Categories
Compliance Tip of the Day

Compliance Tip of the Day – M&A-Pre-Acquisition: Conducting a Corruption Risk Assessment

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice for navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

We continue our look at the role of compliance in the pre-acquisition phase of a merger and acquisition. Today, we consider the need for a corruption risk assessment.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Innovation in Compliance

Innovation in Compliance – Steph Holmes on Blending AI and Human Oversight for Effective Compliance

Innovation spans many areas, and compliance professionals need not only to be ready for it but also to embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom welcomes Steph Holmes, long-time friend and Director of Ethics and Compliance Strategy at the EQS Group, who looks at the current Intersection of AI and compliance.

Steph Holmes and EQS are both at the forefront of integrating artificial intelligence (AI) into compliance programs to enhance their efficiency and effectiveness. With a focus on practical applications, Holmes views AI as a crucial tool for expanding resources, especially as organizations face increasing regulatory changes and economic pressures. She advocates for the responsible, sustainable, and explainable adoption of AI, emphasizing that compliance professionals should embrace it rather than fear it. Holmes discusses the importance of blending AI capabilities with human oversight to ensure compliance tasks are managed accurately and risks are mitigated effectively.

Key highlights:

  • Digitizing Compliance: AI Tools and Programs
  • Navigating Compliance Challenges with Human Judgment
  • Enhancing AI Reliability Through Human Oversight
  • Enhancing Compliance through Responsible AI Implementation
  • Implementing AI Pilot Programs in Compliance Workflows

Resources:

Steph Holmes on LinkedIn

EQS Group LinkedIn

Where in the Loop: Corporate Compliance Insights

EQS Website

EQS Benchmark Report: AI Performance in Compliance & Ethics

Innovation in Compliance was recently ranked 4th among Risk Management podcasts by 1,000,000 Podcasts.

Categories
Blog

Why AI Demands a New Breed of Leaders: A Compliance Perspective

Artificial intelligence is no longer a distant future state for compliance teams. It is here, operating inside financial crime platforms, powering third-party due diligence tools, driving monitoring engines, and influencing the everyday judgments that regulators scrutinize. Yet too many companies still approach AI as if it were simply another IT project. In a recent Sloan Management Review article, Why AI Demands a New Breed of Leader,” the authors, Faisal Hoque, Thomas H. Davenport, and Erik Nelson, argue that successful AI transformation is far more about people, culture, and leadership than about code.

For compliance professionals, that should sound familiar. Every major enforcement action of the last decade has shown that failure rarely begins with a faulty system. Failure begins with leadership that misunderstands risk, a culture that resists change, and governance frameworks that cannot keep pace with new technologies.

The authors argue that modern organizations require a new category of leader to guide AI adoption, a role that blends technical capability with cultural stewardship, ethical understanding, and organizational change management. They call this the Chief Innovation and Transformation Officer (CITO) or an equivalent title. Whether companies formally adopt the title or not, the message is unmistakable: AI changes the leadership equation, and compliance has a front-row seat.

Why Traditional Technology Leadership Is No Longer Enough

While CIOs are increasingly viewed as changemakers, they often lack the time and mandate to address the organizational disruption AI brings. Compliance officers understand this problem intuitively. You can have the most sophisticated tools in the world, but if the culture is not ready for them, the result will be chaos or even misconduct. The authors cite survey data showing that 91 percent of large-company data leaders believe cultural issues, not technical ones, are blocking progress. That finding mirrors what compliance sees in every DOJ corporate enforcement action. Misconduct thrives not because technology fails, but because people and processes fail.

The article also includes examples of organizations that stumbled by treating AI as a purely technical deployment. The Zillow pricing model collapsed. The swift employee backlash at California State University. The Air Canada chatbot that mishandled bereavement fare guidance. Each case reveals the same lesson: AI without governance becomes a liability. For compliance professionals evaluating AI adoption, these examples should resonate. AI raises questions about transparency, fairness, documentation, accountability, and the human impact of automation. Those are governance issues, not engineering puzzles.

The New Leadership Model AI Demands

The authors describe several competencies required for effective AI leadership, all of which map directly into compliance priorities:

Navigating ethical considerations.

AI introduces bias, harm, and fairness risks, all of which are central concerns for regulators. Leaders must weigh efficiency gains against ethical boundaries.

Driving cultural transformation.

