on the specific issues senior management will face if a reportable compliance incident occurs. You could train on such hypotheticals by walking the executive leadership team through them so they understand the process, while also providing training on the specific issues.

I think this approach offers practical, repeatable ways to build trust with senior management before a crisis, so that when compliance raises a serious issue, the function is seen as a stabilizing force, not a source of panic.

The Core Problem: Compliance as the Bearer of Bad News

Many compliance officers do excellent technical work but still struggle to earn executive trust. The reason is not competence. It is timing and framing. Senior leaders often experience compliance in three narrow contexts:

  • An investigation has begun.
  • A whistleblower allegation has escalated; and/or
  • A regulator may need to be notified.

In those moments, compliance is necessarily directive. The CCO must slow decisions down, insist on process, and sometimes recommend outcomes executives would prefer to avoid. Without a foundation of trust, those recommendations can feel punitive or overly conservative. The solution is not softer messaging during crises. The solution is familiarity with the compliance process long before the crisis arrives.

Process Transparency as a Trust-Building Strategy

Trust is built through predictability. Senior executives are far more comfortable with difficult outcomes when they understand the process that leads there. This is where scenario-based training becomes one of the most underused tools in the compliance arsenal. Instead of waiting for a live issue, the CCO can walk the executive leadership team through realistic hypotheticals:

  • A fact pattern that suggests regulatory notification may be required
  • How compliance evaluates credibility and materiality
  • Who is involved at each stage and why
  • What decisions will management be asked to make
  • What actions help, and what actions make things worse

These sessions are not about assigning blame or rehearsing fear. They are about demystifying how compliance operates when the stakes are high.

Why Scenario-Based Training Works With Executives

Scenario-based discussions resonate with executive teams for several reasons. First, they are practical. Executives do not need another policy overview. They want to know what actually happens when something goes wrong. Second, they are respectful of executive time and intelligence. A well-designed hypothetical treats leadership as decision-makers, not students. Third, they normalize compliance involvement.

When executives have already walked through a compliance-led process in a low-pressure setting, that process feels familiar rather than threatening during a real event. Most importantly, scenario-based training reframes compliance from a reactive function to a preparedness function.

The Strategic Role of Informal Engagement

These conversations do not need to occur only in formal training sessions. In fact, some of the most effective trust-building happens outside structured settings.

  • A short walkthrough during an executive offsite.
  • A tabletop discussion over lunch.
  • A casual conversation that begins with, “Let me show you how we would handle this if it ever happened.”

These informal touchpoints matter because they remove fear from the equation. They allow executives to ask questions they might not ask during a live issue. They also allow compliance to show judgment, nuance, and business awareness. This is not a charm offensive. It is a deliberate relationship strategy.

Training on What Not to Do

One of the most valuable elements of scenario-based transparency is the ability to explain mistakes before they occur. Executives often want to help in a crisis. That instinct, while well-intentioned, can create problems. Premature document reviews. Side conversations. Incomplete recollections. Overconfident assurances.

Scenario training allows the CCO to say, in advance, “Here is what helps us protect the company,” and just as importantly, “Here is what can unintentionally make things worse.” When executives understand these boundaries ahead of time, compliance interventions during a real issue feel protective rather than restrictive.

From Messenger of Doom to Stabilizing Force

When compliance has invested in transparency and education, something important shifts. When the CCO later says, “We believe this may require regulatory notification,” that recommendation is no longer heard in isolation. It is understood as part of a known, previously discussed process.

Executives may not like the conclusion, but they trust the path that led there. That trust allows compliance to do its job effectively. It reduces friction. It shortens response time. It improves decision quality. Most importantly, it positions compliance as an advisor whose presence brings structure and clarity to uncertainty.

What Compliance Officers Should Take Away

For compliance officers, the lesson is not about presentation skills or tone management. It is about timing and familiarity. If senior management only experiences compliance during moments of stress, compliance will always feel adversarial. If senior management understands the compliance process before the stress arrives, compliance becomes a stabilizing influence.

Scenario-based training, informal engagement, and process transparency are not “nice to have” activities. They are strategic tools for relationship-building at the highest levels of the organization. The most trusted CCOs are not those who avoid bringing bad news. They are the ones who ensure that when bad news arrives, it is delivered within a framework everyone already understands. That is how compliance earns trust before the crisis and credibility during it.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 26 – Elevating the Role and Independence of the Chief Compliance Officer

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 26 episode, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations.

Key highlights:

  • Key Inquiries Around the CCO and Compliance Function
  • Importance of CCO Certification and Court Decisions
  • Critical Takeaways for Compliance Professionals

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Blog

Board KPIs for AI Governance: Guidance from the ECCP

Corporate Boards are no longer asking whether their organizations will use artificial intelligence. The business has already answered that question. The only question that matters now is whether AI is being governed well enough to support growth without creating unmanaged risk.

