Tag: compliance

Categories
Blog

The Culture Builder’s Trilogy: Part 1 – The Art of Ideation: Compliance Begins with Better Questions

Ed. Note: over the next three blog posts, I will be running a short series on three recent books by Hemma Lomax and Ashley Dubriwny. There are The Art of Ideation, The Art of Celebration, and The Art of Implementation.

Hemma Lomax and Ashley Dubriwny’s The Art of Ideation is, on one level, a practical guide for culture builders. On another level, it is a challenge to compliance professionals: stop treating compliance as a function that merely publishes rules, delivers training, and waits for reports. Start treating compliance as a discipline of curiosity, engagement, design, and shared intelligence.

The book begins with a simple but powerful premise. Culture builders need ideas, but more importantly, they need the skill to generate better ideas through peer ideation, storytelling, and crowdsourcing intelligence. Lomax and Dubriwny describe the spark that came from compliance professionals exchanging creative approaches at a conference table and then ask why that energy should be limited to a once-a-year event. Their answer is to make ideation intentional, repeatable, and community-based.

For compliance professionals, this is not a soft concept. It goes directly to the DOJ’s Evaluation of Corporate Compliance Programs (ECCP). The ECCP continues to ask whether a program is well-designed, adequately resourced, empowered to function effectively, and working in practice. The compliance lesson from The Art of Ideation is clear: a program that does not ask better questions will not get better answers.

Lesson One: Know Your Audience Before You Design the Control

One of the book’s strongest lessons comes from the São Paulo story. Hemma arrives in Brazil to speak to more than 200 sales executives. Rather than deliver a generic compliance presentation, she uses images and experiences from the city itself to connect with the local audience. The lesson is not simply that visuals work. The deeper lesson is that compliance must demonstrate cultural awareness before it asks for behavioral change.

Too many compliance programs are still designed from the top down. Policies are written in legal language. Training is translated late, if at all. Hotline posters are posted in areas where employees do not work. Codes of Conduct speak to an imagined employee rather than the actual workforce.

The ECCP lens is unforgiving here. A risk-based program must be tailored to the company’s risk profile, business model, workforce, geography, and operations. If field employees, sales teams, or third-party-facing personnel cannot access guidance in the moment of need, the control may exist on paper but fail in practice.

Lesson Two: Storytelling Is a Control Enhancement

Dubriwny’s discussion of training emphasizes that facts alone rarely change behavior. Stories create context, emotion, and recall. In compliance, that matters because most misconduct does not arise from someone misunderstanding a policy title. It arises in moments of pressure, ambiguity, fear, loyalty, or perceived business necessity. A good compliance story can show what a conflict of interest feels like. It can show why a facilitation payment creates risk. It can show how retaliation begins quietly. It can show a manager what it means to receive a concern well.

This is especially important for a culture of speaking up. Employees do not speak up because a poster says they can. They speak up because they believe the organization will listen, protect them, and act. The Art of Ideation repeatedly returns to the need to meet people where they are, involve them, and design engagement pathways that feel safe. That maps directly onto the ECCP’s focus on confidential reporting, anti-retaliation, and investigation processes, as well as employees’ trust in those systems.

Lesson Three: The Code of Conduct Should Be Designed to Work

The book’s chapter on Codes of Conduct is especially useful for CCOs. It asks whether the Code is an external artifact, a regulatory box-checking document, or a decision-making tool for employees. The answer should be all the above, but the priority must be the employee user. That is a powerful compliance point. A code should not merely state values. It should operationalize them. It should be accessible, visually clear, mobile-friendly, translated appropriately, and supported by examples that reflect real roles, geographies, and pressures. The authors argue that a Code should be co-created, tested, and designed so people can see themselves in it.

This has implications for internal controls. A policy no one reads is not a meaningful control. A code no one uses is not a cultural anchor. A decision tree that helps an employee escalate a third-party red flag is more valuable than a beautifully written paragraph no one remembers.

Lesson Four: Crowdsourcing Risk Intelligence Is Compliance Modernization

Perhaps the most compliance-relevant section of the book is the discussion of crowdsourcing intelligence. Lomax and Dubriwny argue that leadership does not have a monopoly on the perspectives needed to identify risk. Employees across functions, geographies, and levels see vulnerabilities long before they appear in formal reporting channels. This is exactly where modern compliance must go. Annual risk assessments remain useful, but they are not enough on their own. A CCO needs real-time, near-real-time, and frontline input. This includes surveys, focus groups, collaboration tools, investigation themes, hotline trends, third-party feedback, and data analytics.

AI governance fits here as well. The book encourages responsible experimentation with AI, including using AI to make policies more accessible, generate first drafts, synthesize information, and provide decision-useful guidance. In compliance terms, AI should not be a gimmick. It should be governed, risk-assessed, monitored, and used to improve the employee experience.

Compliance Application

For the compliance professional, ideation is not brainstorming for its own sake. It is how the CCO identifies gaps, improves controls, tests training, strengthens speak-up systems, modernizes the Code, and uses AI responsibly. It is how compliance moves from headquarters’ assumptions to operational intelligence.

