Categories
Compliance Tip of the Day

Compliance Tip of the Day – A Failure in Internal Controls

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

This week, we consider issues around internal controls in a best practices compliance program. Today, we consider how a single control override led to a catastrophic control failure and an FCPA enforcement action.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Life with GDPR

A Compliance Roadmap for ADS/ADMT – Part 1: Introduction & Jurisdiction

Welcome to a special series on Life with GDPR. Over the next five episodes, Tom Fox and Alyssa DeSimone, a legal/compliance & risk management expert with an extensive background in HR, will discuss the complex topic of a Compliance Roadmap for ADS/ADMT.

In this first episode, we break down the essentials of ADS/ADMT, focusing on who is covered, the nuances of jurisdiction, and the broader business implications of evolving employment laws. ADS is an automated decision system, and ADMT is an automated decision-making technology. Whether you are an HR professional, compliance professional, or legal eagle, this discussion will help you navigate the complexities of compliance in a changing legal landscape.

Key highlights:

  • What is ADS/ADMT?
  • Applies to 5+ employees (including part-time/out-of-state).
  • Coverage limits for out-of-state conduct.
  • Jurisdiction can reach beyond California.
  • Risk mitigation tips for businesses.

Resources:

Connect with Tom Fox

Connect with Alyssa DeSimone

Life with GDPR was recently honored as a Top Data Security Podcast

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Rev Rec, Internal Controls and Compliance

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

This week, we consider issues around internal controls in a best practices compliance program. Today, we consider the inter-relationship of revenue recognition, internal controls, and compliance.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Blog

Nights in White Compliance: Lessons from John Lodge and the Moody Blues for Today’s Compliance Professional

1, 2, 3, 4. While that sequence is well known, it is also one of the greatest rock n’ roll count-ins. It opens the John Lodge-written song “Ride My See Saw” by The Moody Blues. We lost John Lodge last week. The Moody Blues are in my top 5 bands of all time and were one of the leading lights of progressive (prog) rock.

According to his New York Times (NYT) obituary, John Lodge and Justin Hayward joined the band in 1966, replacing two founding members, Denny Laine and Clint Warwick. The classic Moody Blues lineup was now in place with Lodge and Hayward, with Mike Pinder on keyboards, Graeme Edge on drums, and Ray Thomas on flute and vocals.

It was their groundbreaking release of the 1967 album, “Days of Future Passed,” that changed rock n’ roll forever. It fused rock and orchestral music, establishing The Moody Blues as pioneers of progressive rock. It was one of the first rock albums to be structured as a concept album, telling a story over a 24-hour cycle. It propelled the band to international success, particularly through the enduring hit single “Nights in White Satin“. It offered elaborate arrangements, lush contributions from the London Festival Orchestra, and the plaintive sound of Mr. Pinder’s Mellotron, an electromechanical keyboard that plays samples of different instruments.

While the Moody Blues had hits for the rest of the century, it was their development of prog rock for which they will always be known. Today, I want to pay tribute to Lodge and explore five timeless lessons compliance professionals can learn from him and from The Moody Blues.

1. Innovation Begins When You Refuse to Accept the Status Quo

When Days of Future Passed was released in 1967, it was unlike anything listeners had ever heard. The Moody Blues combined rock instrumentation with full orchestral arrangements, creating a symphonic concept album that broke every rule of the time. Instead of focusing on singles or radio hits, they presented a continuous musical experience that told a story, a day in the life of ordinary people, elevated to art.

For compliance professionals, the lesson is clear: the most meaningful innovation happens when you refuse to accept “the way it’s always been.” Lodge and his bandmates didn’t abandon structure; they reimagined it. Likewise, modern compliance programs shouldn’t merely follow old templates. Whether it is integrating AI-driven monitoring, developing behavioral analytics, or crafting narrative-based training, progress comes from seeing beyond the checklist and daring to compose something new. In other words, the future of compliance is not mechanical; it is symphonic.