For the corporate compliance officer, this reality creates both pressure and opportunity. Pressure, because Boards with minimal AI literacy still carry full fiduciary responsibility. Opportunity, because compliance is uniquely positioned to translate complex AI activity into oversight-ready information. The bridge between those two worlds is the right set of Board-level  Key Performance Indicators (KPIs) for AI governance. Moreover, I believe the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) can serve as a framework for developing appropriate KPIs for your Board.

In this blog post, we detail a set of Board-level KPIs for compliance professionals tasked with educating growth-oriented Boards on AI governance using a blended, ECCP-centric framework. It assumes that AI is already deployed across the enterprise, including generative AI, and that governance must enable innovation while enforcing guardrails.

Why Boards Need AI KPIs Now

The ECCP makes one point repeatedly and without ambiguity: regulators care less about written policies and far more about whether controls work in practice. Boards are expected to exercise oversight over risk, including emerging and technology-driven risks. AI is now firmly in that category.

AI governance KPIs are not about teaching directors how models work. They are about answering three questions every Board must be able to answer:

  1. Do we know where AI is being used?
  2. Do we control how AI changes over time?
  3. Can we detect, respond to, and remediate AI-related harm quickly?

If a Board cannot answer those questions with evidence, not narrative reassurance, the organization is exposed. The role of compliance is to ensure those answers are delivered in a form that directors can understand and act upon.

The KPI Philosophy: Enablement With Guardrails

Because this is a growth-oriented Board, the goal is not to slow AI adoption. The goal is to make AI scalable, defensible, and sustainable. KPIs must therefore do three things simultaneously:

  • Demonstrate coverage and control without micromanagement
  • Surface risk early, before incidents become enforcement events
  • Support informed decision-making, not technical debate

This means Boards should receive KPIs, escalation triggers, and narrative context. Numbers alone are insufficient. Context without metrics is worse.

Six Board-Level KPIs for AI Governance

The following six KPIs apply to all AI systems, including generative AI, within a unified governance framework. They are evidence-based, auditable, and aligned with the ECCP expectations for testing, monitoring, and continuous improvement.

1. Risk Inventory Coverage

This KPI measures the percentage of in-scope AI systems with a current, signed risk record documenting use case, data sources, impacts, potential harms, and safeguards. If AI is operating outside the risk inventory, it is operating outside governance. This KPI answers the most basic oversight question: do we know what we have? Any material AI system without a documented risk assessment or with an expired review date should be escalated for review.

The ECCP begins with risk assessment for a reason. Under the ECCP, they are directed to consider whether a company has identified and prioritized its risks, including emerging risks. AI, particularly GenAI, now squarely fits within that expectation. Risk Inventory Coverage directly answers the ECCP question: “What methodology has the company used to identify, analyze, and address the particular risks it faces? ” If AI systems are operating without a documented risk record, the program fails at step one. From an ECCP perspective, undocumented AI use is indistinguishable from unmanaged risk.

2. Model Change Control Adherence

This measures the percentage of AI model changes, including code, data, prompts, parameters, or vendors, that followed the approved change management process. Uncontrolled change is the fastest way for compliant AI to become noncompliant. This KPI assures directors that innovation is disciplined, not chaotic. Any production AI change implemented without pre-deployment testing, approval, or rollback capability should be escalated for review.

ECCP Alignment:

The ECCP explicitly evaluates whether policies are followed in practice, not merely written. Adherence to change control shows whether AI governance has real authority over business and technology decisions. Unapproved model changes undermine every safeguard the company believes it has in place. From the DOJ’s perspective, a control that can be bypassed without consequence is not a control. For your Board, this KPI demonstrates that AI innovation is disciplined and governed, not uncontrolled experimentation that creates hidden compliance exposure.

3. Model Lineage and Provenance Completeness

This KPI measures the percentage of AI systems with end-to-end traceability, enabling the reconstruction of how outputs were generated and decisions were approved. When something goes wrong, regulators and plaintiffs will ask how the AI reached its decision. This KPI determines whether the company can answer. Any high-impact AI system lacking sufficient documentation to support root cause analysis should be escalated for review.

This KPI is derived from the ECCP sections on Continuous Improvement, Periodic Testing, and Review, as well as Investigation, Analysis, and Remediation of Misconduct. The ECCP asks whether a company can understand why something went wrong and conduct effective root cause analysis. Without lineage and provenance, AI decisions cannot be reconstructed, tested, or explained. This KPI directly supports DOJ’s expectation that companies can investigate incidents, identify systemic weaknesses, and remediate effectively. For your Board, this KPI determines whether the organization can defend its AI decisions after the fact or whether it will be forced into speculation and guesswork.