The lesson is also relevant to investigations. The book’s discussion of investigations emphasizes empathy, transparency, gratitude toward participants, and learning from the process. That is an important reminder that investigations are not simply fact-finding exercises. There are moments when employees decide whether the compliance function is credible.

CCO Questions

  • Does our compliance function know how employees actually experience our Code, training, reporting channels, investigation process, and third-party controls?
  • Are we using peer ideation, frontline feedback, and cross-functional input to improve the program?
  • Where are we still relying on headquarters assumptions rather than operational evidence?
  • How are we using AI to improve accessibility, consistency, risk sensing, and employee guidance without weakening confidentiality, privacy, or human judgment?

Practical Takeaways

  1. Redesign one compliance communication from the user’s perspective. Make it shorter, clearer, more accessible, and easier to act on.
  2. Create an ideation circle around one major compliance risk, such as third-party due diligence, gifts and entertainment, speaking up, or AI use.
  3. Test your Code of Conduct with employees from different geographies and functions before the next refresh.
  4. Add crowdsourced risk intelligence to your risk assessment process.
  5. Treat ideation as a compliance control. Better questions produce better evidence, and better evidence produces a more effective program.

Ideation is where the compliance professional begins to see what is possible. It gives the CCO better questions, stronger engagement, richer risk intelligence, and a more human understanding of how employees experience the program. But ideas alone do not create culture. A redesigned code, a better speak-up message, a sharper AI policy, or a new third-party risk insight only matters if it moves from concept to practice. That is where the second book in the trilogy, The Art of Implementation, takes us next.

Join us tomorrow in Part 2, where we will examine how compliance professionals turn good ideas into operating discipline through alignment, stakeholder ownership, pre-mortems, adoption, incentives, and the hard work of making values real inside the business.

Categories
Blog

The Compliance Handbook, 7th Edition

As the Compliance Evangelist, I am pleased to announce the release of The Compliance Handbook, Seventh Edition. I believe it is the best single-author handbook for compliance professionals and about compliance professionals. Beautifully packaged, edited, and published by the country’s top legal and compliance publisher, LexisNexis.

This edition is an update of the Compliance Handbook, 7th edition. The handbook is a must-read for all ethics and compliance professionals. The Seventh Edition provides practical, helpful solutions to important ethics and compliance issues. It is comprehensive, accessible, and a must-have for every ethics and compliance professional.

As noted, I have teamed up with the country’s top legal and compliance publisher, LexisNexis Legal & Professional, to add to its winning series of compliance offerings. The Compliance Handbook, 7th edition, provides seasoned compliance professionals and those new to the profession with practical, actionable guidance and tools to design, implement, and continually enhance a best-practices compliance program. Why the need for this update?

Noted compliance maven Karen Moore said in the book’s foreword.

There is an increasing awareness that compliance and ethics stand at a unique crossroads—the intersection of human behavior and decision-making and of corporate identity, purpose, and mission. We operate at all levels of the organization: we satisfy the board, seek to understand strategy in the C-suite, engage middle managers, and stay relevant to the factory floor and frontline workers. We reconcile the need to defend the enterprise with the need to believe in its individuals. All that, within an increasingly complex landscape of shifting regulations, emerging risk areas, and geopolitical instability.

The Compliance Handbook, 7th edition, provides an in-depth look at the latest thinking and trends for the full range of critical compliance topics, including:

  • Compliance and business ventures;
  • Third-party risk management
  • The Board’s Role in Compliance
  • Continuous improvement;
  • Compliance innovation; and
  • And much more.

The Compliance Handbook, 7th edition, also takes a close look at the roles of all professionals with compliance responsibility, from Compliance Officers and Boards of Directors to Human Resources, Internal Audit and Internal Controls, and Communications and Training professionals. Understanding compliance responsibilities across the organization remains a key theme for both the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC). In this 6th edition, I expand on the concepts articulated in previous editions for operationalizing your compliance program.

What’s new for the 7th edition?

  • Key compliance enforcement actions, DOJ pronouncements, and all things compliance from 2025;
  • The revised section on the use of AI in a best practices compliance program.
  • The significant revisions to the chapter on data analytics, and
  • Looking forward to compliance in 2030 and beyond.

The Compliance Handbook, 7th edition, incorporates the most current government pronouncements governing best practices compliance programs, including the 2024 Evaluation of Corporate Compliance Programs; the new DOJ whistleblower initiative; ideas on innovation in compliance training, data, and its use in improving and maintaining corporate culture; the continued evolution of AI in compliance; and much more.

The Compliance Handbook, 7th edition, is available in both print and eBook editions.  Visit the LexisNexis® Store at https://lexisnexis.com/fox20

To save 20% on The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, please use the promotion code FOX20.

Offer expires December 31, 2026. The offer applies to new orders only, before shipping and taxes are calculated, and shipped to a U.S. address. Discount will be applied to each applicable product after code FOX20 is entered.