2. Harmony Requires Every Voice

The Moody Blues were more than the sum of their parts. Lodge’s melodic bass anchored Justin Hayward’s soaring vocals, Ray Thomas’s flute added ethereal texture, and Graeme Edge’s drumming provided both rhythm and poetry. Each member contributed a distinct voice, yet they blended perfectly into harmony.

A world-class compliance program operates the same way. No single person or department can carry the tune alone. Compliance requires a cross-functional orchestra; legal, HR, finance, audit, operations all playing from the same score. When departments act in isolation, the result is noise; when they work in harmony, it is music. Lodge’s approach to collaboration reminds us that leadership in compliance is not about conducting with authority but coordinating with empathy. The best Chief Compliance Officers listen as much as they lead.

3. Build Systems That Evolve

Progressive rock, by its very name, implies evolution, the willingness to progress. The Moody Blues constantly evolved their sound: from the baroque experimentation of On the Threshold of a Dream to the electronic textures of Long Distance Voyager. They did not stagnate; they adapted.

Compliance programs, too, must evolve with changing times. Regulations, markets, and technologies shift. What worked in 2015 may be obsolete in 2025. The DOJ’s 2024 Evaluation of Corporate Compliance Programs underscores this need for adaptability, requiring that programs be “dynamic, data-informed, and risk-based.” Lodge’s musical journey embodies that principle. He never let nostalgia stop innovation. Compliance officers should adopt the same mindset, continuously evaluating controls, integrating feedback, and embracing technology to remain relevant. Evolution, not inertia, sustains credibility.

4. Tell a Story That Inspires, Not Just Informs

The Moody Blues were not just musicians; they were storytellers. Songs like Nights in White SatinQuestion, and Isn’t Life Strange resonated because they connected emotionally. They did not lecture; instead, they invited listeners to reflect. Each album was an emotional arc, designed to make people feel, not just think.

That is precisely the challenge and opportunity for compliance communication. Too often, we rely on policies and PowerPoints that inform but fail to inspire. John Lodge understood that engagement requires narrative. Compliance professionals can learn from that: training should tell stories, not recite statutes. Whistleblower programs should humanize courage, not just codify reporting channels. Codes of conduct should speak to values, not just violations. In short, emotion drives ethics. Lodge showed us that communication, when done with authenticity, can change behavior. Compliance leaders should compose their messaging the same way musicians write songs: with heart, structure, and meaning.

5. Legacy Matters More Than Fame

Though The Moody Blues achieved global recognition, they never chased popularity at the expense of integrity. Their albums demanded patience and reflection,  qualities at odds with commercial radio. Yet their influence endures precisely because they valued substance over spectacle. Lodge once said he wanted to “create music that would last.” And it has.

For compliance professionals, this is the ultimate lesson: sustainability over visibility. A compliance program’s success is not measured by awards or press releases but by resilience, the quiet trust employees place in doing the right thing even when no one’s watching. Lodge’s passing reminds us that legacies are built note by note, day by day. In compliance, every investigation handled with fairness, every training delivered with clarity, every policy written with purpose, these are our symphonies. The work may seem routine, but over time, it becomes timeless.

Closing Reflections: From Melodies to Ethics

As we reflect on John Lodge’s contribution to music, we can see the deeper resonance for our own profession. Progressive rock does not simply entertain; it continues to expand what music could be. Likewise, compliance today is no longer a back-office function; rather, it is a driver of culture, innovation, and trust.

Both disciplines, music and compliance, strive for harmony amid complexity. Both require structure balanced with creativity. Both depend on collaboration, communication, and conviction.

So as we say goodbye to John Lodge, perhaps we can also rededicate ourselves to what he and The Moody Blues represented: the belief that art and ethics can elevate humanity. Because in the end, every great compliance program, like every great song, seeks the same outcome: to move people toward something better.