4. Third-Party Model Assurance Coverage

This KPI measures the percentage of third-party AI tools and services that have completed due diligence, contractual controls, and periodic reassessment. Most AI risk now enters organizations through vendors. Boards must know whether those risks are being actively managed. Any use of third-party AI without completion of onboarding or with unresolved high-risk findings should be escalated for review.

This ties to the ECCP section around Third-Party Management. The ECCP is unambiguous on third parties. Companies are expected to conduct risk-based due diligence, impose contractual controls, and monitor third-party performance over time. Most AI risk now enters through vendors, platforms, APIs, and embedded models. Treating third-party AI differently from other third-party risks would be inconsistent with DOJ guidance. For your Board, this KPI shows that AI vendor risk is governed with the same rigor as bribery, sanctions, or data security risks.

5. AI Incident Mean Time to Resolution (MTTR)

This KPI measures the median time from detection of an AI incident to containment and recovery. Incidents are inevitable. What matters is how fast the organization responds. This KPI demonstrates operational resilience. Repeated incidents with increasing resolution times or incomplete remediation should be escalated.

This ties to the ECCP sections on Investigation, Analysis, and Remediation of Misconduct. The ECCP focuses heavily on how quickly and effectively companies respond to detected issues. Speed matters. Delayed containment signals weak controls and inadequate monitoring. AI Incident MTTR translates this expectation into a measurable operational outcome. It demonstrates whether the company can detect, contain, and remediate AI-related harm before it escalates into regulatory or reputational damage. For your Board, the key takeaway is that this KPI demonstrates operational resilience and governance maturity, not merely technical incident response.

6. Fairness and Robustness Pass Rate

This KPI measures the percentage of AI systems passing predefined fairness, bias, and robustness tests across relevant segments and use cases. It connects AI governance to ethical outcomes and reputational risk. Any material AI system deployed with known fairness or robustness failures should be escalated for review.

This ties to the ECCP sections on Continuous Improvement, Periodic Testing, and Review. The ECCP repeatedly asks whether companies test their controls and whether those controls work in practice. Fairness and robustness testing is the AI equivalent of transaction testing in anti-corruption or sanctions compliance. This KPI shows that AI systems are not only reviewed at launch but are continuously validated against defined risk thresholds. For your Board, the key takeaway is that this KPI demonstrates that ethical and legal AI commitments are enforced through testing, not slogans.

Board Oversight Questions Tied to AI KPIs

To close, here are Board-level questions compliance officers should encourage directors to ask:

  1. Which AI systems fall outside our current risk inventory, and why?
  2. Where have we accepted AI risk, and what safeguards justify that decision?
  3. Are AI changes happening faster than our governance can keep up with?
  4. How quickly can we detect and contain AI-related harm?
  5. Which third-party AI risks would cause us to pause or exit a deployment?
  6. How do these KPIs support growth rather than restrict it?

AI governance KPIs are not about slowing innovation. They are about making growth durable. For compliance professionals, delivering these metrics in a clear, disciplined, and Board-ready way is how AI governance becomes a strategic asset rather than a regulatory afterthought.

If you would like specific KPIs based on this blog, go over and subscribe to my Substack. At this point, it is free. Check it out here.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 25 – Investigative Findings

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 25 episode, we consider the critical importance of addressing investigative findings within a corporate compliance framework.

Key highlights:

  • The Impact of Investigations on Compliance
  • Communicating Costs and Risks
  • Ensuring Effective Communication

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Sunday Book Review

Sunday Book Review: January 25, 2026, The Book on Leadership for ‘26 Edition

In the Sunday Book Review, Tom Fox considers books that would interest compliance professionals, business executives, or anyone curious. It could be books about business, compliance, history, leadership, current events, or anything else that might interest Tom. In this episode, we look at 4 recent books on leadership you should read in 2026.

  1. The AI Centered Enterprise by Ram Bala, Natarajan Balasubramanian, and Amit Joshi
  2. Twin Transformation by Michael Wade and Konstantinos Trantopoulos
  3. Gain by Michael Wade and Amit Joshi
  4. Leading a Sustained Business Transformation by Julia Binder and Knut Haanaes

Resources:

12 leadership books you should read in 2026 by the IMD Blog

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 24 – Internal Reporting and Triage

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 24 episode, we look into the critical process of internal reporting and triaging of FCPA claims.

Key highlights:

  • Guidelines for Effective Compliance Programs
  • Jonathan Marks’ Five-Step Process for Early Assessment
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.