Categories
GSK in China: 13 Years Later

GSK In China: 13 Years Later – Compliance Lessons Learned

Thirteen years after the GSK China scandal exploded onto the global stage, its lessons remain as urgent as ever for compliance professionals and business leaders. In this podcast series, we revisit the case not simply as corporate history, but as a living cautionary tale about culture, incentives, third parties, investigations, and governance. Each episode explores what went wrong, why it went wrong, and how those failures still echo in today’s compliance and ethics landscape. Join me as we unpack the scandal and draw practical lessons for building stronger, more resilient organizations. In this episode, we dissect corporate compliance lessons from GSK’s corruption scandal in China and consider GSK’s flawed response to anonymous whistleblower reports, the “Inspector Clouseau imitation,” and situate it against an earlier whistleblower case.

The discussion explains how bribery was operationalized through a targeted Botox marketing plan (“Vasili”) and the use of travel agencies as cash conduits via fake conferences and why frequent internal audits and PwC still missed it due to financial-audit “materiality” standards, which are set at zero under the FCPA. It outlines needed controls such as proper approval level, legitimate business purpose, enforcement, and preventive design; warns about siloed “functional trap” risk management; critiques “Olympian pronouncements” undermined by “tone in the middle” and unofficial messaging; and distinguishes auditing from real-time monitoring, including relationship-monitoring software that flags anomalous communication patterns, raising a final question about preventing corruption without creating a surveillance state.

Key highlights:

  • GSK China Scandal Setup
  • Why Investigations Fail
  • Travel Agencies as ATMs
  • Auditing Materiality Trap
  • Unofficial Messaging
  • Monitoring vs Auditing

Resources:

GSK in China: A Game Changer for Compliance on ⁠Amazon.com⁠

GSK in China: Anti-Bribery Enforcement Goes Global on ⁠Amazon.com⁠

Tom Fox

⁠Instagram⁠

⁠Facebook⁠

⁠YouTube⁠

⁠Twitter⁠

⁠LinkedIn

Ed. Note: the voices of the hosts, Timothy and Fiona, were created by Notebook LM based upon text written by Tom Fox

Categories
Blog

The Warner Bros. Bidding War: Part 3 – The CCO Playbook for Transactions Under Pressure

The Warner Bros. Bidding War: Part 3 – The CCO Playbook for Transactions Under Pressure

The Warner Bros. (WBD) bidding war is not simply a Board story. It is a compliance operating model test. When a superior proposal emerges, the Chief Compliance Officer (CCO) must move from program design to execution discipline. Today, we conclude our short review of the Warner Bros./Netflix/Paramount dance and sale by considering lessons for the compliance professional.

In Part 1, we focused on the deal mechanics that led Warner Bros. Discovery to move from an agreed transaction with Netflix to a superior proposal from Paramount Skydance. In Part 2, the focus shifted to Board governance and fiduciary duty. This final post, Post 3, answers the operational question. What must the Chief Compliance Officer do when the process accelerates and governance must be proven in real time?

The answer is grounded in the DOJ’s Evaluation of Corporate Compliance Programs (ECCP). The core question remains constant. Is the program working in practice? A live transaction provides the answer.

Move Compliance Into the Transaction Control Room

Too many compliance functions treat M&A as a legal and financial activity. That approach fails when the transaction becomes contested. Once a superior proposal is identified, the compliance function must:

  • Participate in transaction governance meetings
  • Map control risks across disclosure, communications, and decision-making
  • Establish escalation pathways for new information

This is consistent with the expectations embedded in the DOJ’s Corporate Enforcement Policy, which rewards companies that demonstrate real-time awareness, escalation, and action. A compliance function that is not present during the decision-making process cannot later demonstrate that controls were effective.

Build and Execute an Evidence Protocol

The most significant compliance failure point in transactions is not misconduct. It is the absence of a reliable evidentiary record. In the WBD process, multiple streams of information were created simultaneously:

  • Board materials
  • Banker communications
  • Draft proposals and revisions
  • Internal analyses and emails

The CCO must ensure that the company has an evidence-based protocol that includes:

  • Centralized collection of transaction-related materials
  • Defined custodians for document integrity
  • Time-stamped records of key decisions and communications

Under the DOJ’s framework, this directly ties to the question of whether the company can demonstrate effectiveness through data and documentation. If the company cannot reconstruct its decision-making process, it cannot defend it.

Treat Disclosure Controls as a Real-Time Compliance System

Post 2 emphasized that disclosure is a governance issue. For the CCO, it is a control system. The compliance function should validate that:

  • The disclosure committee is activated and functioning continuously
  • There is a clear trigger matrix for Form 8-K filings and proxy updates
  • All external communications are coordinated and controlled

This is not theoretical. In a contested transaction, the volume and speed of information create a risk of selective disclosure, inconsistent messaging, or delayed filings. The CCO must ensure that disclosure controls meet the same standard as financial controls. They must be tested, documented, and operational.

Control Third-Party and Advisor Risk

Transactions introduce intense third-party engagement. Investment banks, legal advisors, consultants, and communications firms all operate at speed. In the WBD scenario, third-party actions included:

  • Structuring revised proposals
  • Communicating deal terms
  • Interacting with market participants

The CCO must ensure:

  • Clear protocols for third-party communications
  • Defined boundaries on who can speak on behalf of the company
  • Documentation of all material third-party interactions

This aligns with long-standing expectations under the Foreign Corrupt Practices Act (FCPA) and the broader third-party risk principles embedded in compliance programs. Even in a domestic transaction, third-party risk remains a control issue.