===============================================================

A special thanks to Alison Taylor, who many years ago named me the Rock’ N’ Roll Compliance Blogger. It is my favorite moniker of all time and one I still take seriously. 

Tom’s Top 5 John Lodge Songs (all links from YouTube)

  1. Ride My See Saw – Lodge said of the song, “It started, really, like a lot of my rock ‘n’ roll songs, as a rhythm track building up. “I wanted it to be this chorale, where we’re all singing these harmonies through the song — it’s interesting that way,” he added.
  2. I’m Just a Singer (in a rock n roll band)- Lodge retook the lead for this Top 20 track, the last single of the Moody Blues’ first phase. Lodge’s message was world peace through music, singing that “I’m just a-wandering on the face of this earth/Meeting so many people who are trying to be free…Now we’ve found the key.” The song marked the last time the group used a Mellotron, which was one of its sonic hallmarks, while the saxophone sound came from a Chamberlin keyboard.
  3. (Evening) Time to Get Away – Lodge made his prog rock mark on the group’s thematic masterwork first with “Lunch Break: Peak Hour” but more memorable with the airy “(Evening) Time to Get Away),” part of “The Afternoon” suite that kicked off side two in tandem with Hayward’s “Forever Afternoon (Tuesday?).”
  4. Natural Avenue – Part of the album Lodge and Hayward made together during the Moodys’ hiatus, this kicked off the second side of the album with symphonic bombast. Its theme, established in the title, maintained Lodge’s heartfelt belief in the divine (spiritually more than religiously) power of music.
  5. Gemini Dream – This song emerged from a jam session built from a dance-floor targeted beat, with Lodge’s chugging bass pushing the groove. Lodge’s original title, by the way, was “Touring in the USA,” while Hayward came up with “Backstage Pass;” they settled on “Gemini Dream” as a representation of their dual personalities. It received an ASCAP songwriting award for the track, which reached its No. 12 peak as the Moody’s best for a new song in eight years.

Resources:

Top 10 John Lodge Songs

Categories
FCPA Compliance Report

FCPA Compliance Report – From the Courtroom to Compliance: FCPA Challenges and Strategies with James Koukios

Join Tom Fox as he welcomes back MoFo partner James M. Koukios to discuss the themes and strategies observed in recent FCPA trials and the DOJ’s prosecutorial approach. They explore the importance of making juries care about corruption cases, the themes of abuse of power and financial motive, and the significance of concealment in establishing guilt. The conversation also touches on the future of FCPA trials and the DOJ’s commitment to prosecuting individuals involved in corporate misconduct. And of course, Go Blue!

Key highlights:

  • Making juries care about the impact of corruption is crucial.
  • Abuse of power is a central theme in corruption cases.
  • Concealment of actions indicates consciousness of guilt.
  • Compliance programs must emphasize transparency and documentation.
  • Jurors expect good governance and are sensitive to abuse of power.
  • Financial incentives in corporations should align with compliance.
  • Prosecuting individuals remains a priority for the DOJ.

Resources:

Morrison Foerster

James Koukios

Expect DOJ To Repeat 4 Themes From 2024’s FCPA Trials

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

Categories
AI Today in 5

AI Today in 5: October 10, 2025, The Romantic AI Edition

Welcome to AI Today in 5, the newest edition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI, so start your day, sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5, all from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest related to AI.

Top AI stories include:

  1. How does AI think? (WSJ)
  2. Can you trust your eyes anymore? (NYT)
  3. 20% of high schoolers have romantic relationships with AI. (NPR)
  4. Saunders says AI will cost 100MM jobs. (Yahoo!News)
  5. Data quality and AI. (Global Newswire)
Categories
Compliance Tip of the Day

Compliance Tip of the Day – Compliance Lessons from Wells Fargo’s AI-Assisted Whistleblower Program

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we conclude our look at how companies are using AI in their business operations and draw compliance lessons from this use for compliance professionals. Today, we continue with compliance lessons from Wells Fargo’s development of an AI-assisted tool to help in the triage of whistleblower complaints.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Blog