AI adoption changes workflows, reporting lines, incentives, and human-machine collaboration. Leadership must prepare the workforce for new models of decision-making.

Managing human-AI partnerships.

The near-future compliance program will rely on co-decision systems that combine algorithmic outputs with human judgment. Leaders must understand how to balance the two.

Breaking down silos.

AI implementation touches HR, legal, IT, operations, procurement, and compliance. Leadership must connect these functions rather than allow fragmented approaches.

Overseeing citizen development.

Employees across the business can now build AI models without IT involvement. That democratization requires governance and guardrails.

These competencies go far beyond traditional CIO responsibilities. They lean toward behavior, judgment, and organizational change, the same strengths compliance brings to the table.

Emerging Executive Roles Around AI

The article documents the rapid rise of AI-focused executive roles such as Chief Innovation Officer, Chief AI Officer, and Chief Transformation Officer. Compensation is rising, hiring is accelerating, and responsibilities increasingly blend technology, ethics, culture, and strategy.

The authors highlight examples:

  • PepsiCo’s Chief Strategy and Transformation Officer is overseeing enterprise-wide digitization.
  • Standard Chartered’s Chief Transformation, Technology, and Operations Officer.
  • JPMorgan Chase’s governance model for IndexGPT and AI-driven investment analysis.

These roles share a common trait: they embed ethics, cultural change, and strategic alignment directly into AI governance. This direction should reassure compliance officers. Regulators have signaled that they expect AI oversight to be integrated, accountable, and verifiable. A dedicated AI leadership role can help unify these obligations.

AI Persona Management: The Next Frontier of Governance

One of the most intriguing sections of the article describes “AI persona management,” the oversight of digital agents with defined personalities, roles, and decision-making authority. As AI becomes more autonomous, these personas may behave like digital employees. That raises profound governance questions.

Compliance professionals should begin considering:

  • What decision rights will AI personas have?
  • How will we document their logic?
  • How will we audit their behavior?
  • How will we ensure ethical consistency across different personas?

The authors note that Salesforce already uses AI personas internally to guide product decisions. That should serve as a signal: AI agents are not a theoretical concept; they are entering the enterprise now. A compliance professional will need to treat AI personas with the same seriousness as human employees, subject to monitoring, training, policies, escalation channels, and accountability structures.

What This Means for Corporate Compliance Leaders

The article argues that companies must rethink how they manage technology change. AI’s impact is too broad to remain confined to the IT organization. Talent, culture, ethics, governance, and risk management all intersect. The authors present the CITO role as the logical solution for a leader who integrates technical fluency with organizational psychology and ethical judgment.

From a compliance standpoint, this represents both an opportunity and a responsibility. The opportunity is clear: compliance brings exactly the kind of cross-functional, ethics-driven perspective AI leadership requires. The compliance function knows how to document decisions, manage cultural change, develop defensible processes, and build controls around complex risks.

The responsibility is equally clear: AI will soon permeate every corner of the enterprise. If compliance does not assert its role in governance, the organization will drift toward risk. This article provides a roadmap for what strong governance must look like. It tells companies that AI success demands a leader capable of bridging technical, ethical, and cultural domains, the very domains compliance has long mastered.

Now is the moment for compliance to claim its seat at the AI leadership table, helping shape the systems that will define operational and ethical performance for years to come.

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – Doing Business (and Compliance) in India with Joseph Azam

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Joseph Azam discusses the panel at the event. Their presentation is entitled “On the Ground in India: Special Considerations for Compliance, Risk Management, and Third-Party Oversight—Practical Takeaways from Real-World Experiences.

Some of the issues the panel will discuss are:

  • Corruption risk specific to India.
  • Long-term strategies for effective due diligence in India and
  • Aligning global expectations with local realities.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots-on-the-ground experience encountering the high risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.

Categories
Blog

The SFO’s New Compliance Program Guidance: Compliance is a Verb

The Serious Fraud Office’s 2025 Guidance on Evaluating a Corporate Compliance Program is more than another regulatory document. It is a bright line in the sand. It says, with unmistakable clarity, that compliance must move beyond paper, policies, and PowerPoints. The era of check-the-box compliance is over. The SFO wants to know whether your program works, whether it is embedded, and whether it actually shapes employee behavior at the moment of risk.