Align Governance With Internal Controls Frameworks

The events described in Parts 1 and 2 map directly onto internal control frameworks such as the COSO Internal Controls Framework. For the CCO, this means:

  • Control Environment: Tone at the top regarding disciplined decision-making
  • Risk Assessment: Identification of disclosure, litigation, and regulatory risks
  • Control Activities: Implementation of approval processes and documentation protocols
  • Information and Communication: Real-time disclosure and coordination
  • Monitoring: Ongoing review of transaction-related controls

This mapping is not academic. It is how the company demonstrates that governance is structured, repeatable, and effective.

Prepare for Day Two Risk

The transaction does not end with signing or closing. It creates a new risk profile. The CCO must plan for:

  • Integration of compliance programs across entities
  • Review of legacy decisions made during the transaction process
  • Preservation of records for litigation or regulatory review

This is where the DOJ’s focus on continuous improvement becomes critical. The company must show that it learns from the transaction and strengthens its program.

Connecting the Lessons Across the Series

Part 1 showed that deal terms, including termination fees and superior proposal mechanics, can change outcomes. Part 2 demonstrated that the Board must govern those changes through documented, disciplined processes. In Part 3, we demonstrated the connections between the two. The compliance function is the mechanism that allows the company to prove that governance worked. Without compliance execution, governance is an assertion. With compliance execution, governance becomes evidence.

Practical Action Steps for CCOs

  1. Embed compliance into the transaction governance structure at the outset of any deal.
  2. Implement an evidence protocol that captures all material transaction activity in real time.
  3. Test disclosure controls under accelerated conditions, including mock 8-K scenarios.
  4. Define and enforce third-party communication protocols.
  5. Map transaction governance to COSO and DOJ ECCP requirements before a contested situation arises.

Questions for the CCO

  1. If a regulator requested the full decision record tomorrow, could the company produce it?
  2. Are disclosure controls capable of operating continuously under transaction pressure?
  3. Is there a single source of truth for transaction-related documentation?
  4. Are third-party interactions fully documented and controlled?
  5. Has the compliance program been stress-tested in a high-speed governance scenario?

Final Thoughts

The Warner Bros. Discovery bidding war is not unique. What is unique is how clearly it illustrates the modern role of the Chief Compliance Officer. Compliance is no longer limited to preventing misconduct. It is responsible for enabling the company to act, decide, and disclose with integrity under pressure and then prove it. That is the standard set by the DOJ. That is the expectation of Boards. And that is the future of the compliance profession.

 

Categories
AI Today in 5

AI Today in 5: May 6, 2026, The Religious Objections to AI Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider five stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. Religious objections to AI coming. (HR Dive)
  2. AI healthcare frameworks will become as standard as HIPAA. (Healthcare IT News)
  3. AI is coming to AML compliance. (FinTechGlobal)
  4. Roomba returns with AI. (AP)
  5. AI and shadow crypto markets. (Bloomberg)

For more information on the use of AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on Amazon.com.

Categories
Great Women in Compliance

Great Women in Compliance: DOJ’s New Fraud Division: Practical Insights for Compliance Professionals

In this episode, Lisa and Ellen speak with Leigha Simonton and Jennifer Beidel, former prosecutors and now partners at Dykema Gossett. They discuss the changes in the U.S. Department of Justice, focusing on the National Fraud Enforcement Division and shifts in enforcement priorities.

They discuss the spotlight on fraud involving federal funds, especially in healthcare, PPP loans, and other government programs. They discuss the new structure of the criminal fraud division and how that may change the government’s approach to prosecuting cases. At the same time, they also note that many experienced prosecutors and agents have left the DOJ, creating a gap between stated priorities and capacity and expertise.

Leigha and Jennifer also provide practical guidance for ethics and compliance professionals. They confirm that a risk assessment is critical and that any company that received federal funds, such as PPP loans, should remain vigilant for possible exposure under the current enforcement trends.

Even with these changes, they reiterate that effective, well-tested compliance programs do matter if the U.S. government is considering (or engaging in) prosecution. A proactive program—not the tick-the-box type—demonstrates implementation and remediation, increasing the likelihood of a declination.

This is a great episode for those of us trying to understand the US DOJ’s current enforcement landscape amid uncertainty.

Categories
Blog

The Warner Bros. Bidding War: Part 2 – Board Governance Under Pressure

When a superior proposal emerges, the Board is no longer evaluating strategy. It is proving governance. The Warner Bros. transaction shows how fiduciary duty, disclosure discipline, and control execution must function in real time. We are exploring Warner Bros./Netflix/Paramount’s bidding and purchase processes for lessons for the compliance professional. In Part 1, we focused on what happened. This post focuses on how the Board must respond when events accelerate.