Compliance Lessons from Bela Lugosi’s Dracula

As many of my readers know, I am a huge fan of the Classic Universal Picture Movie Monsters, focusing on the period from 1931 to the mid-1950s. In October, I traditionally use our Halloween-ending month to explore the Classic Universal Movie Monsters, along with other films from the Hammer Studio, those produced by Val Lewton, and those starring Vincent Price.  This year, I wanted to go back to basics by looking at the Classic Universal Movie Monsters, starting with Dracula and Frankenstein in 1931, followed by The Invisible Man in 1933, The Mummy in 1936, and ending with The Wolf Man in 1940.

Over the next five weeks, I will examine each of these movies through the lens of compliance and extract compliance lessons from each one. Today, I continue with the Classic Universal Movie Monster, Bela Lugosi’s version of Dracula. If you want to take a deeper dive into this movie in the podcast format, check out the special series on Popcorn and Compliance, hosted by my friends Fiona and Timothy. These podcasts will be posted alongside the blog post each Friday during October.

When Bela Lugosi first spoke the words, “I am Dracula,” in Tod Browning’s 1931 classic, audiences were mesmerized. His piercing stare, deliberate speech, and aristocratic charm redefined horror cinema. But beneath the gothic atmosphere lies something compliance professionals know all too well: the dangers of deception, unchecked power, and the failure to recognize risk until it’s too late.

The Lugosi Dracula is not just a horror film; instead, think of it as a parable of compliance. The Count operates as a smooth-talking third-party who gains access, conceals his true motives, and ultimately causes destruction when left unmonitored. For the corporate compliance professional, there are striking lessons in risk management, due diligence, and the importance of cultural awareness.

We continue our look at the Classic Universal Monster Movies by reviewing five key compliance lessons from the Lugosi Dracula.

1. Third Parties Are Your Greatest Risk

Dracula does not walk into London as a monster. He enters as an exotic nobleman, charming, well-spoken, and seemingly trustworthy. The people around him take him at face value. Only too late do they discover the truth: he is feeding off their lifeblood. This is the archetype of third-party risk. Business partners, agents, or distributors may present themselves as polished and reputable, but without thorough due diligence, they can bring immense legal and reputational risk.

Compliance takeaway: Treat every third-party relationship as a potential source of risk. Conduct due diligence, monitor relationships, and never rely solely on surface-level reputation. A charming exterior may conceal dangerous intentions.

2. Beware the Power of Influence

One of Lugosi’s most memorable traits is his hypnotic gaze. With it, he bends others to his will: Renfield, Mina, and Lucy, as each falls victim not by force, but by subtle manipulation. In the compliance world, influence is often exerted by powerful executives, dominant cultures, or high-performing employees. When individuals exercise undue influence, they can pressure others to bend the rules, ignore red flags, or accept unethical behavior as usual.

Compliance takeaway: Compliance officers must watch for undue influence in corporate cultures. Strong tone from the top matters, but so does tone in the middle. Employees must feel empowered to resist pressure, report concerns, and recognize when influence becomes coercion.

3. Risk Hides in the Shadows

Much of the horror in Dracula comes not from what is seen, but from what lurks in the shadows. The Count moves by night, unseen, exploiting darkness to conceal his actions. By the time victims realize what has happened, the damage is already done. This resonates with how misconduct often operates in organizations. Corruption, fraud, and abuse typically occur out of sight, through falsified invoices, shell companies, or hidden payments. By the time regulators or auditors arrive, the harm is already inflicted.

Compliance takeaway: Continuous monitoring and data analytics are the compliance professional’s tools for shining light into the shadows. Proactive detection: real-time alerts, AI-driven monitoring, and transactional reviews help catch misconduct before it metastasizes.

