Tag: compliance

Categories
Blog

The Metaverse and Compliance: Governing Behavior, Trust, and Delegated Authority

Imagine a virtual meeting in which an employee’s avatar nods in agreement. A colleague interprets that gesture as support for a business decision. But software, not the employee, generated the nod. Would your organization know the difference? More importantly, would its approval controls?

That hypothetical illustrates the governance challenge Patrick Henz raises in “The psychological impact of the Metaverse.” Henz explores how virtual environments could reshape socialization, identity, trust, and decision delegation to artificial intelligence.

His article is explicitly a prediction and an invitation to discussion, not proof that every anticipated psychological effect will occur. That distinction matters. Compliance should neither dismiss emerging risks nor present speculation as established evidence. Metaverse. Henz: For Chief Compliance Officers, the central question is practical: How should a company govern an environment that could influence both what people do and how they understand their relationships with technology?

Start with the Environment, Not the Marketing Label

Henz defines the Metaverse as interconnected, persistent virtual worlds with continuity of identity, communications, assets, and other data. An isolated virtual meeting platform does not satisfy that definition simply because its supplier uses the label. He also distinguishes professional and educational applications from private and leisure uses, while recognizing that the boundaries can overlap. His professional examples include learning with digital twins and using gamification to support participation. Metaverse. Henz

For compliance, this suggests beginning with the actual business activity. Is the company providing training, facilitating collaboration, selling products, or allowing software to represent employees? Each purpose warrants different controls. A simulation for practicing equipment operation raises different questions from an autonomous representative participating in a confidential negotiation.

Before approving a pilot, document its purpose, participants, data flows, and permitted actions. Identify which functions remain under direct human control. Assess the proposed activity rather than treating “the Metaverse” as a single risk category.

Socialization and Roles: Carry the Culture into the Platform

Henz argues that experiences across physical and virtual environments may influence one another. An avatar’s appearance, the treatment it receives, and the roles a user adopts could affect self-understanding and behavior beyond a particular session. These are proposed effects, not inevitable outcomes. His discussion of “cocooning” adds an important qualification. Being physically alone does not necessarily mean feeling lonely. Virtual interaction may restore social contact, even as it substitutes for some physical experiences.

The compliance implication is not to diagnose employees through their platform usage. It is to examine whether the company’s environment supports inclusion, respectful conduct, and access to human assistance. Henz identifies harassment as a concern and discusses safety features that can separate an avatar from surrounding characters. Metaverse. Henz translates that concern into operational questions. Can an employee leave an uncomfortable interaction immediately? Can the employee report it without confronting the other participant? Who receives the report?

Extend conduct expectations to company-sponsored virtual interactions. Establish an investigation process that identifies relevant participants and preserves necessary evidence without indiscriminately recording everyone. Test those procedures before launch. An accessible reporting button means little if nobody is accountable for responding. A different employee representation should not mean a lower standard of corporate conduct.

Humanization of AI: Familiarity Is Not Assurance

Henz distinguishes human-controlled avatars from “Virtual Beings,” or VBs, controlled by AI. He suggests that an appealing representation, responsive behavior, and even a fictional biography could encourage a user to perceive a relationship with software. His virtual dog example makes the issue concrete. A digital companion might offer comfort and facilitate social interaction. Metaverse. Henz: The same companion could also use knowledge about its user to influence behavior, including encouraging longer platform use.

Henz also discusses motivated reasoning: a person’s desire for a relationship may affect what that person accepts as real. For compliance, the issue is not whether a digital character seems friendly. It is whether the organization encourages users to place inappropriate trust in it.

Consider a proposed virtual compliance assistant. A supportive personality might make it easier to ask questions. It should not obscure whether the assistant is authorized to interpret policy, receive confidential allegations, or approve an exception. Make its artificial nature, limitations, and escalation options clear. Test whether employees understand those distinctions, rather than assuming a disclosure statement resolves the problem. A personable interface is a design choice. It is not evidence that the underlying advice is reliable.

Influence: Examine the Incentives Behind the Experience

Henz describes how a virtual platform could capture user inputs, potentially including eye movements through compatible equipment. He warns that an AI-controlled character could use this information to respond persuasively, with an appealing appearance boosting perceived trustworthiness.