The process moved from a negotiated transaction with Netflix to a contested situation with a rival bidder, Paramount. At that moment, the Board’s role shifted from approving a deal to managing an auction under fiduciary duty. This is the precise moment contemplated by Delaware fiduciary law and the Board oversight obligations often framed through the lens of Caremark duties. The question is no longer whether the Board can approve a transaction. The question becomes whether the Board can demonstrate that it acted on an informed basis, in good faith, and in the best interests of shareholders. That is not a conclusion. It is a record.

Waiver Discipline and the Fiduciary Record

In a live bidding environment, the Board will be asked to consider waiving contractual provisions, including standstill agreements, exclusivity clauses, and information-sharing restrictions. The governance risk is not the waiver itself. The governance risk is undocumented decision-making. A Board must ensure that every waiver is:

  • Reduced to writing with a defined scope and duration
  • Reviewed by counsel with a clear statement of fiduciary rationale
  • Reflected in contemporaneous Board minutes that explain why the waiver was necessary

Under the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) framework, the question is whether the company can demonstrate that its processes work in practice. A waiver without documentation is indistinguishable from a control failure.

Termination Fees as Board-Level Risk

The WBD transaction turned the $2.8 billion termination fee into a live issue. When Paramount agreed to fund the fee, the Board had to evaluate more than price. It had to evaluate:

  • Who ultimately bears the economic and legal risk
  • Whether the funding mechanism introduces new contingencies
  • How the arrangement should be disclosed to shareholders

Termination fees are often treated as deal protections. In a contested process, they serve as mechanisms for risk allocation. That places them squarely within Board oversight. A Board that does not interrogate the assumptions behind a termination fee, including third-party assumptions, is not exercising informed judgment.

Real-Time Disclosure Controls

Disclosure obligations in a transaction are not periodic. They are continuous. Once a superior proposal is identified, the company must:

  • Update proxy materials where required
  • Ensure that all material information is disclosed without selective leakage
  • Align communications across legal, investor relations, and management

The governance challenge is that information moves faster than process. Emails, banker discussions, draft proposals, and internal analyses all become part of the evidentiary record. Boards must ask whether the company has a real-time disclosure protocol. This includes:

  • A defined disclosure committee process
  • A single point of accountability for filings such as Form 8-K
  • Controls over who can communicate with external stakeholders

This is where governance intersects directly with compliance. Disclosure failures are not merely technical. They can trigger enforcement exposure.

The 8-K and Proxy Playbook

In a fast-moving transaction, the company does not have the luxury of drafting disclosures from scratch. A Board should expect management to have a predefined playbook that includes the following:

  • Trigger thresholds for filing obligations
  • Pre-approved disclosure templates for common scenarios
  • A documented approval chain involving legal, finance, and executive leadership

The absence of such a playbook creates a delay. Delay creates inconsistency. Inconsistency creates risk. From a COSO internal control perspective, this is a failure in control activities and information and communication. From a DOJ perspective, it is evidence that the program is not operationalized.

Regulatory Readiness and Remedy Planning

Both competing transactions carried regulatory risk. The difference was how that risk was allocated and mitigated. A Board must understand the following:

  • The regulatory approval pathways
  • The likelihood of a challenge
  • The remedies available if regulators object

More importantly, the Board must ensure that management has pre-developed the following:

  • Divestiture scenarios
  • Behavioral remedies
  • Escrow or holdback mechanisms tied to regulatory outcomes

This is not theoretical planning. It is part of the decision to determine which proposal is superior. A Board that does not understand regulatory risk is not fully evaluating the transaction’s value.

Post-Termination Control and Evidence Custody

When WBD terminated the agreement with Netflix, the transaction did not end. It transitioned into a new phase of risk. The company must:

  • Ensure proper handling of confidential information shared during the termination process
  • Preserve all records relevant to the decision-making process
  • Maintain audit trails for potential litigation or regulatory review

This is where evidence discipline becomes critical. The record must be complete, organized, and defensible. In the absence of such controls, the company risks being unable to demonstrate how decisions were made.

Why This Matters for Boards

The WBD process illustrates that governance is tested when conditions change rapidly. A Board cannot build governance in the middle of a transaction. It must already exist. The DOJ and SEC will not evaluate the Board based on the outcome. They will evaluate the Board based on the effectiveness of its processes, documentation, and controls. This is the essence of modern corporate governance. It is not about whether the Board chose Netflix or Paramount. It is about whether the Board can prove how and why it made that choice.

Practical Takeaways for Boards

  1. Ensure that superior proposal mechanics are understood at the Board level before a transaction is signed.
  2. Treat termination fees and regulatory protections as governance issues requiring full Board engagement.
  3. Demand real-time disclosure controls with clear ownership and escalation protocols.
  4. Require a pre-built 8-K and proxy playbook to manage disclosure risk under time pressure.
  5. Mandate regulatory scenario planning as part of transaction evaluation.

Questions for the Board

  1. Can the Board demonstrate, through contemporaneous documentation, how it evaluated a superior proposal?
  2. Does the company have a real-time disclosure control framework that supports rapid filings and updates?
  3. Are termination fee structures and third-party funding arrangements fully understood and documented?
  4. Has the Board reviewed regulatory risk scenarios and approved a default remedy strategy?
  5. Who is accountable for evidence preservation and record integrity during and after the transaction?