For corporate compliance professionals, this should be welcome news. For years, I have advocated that compliance is effective only when it is operationalized, when it is woven into business processes, incentives, controls, communications, and culture. Indeed, it is the subtitle of my seminal work, The Compliance Handbook: A Guide to Operationalizing Your Compliance Program. The SFO has now said the quiet part out loud: if your program does not function in practice, it will not be credited, and it will not protect the organization in the moments that matter most.

The SFO Is Not Evaluating Paper. It Is Evaluating Performance.

The SFO identifies six scenarios in which it evaluates a company’s compliance program, including charging decisions, DPAs, monitorships, and statutory defenses under the Bribery Act and the ECCTA failure-to-prevent fraud offence. In each scenario, the question is the same: did the program work at the time of the misconduct, and does it work today?

The guidance explicitly flags that a company with an ineffective program at the time of the offence faces a public-interest factor in favor of prosecution. Conversely, proactive remediation and an already-effective program weigh against prosecution. This is a radical shift in emphasis. A policy framework will not suffice. A training slide deck will not suffice. A risk assessment performed once every three years will not suffice.

The SFO wants evidence of operational behavior:

  • Were approvals actually checked, or were they just required?
  • Were red flags escalated in practice, not just in policy?
  • Were third-party risks managed through real due diligence, not just questionnaires?
  • Did employees feel empowered to speak up?
  • Did managers respond appropriately when they did?

The guidance says it plainly: “A key feature of any compliance program is that it needs to be effective and not simply a ‘paper exercise.’” That sentence should be printed above every compliance officer’s door.

Adequate vs. Reasonable vs. Effective: The SFO’s Focus Is on Reality

The legal standards differ across regimes: “adequate procedures” for the Bribery Act and “reasonable procedures” for ECCTA failure to prevent fraud, but the SFO’s approach is consistent across all of them. The prosecutor will examine whether the program operated as designed. A beautifully written policy that sits untouched in a shared drive does nothing for your defense. Under both frameworks, the principles are clear:

  • Top-level commitment must be visible and sustained.
  • Tone-from-the-top is no longer a slogan. Executives must demonstrate operational ownership through resources, messaging, and decisions.
  • Risk assessments must be dynamic and documented.
  • Periodic reviews are insufficient. Companies must revisit risks as business models, markets, and products evolve.
  • Due diligence must be risk-based and enforced.
  • The SFO will look for evidence of follow-through: actual reviews, remediation steps, and periodic refreshes, not just questionnaires.
  • Training must reach the right people, at the right depth, at the right time.
  • If frontline staff cannot articulate how policies apply to real situations, the program is not embedded.
  • Monitoring and review must capture failures and lead to improvements.
  • The SFO expects companies to learn from investigations, whistleblowing incidents, and near misses.

These principles have one common trait: they require action, not intention. Indeed, it is clear that “compliance” is a verb.

How the SFO Looks Behind the Curtain

The SFO’s FAQs section is an important reality check. The agency describes its evaluation process as holistic, evidence-based, and focused on operational activity (pages 10–12). It will use every investigative tool at its disposal.

This includes:

  • voluntary disclosures
  • compelled document production under section 2
  • witness interviews
  • suspect interviews
  • direct questions to the organization

Why is this important? Because the SFO is not taking the company’s word for anything. Assertions are not evidence. The agency will “dig behind generalities and challenge high-level assertions” to determine whether policies translate into conduct. In other words, if the program only exists in policy language, the SFO will know and quickly.

DPAs and Monitorships: Operationalized Compliance Determines Outcomes

When considering whether a DPA is appropriate, the SFO again focuses on whether the program works in practice. A DPA is less likely if the program was ineffective at the time of the offence and has not substantially improved since. If the program failed but is now demonstrably effective, a DPA becomes more viable. If a monitorship is imposed, the SFO expects the monitor to advise on “necessary compliance improvements” that reduce future risk. This language reinforces a core message: compliance must be operational, measurable, and continuously improving.

For companies negotiating a DPA, this means a surge of paper policy updates is not persuasive. What prosecutors want to see is changed behavior, improved controls, and evidence that new measures are taking hold across the organization.

The Shift from Compliance as Documentation to Compliance as a Business System

The guidance mirrors a shift seen globally from the DOJ’s “three questions” to the French AFA’s operational guidance and places the United Kingdom in alignment with international enforcement trends.