4. Cultural Blindness Increases Vulnerability

One of the early warnings comes from the locals in Transylvania, who beg Jonathan Harker not to go to Dracula’s castle. They know the legends, they understand the risks, and they offer charms for protection. Yet he dismisses them as superstition. This is a classic case of ignoring cultural risk signals. In multinational operations, compliance failures often occur when the headquarters dismisses local knowledge, customs, or warnings. By failing to respect the insights of those closest to the risk, organizations make themselves vulnerable.

Compliance takeaway: Listen to local voices. Local compliance officers, employees, and partners often see risks first. A compliance program that ignores or downplays its input is doomed to fail. Respecting cultural context is essential for effective risk management.

5. Complacency Enables Catastrophe

Finally, one of the key reasons Dracula thrives in London is that no one believes such evil could exist among them. Van Helsing recognizes the threat, but others mock him or rationalize the strange events. Denial and complacency give Dracula the space to flourish. In corporate compliance, complacency is equally dangerous. When companies assume “it can’t happen here,” they let their guard down. When managers dismiss warning signs as anomalies, they enable misconduct to spread. Complacency is the enemy of effective compliance.

Compliance takeaway: Compliance professionals must cultivate vigilance. Risk assessments should be ongoing, investigations must be taken seriously, and whistleblower reports must never be ignored. The moment an organization believes it is immune, it becomes most vulnerable.

Conclusion: Dracula in the Boardroom

Bela Lugosi’s Dracula is remembered for its elegance and terror. But for compliance officers, it offers something more: a reminder that risk often comes disguised as opportunity, that influence can corrupt, that danger thrives in shadows, that cultural insights matter, and that complacency kills.

Just as Van Helsing armed himself with crucifixes, garlic, and sunlight, compliance professionals must arm their organizations with due diligence, monitoring, cultural awareness, and vigilance. The Lugosi Dracula teaches us that evil is not always obvious; rather, it often comes in a tuxedo, with a charming smile and a foreign accent, promising value while draining the lifeblood of those who trust too easily.

The compliance professional’s mission is clear: don’t let Dracula through the door without asking the hard questions, shining the light into dark places, and ensuring that your organization is prepared for what lurks in the night.

Join us next Friday as we jump to 1940 and consider compliance lessons from Lon Chaney Jr.’s The Wolf Man.

Categories
Life with GDPR

Life With GDPR – Endpoint Security and Data Protection: Uncovering the Hidden Compliance Risks in Printer Security with Jim LaRoe

Jonathan Armstrong remains on assignment. Today, Tom Fox visits with fellow Texan Jim LaRoe, CEO of Symphion, to discuss data privacy, data protection, and compliance related to printer security in one of the most interesting podcasts Tom has done in some time.

Jim provides insight into how 20-30% of network endpoints are printers, and alarmingly, 99% of these are unprotected. Printers, despite being integral to business functions, are typically left vulnerable, making them prime targets for sophisticated phishing and cyber-attacks. Jim shares his journey from a trial lawyer to founding Symphion in 1999 and explains Symphion’s groundbreaking work in developing comprehensive security software for printers. Jim highlights the importance of a culture of compliance in managing endpoint security and the multifaceted challenges that come with securing printers.  He emphasizes the collaborative effort needed among GRC compliance teams, IT, and supply chain departments to manage printer security effectively, and offers actionable steps for businesses to mitigate these risks.

Key takeaways:

  • The Hidden Risk of Printers
  • Understanding Endpoint Security
  • Challenges in Printer Security
  • Risk Management Strategies
  • Supply Chain Vulnerabilities

Resources:

Connect with Tom Fox

Connect with Jim LaRoe

Connect with Symphion

The award-winning Life with GDPR was recently honored as a Top Data Security Podcast. This was a sponsored podcast.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Compliance Lessons from Citibank’s AML Program

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

This week, we continue our look at how companies are using AI in their business operations and draw compliance lessons from this use for compliance professionals. Today, we continue with compliance lessons from Citibank’s development of a worldwide AML tool.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.