Please join us tomorrow; in our final post, we’ll focus on the Chief Compliance Officer. The question will be direct. What must a CCO do, in operational terms, to ensure that the company can execute governance under pressure and prove it after the fact?

 

Categories
Innovation in Compliance

Innovation in Compliance: Invitational Leadership for Employee Engagement Success With Dr. Dennis Cummins

Innovation comes in many forms, and compliance professionals need not only to be ready for it but also to embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom visits with Dr. Dennis Cummins to discuss his new book, “Invitational Selling: The Human Connection Advantage.”

Dr. Dennis Cummins, a globally recognized authority on invitational selling, champions a sales approach that prioritizes building authentic connections over traditional hard-sell techniques. Rooted in his extensive experience selling from the stage, Dr. Cummins believes in the transformative power of meaningful conversations to understand and effectively meet customer needs. His philosophy is detailed in his new book, “Invitational Selling: The Human Connection Advantage,” which promotes inviting customers to engage rather than pressuring them into a purchase, fostering authentic relationships that extend beyond mere transactions. Proceeds from the book benefit the Make-A-Wish Foundation. His book also underscores the potential of invitational selling to inspire collaboration within organizations and families, reflecting his commitment to empowering others through shared skills and talents.

Key highlights:

  • Relationship-Driven Sales Approach
  • Invitational Leadership for Employee Engagement
  • Profitability through Open Communication Culture
  • Humanizing AI to Build Trust and Connection
  • Invitational Selling: Creating Authentic Business Connections

Resources:

Dr. Dennis Cummins on LinkedIn

Dr. Dennis Cummins Website

Invitational Selling: click here 

Innovation in Compliance was recently honored as the Number 4 podcast in Risk Management by 1,000,000 Podcasts.

Categories
Blog

The Warner Bros. Bidding War: Part 1 – What Happened and Why Compliance Professionals Should Care

A fast-moving corporate auction shows how deal terms, fiduciary duties, disclosure controls, regulatory risk, and evidence discipline can determine the outcome of a major transaction. Over the rest of this week, I will be exploring the Warner Bros./Netflix/Paramount bidding war, which

The Deal That Changed Direction

The Warner Bros./Netflix/Paramount bidding war is one of those corporate stories that looks like Hollywood drama on the surface but is really a governance story underneath. At first, Warner Bros. (WBD) had an agreed transaction with Netflix. That deal carried a $2.8 billion company termination fee payable by WBD under specified circumstances, including termination to enter into a superior proposal. The proxy materials also disclosed a $5.8 billion regulatory termination fee payable by Netflix if the deal failed for certain regulatory reasons. (SEC)

Then Paramount Skydance (Paramount) came back with a revised proposal. It raised the bid to $31 per WBD share in cash, added a ticking fee, offered a $7 billion regulatory termination fee, and agreed to fund the $2.8 billion termination fee owed to Netflix. (SEC) Reuters reported that WBD said the revised Paramount proposal could be considered superior, which set the process in motion. (Reuters)

By February 27, 2026, WBD terminated the Netflix agreement and entered into a merger agreement with Paramount Skydance. WBD later disclosed that Paramount Skydance paid the $2.8 billion Netflix termination fee on WBD’s behalf. (SEC)

That is the transaction story. The compliance story is deeper.

This Was Not Merely a Higher Price

In M&A, price matters. But price is rarely the only issue. Boards also look at certainty of closing, regulatory risk, financing, timing, shareholder value, legal exposure, and execution risk. Paramount did not merely increase the cash price. It addressed several deal objections at once. It offered to cover the Netflix break fee. It added a ticking fee if closing was delayed. It increased regulatory risk protection. It positioned its offer as cleaner, faster, and more certain than the existing transaction. (SEC)

That matters because boards do not evaluate superior proposals in a vacuum. They evaluate the entire package. The better governance question is not simply, “Which offer is higher? ”It is, “Which offer delivers the best risk-adjusted value to shareholders, and can the Board prove how it reached that conclusion? ”

The Termination Fee Became a Governance Issue

The $2.8 billion termination fee is an important part of the story. In ordinary conversation, that number sounds like a barrier. In this transaction, it became part of the competitive bidding structure. Paramount agreed to fund the termination fee, which changed the economics for WBD shareholders. WBD’s own annual report language later stated that, after the Board determined it had received a Company Superior Proposal and Netflix waived its right to propose revisions, WBD terminated the Netflix agreement and Paramount paid Netflix the $2.8 billion fee on WBD’s behalf. (SEC)

For compliance and governance professionals, this is the control point: when a large termination fee can be assumed, reimbursed, funded, or otherwise neutralized by a rival bidder, the company needs clear documentation showing who approved that structure, how it was analyzed, how it was disclosed, and how conflicts were managed.