Across regimes, regulators are converging on the same model:

  1. A well-designed program.
  2. Adequate resources and authority to operate.
  3. Proof that the program works in practice.

The SFO’s guidance aligns directly with this structure. For compliance officers, that means your influence must go beyond policy drafting. Compliance must embed itself into:

  • procurement workflows
  • HR processes
  • incentives and compensation frameworks
  • approval systems
  • financial controls
  • business-development oversight
  • investigation protocols
  • continuous monitoring and data analytics
  • leadership behavior
  • cultural reinforcement mechanisms

This is what it means to operationalize compliance. A check-the-box program may look good in a binder. But it will not protect the company from enforcement, reputational harm, or sentencing penalties. A program that works in practice. This means real controls, real accountability, real culture, and a real will to do so.

The Message for Compliance Leaders

The SFO is telling companies something essential: The risk is not that you have a compliance failure. The risk is that your compliance program cannot prevent one. Your company can withstand a failure. It cannot withstand a failure in a system that does not exist.

The guidance signals a new enforcement reality: companies that invest in operationalized compliance, which is truly embedded into how people work, will be treated differently, prosecuted differently, and negotiated with differently. For compliance leaders, the priority is clear. This is the moment to shift your program from aspirational to operational. Because when regulators ask whether your program works, the only answer that matters now is evidence.

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – From Value Protection to Value Creation with Rodrigo Cunha

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Rodrigo Cunha discusses his panel at the event, “Compliance in Motion: How to Retool Your Compliance Program for Speed, Flexibility, and Resilience to Meet the Demands of Today’s Rapidly Changing Risk Landscape.”

Some of the issues the panel will discuss are:

  • Why compliance needs to reinvent itself in 2026.
  • Moving at the speed of business, and
  • Improving compliance communications.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots on the ground, encountering the very risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.

Categories
AI Today in 5

AI Today in 5: November 21, 2025, The Who Audits Open AI Edition

Welcome to AI Today in 5, the newest edition of the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. Compliance grade AI. (BusinessWire)
  2. New compliance AI for investment managers. (Cision)
  3. Who audits OpenAI? (FT)
  4. Trump wants to ban all state AI regulation. (NBC)
  5. FinTech wants a united front against cybercrime. (ComputerWeekly)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Compliance Terms and Conditions

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice for navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

This week, we are reviewing the third-party risk management process. We conclude our look at the compliance terms and conditions you should include in your 3rd-party contracts.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Compliance and AI

Compliance and AI: Steph Holmes on the Intersection of AI and Compliance

What is the intersection of AI and compliance? What about Machine Learning? Are you using ChatGPT? These questions are just three of the many we will explore in this cutting-edge podcast series, Compliance and AI, hosted by Tom Fox, the award-winning Voice of Compliance. Today, Tom looks at the current Intersection of AI and Compliance with Steph Holmes, a long-time friend and Director, Ethics and Compliance Strategy at the EQS Group.

They discuss the evolving role of AI in corporate compliance, emphasizing its key role in modernizing compliance programs. Steph elaborates on the importance of evidence-based assessments of AI capabilities, the impact of AI on operational efficiency, and the need for human oversight in AI processes. She highlights EQS’s comprehensive AI performance test, which evaluated various AI models against multiple compliance tasks. The discussion also covers practical steps for compliance professionals to begin their AI adoption journey, as well as the necessity of continuous monitoring and risk-based evaluation to ensure effective AI deployment.

Key highlights:

  • Steph Holmes’ Role at EQS Group
  • AI in Compliance: Current Landscape
  • AI Performance Test Report
  • The Messy Middle of Compliance and AI
  • Human Oversight in AI Implementation

Resources:

Steph Holmes on LinkedIn

EQS Group LinkedIn

Where in the Loop: Corporate Compliance Insights

EQS Website

EQS Benchmark Report: AI Performance in Compliance & Ethics

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – Laura Perkins on Compliance as a Team Sport

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Laura Perkins discusses her workshop at the event, “Compliance as a Team Sport: A Comprehensive Guide to Building Smarter, Integrated, and Cross-Functional Compliance Programs.”

Some of the issues the panel will discuss are:

  • Integrating Compliance Functions;
  • Building a cross-functional compliance team;
  • Breaking down siloes.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots on the ground, encountering the very risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.