Disclosure Was Not a Back-Office Exercise

In a contested transaction, disclosure is part of the control environment. The company must update shareholders, respond to rival communications, track proxy statements, preserve drafts, document board deliberations, and avoid selective disclosure. The Netflix proxy materials laid out the termination fee structure and the circumstances under which the fee could become payable. (SEC) Paramount’s revised proposal was also publicly communicated through SEC filings, including the increased $31-per-share cash price and the regulatory termination fee. (SEC)

This is where compliance should pay attention. A transaction can move faster than the company’s document discipline. Emails, banker calls, board materials, draft press releases, proxy supplements, and negotiation notes can become evidence. If the company doesn’t have a real-time evidence protocol, the record will build itself, which isn’t ideal.

Why Compliance Professionals Should Care

Some believe this is a board-and-banker story. That is too narrow. It is also a compliance story because compliance is about governance, controls, documentation, accountability, escalation, and evidence. A high-stakes transaction tests whether the company’s control environment holds up under the highest pressure. It tests whether the Board receives complete information. It tests whether management understands escalation obligations. It tests whether legal, finance, communications, investor relations, and compliance can coordinate without losing the record.

This is exactly the kind of moment when the DOJ’s Evaluation of Corporate Compliance Programs is relevant, even outside an enforcement action. The central question is familiar: is the program well-designed, adequately resourced, empowered to function, and working in practice? In M&A, that means the compliance function should understand how deal governance intersects with disclosure controls, third-party risk, regulatory commitments, document preservation, and post-closing integration.

The Larger Lesson

The WBD bidding war shows that corporate governance is not theoretical. It is operational. A superior proposal clause is not just legal drafting. A termination fee is not just a financial number. A proxy supplement is not just a filing. Each is a control point. The companies that manage these moments well do three things. They make decisions through disciplined processes. They document the basis for those decisions in real time. They align governance, legal, finance, disclosure, and compliance before the crisis point arrives.

Practical Takeaways for Compliance Professionals

  1. Major transactions require evidence discipline from day one.
  2. Disclosure controls must be ready before a rival bidder appears.
  3. Termination fees and regulatory commitments should be treated as governance issues, not simply deal terms.
  4. Board minutes and waiver records must tell the fiduciary story.
  5. Compliance should have a seat at the broader transaction control table, especially when regulatory, third-party, data access, communications, and post-closing integration risks are implicated.

That is the lesson for every CCO. You may not be running the auction, but your program should help the company prove that it made decisions with integrity, evidence, and accountability.

Categories
Blog

May the Controls Be With You: Compliance Lessons from Star Wars: Episode IV – A New Hope

Every May 4, the business world pauses, smiles, and says, “May the Fourth be with you.” For compliance professionals, that phrase carries more than nostalgia. It can also remind us that every organization faces a recurring struggle between power and accountability, command and control, culture and fear, risk and resilience.

Star Wars: Episode IV – A New Hope is not simply a space adventure. It is a story about governance failure, ethical courage, institutional blindness, weak controls, overconfidence, and the power of a small group committed to a mission larger than themselves. In other words, it is fertile ground for the modern compliance professional.

The Galactic Empire had scale, resources, technology, command authority, and a massive enforcement apparatus. What it lacked was ethics, accountability, transparency, and trust. The Rebel Alliance had far fewer resources, but it had purpose, shared values, disciplined intelligence, and a willingness to challenge a system that had become corrupt at its core.

That is the compliance lesson. Size is not strength if governance fails. Technology is not protection if culture is broken. Authority is not leadership if fear replaces trust. And no control environment is effective if the people inside the system are afraid to speak, unwilling to escalate, or conditioned to obey without question.

The Empire as a Case Study in Governance Failure

The Empire offers a powerful example of what happens when power operates without accountability. Its leadership model is command-driven, opaque, and fear-based. Decisions flow from the top, dissent is punished, and risk information is filtered through hierarchy rather than tested through independent challenge.

This is not a sustainable operating model for any corporation. It may produce short-term compliance with directives, but it does not produce ethical performance. Employees may follow orders, but they will not raise concerns. Managers may execute instructions, but they will not challenge flawed assumptions. Leaders may believe they are in control, but they are really operating inside an echo chamber.

That is a classic governance breakdown. Under the DOJ’s Evaluation of Corporate Compliance Programs (ECCP), prosecutors ask whether compliance has adequate authority, access, and resources. They also ask whether the company’s culture encourages ethical conduct and whether employees can report concerns without fear of retaliation. The Empire would fail that test before the first audit interview began. A culture of fear is not control. It is a risk multiplier.

The Death Star and the Danger of Overconfidence

The Death Star is the ultimate symbol of institutional overconfidence. It is massive, technologically advanced, expensive, and terrifying. It is also vulnerable because its designers and leaders failed to take a critical weakness in the system seriously.

For compliance professionals, this is a familiar issue. Organizations often build impressive frameworks: policies, systems, committees, dashboards, training platforms, risk registers, and reporting structures. Yet one untested assumption, one ignored warning, one undocumented exception, or one poorly monitored third party can create a vulnerability that undermines the entire program. The lesson is not that complexity is bad. The lesson is that complexity must be tested.

A compliance program cannot be judged solely by its architecture. It must be judged by whether it works in practice. Do controls operate as designed? Are exceptions reviewed? Are risk assessments updated? Are third-party red flags escalated? Are investigations tied to root cause analysis? Are lessons learned incorporated back into the program? The Death Star failed because its leadership confused scale with effectiveness. Compliance leaders should never make the same mistake.

Princess Leia and the Importance of Speak-Up Culture

Princess Leia is one of the great figures to speak up in popular culture. She sees the Empire’s reality clearly, acts with courage, preserves critical information, and refuses to be intimidated by power. In a corporate setting, she represents the employee, executive, or compliance professional who raises a concern when the organization would rather look the other way. She also reminds us that a speak-up culture is not built by having a hotline. It is built by protecting those who use it.

A company can have a hotline, a Code of Conduct, annual training, and posters in every break room. None of that matters if employees believe reporting will lead to retaliation, career damage, isolation, or indifference. The real measure of a speak-up culture is whether people trust the system enough to use it before a problem becomes a crisis. Leia’s courage mattered. But in a corporation, courage should not be the only control. The system itself must make reporting safe, trusted, and effective.

Obi-Wan Kenobi and the Role of Ethical Leadership

Obi-Wan Kenobi does not lead through fear. He leads through wisdom, restraint, discipline, and example. He understands risk. He understands history. He understands that values must be taught, modeled, and passed forward. That is the leadership lesson. Slogans do not create an ethical culture. It is transmitted through conduct. Employees watch what leaders reward, tolerate, ignore, and punish. They listen to speeches, but they believe in actions.

For boards and senior executives, this is a central compliance obligation. Tone at the top must be matched by conduct at the top. Middle management must reinforce the message. Incentives must align with ethical behavior. Discipline must be consistent. Performance pressure must not overwhelm controls. Obi-Wan understood that leadership is stewardship. Compliance leaders should view their work the same way.

Luke Skywalker and the Development of Compliance Judgment

Luke Skywalker begins as inexperienced, impatient, and uncertain. He does not yet understand the broader conflict, the risks, or his own role. Over time, he learns judgment. He listens, observes, trains, fails, and grows. That is how compliance capability develops inside a company. Employees don’t come to work knowing about conflicts of interest, third-party risk, gifts and hospitality, data governance, sanctions exposure, procurement controls, or escalation protocols. They must be trained, guided, and supported.

Effective compliance training is not a once-a-year exercise in legal coverage. It is a business process for building judgment. The goal is not simply to tell employees the rules. The goal is to help them recognize risk in real time, pause before acting, ask better questions, and escalate when necessary. Compliance is not merely knowledge. It is judgment under pressure.

Han Solo and the Third-Party Risk Lesson

Han Solo is charismatic, capable, and useful. He is also a third-party risk case study waiting to happen. He has unclear loyalties, questionable business relationships, financial pressure, and a complicated history with counterparties. Every compliance professional knows this profile. The company needs a third party because that party can get things done. The business sponsor trusts the relationship. The third party knows the market, has access

to it, and can move quickly. But the risk indicators are visible: opaque ownership, unusual payment terms, reluctance to provide documentation, government touchpoints, reputation concerns, or unexplained urgency.

The answer is not to avoid all third parties. The answer is to manage them. Due diligence must be risk-based. Contracts must include compliance obligations, audit rights, and termination rights. Payment controls must be disciplined. Services must be documented. Red flags must be resolved before onboarding and monitored after onboarding. Han Solo eventually becomes aligned with the mission. In corporate life, however, hope is not a third-party control. Documentation is.

The Rebel Alliance and the Power of Mission

The Rebel Alliance wins not because it is larger, better funded, or more technologically sophisticated. It wins because it has clarity of mission, trust, shared purpose, and the ability to turn intelligence into action. That is the best compliance program at work. They are not bureaucratic overlays. They are mission-aligned business systems. They help the organization grow the right way. They identify risk earlier. They protect trust. They support better decisions. They turn values into controls and controls into evidence.

A mature compliance program should operate like the best parts of the Rebel Alliance: focused, informed, agile, disciplined, and mission-driven. It should gather information from across the enterprise, analyze risk, escalate concerns, and act before the organization faces regulatory, reputational, or operational harm. Compliance is not the department of “no.” It is the discipline of sustainable performance.

Five Key Takeaways for Compliance Professionals

  1. Fear is not a compliance culture. It may produce silence, but it will not produce trust, transparency, or early reporting.
  2. Scale is not effective. A large compliance program must still prove that its controls work in practice.
  3. Speak-up systems must be trusted. Employees need safe channels, anti-retaliation protections, and confidence that concerns will be addressed.
  4. Third-party risk requires discipline. Useful intermediaries can also create serious exposure if diligence, contracts, payments, and monitoring are weak.
  5. Governance must challenge overconfidence. Boards and executives should ask hard questions about assumptions, vulnerabilities, escalation, and control testing.

Final Thought

On May 4, we can enjoy Star Wars Day. But for compliance professionals, A New Hope offers something more durable than a pop culture reference. It reminds us that ethics, accountability, controls, culture, and courage matter. The Empire had power. The Rebels had purpose. In compliance, purpose supported by controls is the real force multiplier.

May the Fourth be with you.