Henz further raises the possibility that constant, apparently unconditional attention from a Virtual Being could alter expectations of human relationships. Metaverse. Henz: For a workplace, I would treat that as a reason to preserve human support and challenge, not as a finding that virtual colleagues necessarily undermine empathy or healthy professional relationships.

The corporate application is to examine how data collection shapes behavior. For a proposed platform, ask what information is collected, why it is necessary, and whether it is used to personalize assistance or steer decisions. Ask the vendor what its system is designed to optimize. Time spent on a platform does not necessarily equal the value it delivers to an employee.

Set boundaries before deployment. Identify unacceptable uses of behavioral information, restrict unnecessary collection, and establish review requirements for changes to personalization. This is also a third-party oversight issue. Assign responsibility for reviewing the supplier’s incentives and actual practices, not merely its product demonstration. An ethics review should ask whether the experience helps people make informed choices or makes it harder for them to recognize that they are being influenced.

Offloading: Delegation Requires Defined Authority

Henz’s discussion of “offloading to the Virtual Being” brings the analysis directly into internal controls. He imagines an avatar becoming capable of autonomous activity, such as attending a meeting and summarizing it for its user. He also describes software-generated gestures, including nodding, and connections to calendars and other tools. These examples explain why the opening hypothetical matters. Metaverse. Henz

For a business, observing a meeting, expressing agreement, and authorizing action should be treated as different activities. A system permitted to perform the first should not automatically acquire permission to perform the others. Define the representative’s authority before connecting it to business workflows. Specify what it may access, communicate, recommend, and execute. Reserve designated decisions for explicit human approval.

Keep records that distinguish human instructions from automated actions. Establish a way to revoke permissions and suspend the representative when its behavior departs from its approved purpose. For consequential decisions, require an approval record rather than inferring assent from a gesture, simulated presence, or meeting attendance. Delegating a task should not obscure who remains accountable for the result.

Governance Must Include Testing, Not Merely Approval

Henz concludes by calling for supervisory oversight and continuing study of psychological effects as the technology develops. He emphasizes the opportunity to benefit users alongside the risk of exploiting their vulnerabilities, which suggests a cross-functional review involving compliance, legal, information security, human resources, technology, and the business owner. The precise structure should match the proposed use. Creating another committee does not replace assigning decision-making authority.

Start with a bounded pilot and documented assumptions. Test whether participants recognize AI-controlled characters, understand their authority, and can reach a human when needed. Include both benefits and risks in the assessment. Building on Henz’s discussion of learning applications, a company could pilot an immersive compliance scenario that lets employees practice challenging an inappropriate instruction. Evaluate employees’ choices and the support they need, not merely whether they finish the exercise. Define the conditions for modifying or stopping the pilot. Review incidents, user feedback, and control failures before expanding deployment. The board should receive information about material risks, unresolved limitations, and management’s response, rather than an assurance based solely on participation or enthusiasm.

Practical Takeaways for CCOs and Boards

Start by mapping the experience. Identify who participates, what the system observes, how it may influence behavior, and whether it can act on anyone’s behalf. Give each significant risk an accountable owner. Then test the controls against realistic scenarios. Use a harassment report, an ambiguous AI recommendation, and an unauthorized action to determine whether escalation and intervention actually work.

Finally, require evidence before expansion. Ask whether users understand the technology, whether employees can get human help, and whether management can show that delegated authority stays within approved limits. Henz’s perspective does not supply a finished corporate compliance framework. It supplies questions about human behavior that a technology-only assessment could miss.

The board’s closing question should be straightforward: Can management demonstrate that this experience supports employee judgment without confusing identity, manufacturing trust, or obscuring accountability? That is where the compliance assessment should begin, regardless of what the platform is called.

Categories
Blog

CFIUS in 2026 and Beyond: Why Foreign Investment Risk Must Become a Core Compliance Priority

For years, many corporate compliance professionals saw the Committee on Foreign Investment in the United States (CFIUS) as primarily a concern for mergers-and-acquisitions attorneys. When a foreign investor sought to acquire a U.S. business, the legal team evaluated potential national security concerns, determined whether to file, and navigated the regulatory review process. Once the transaction closed, the matter often moved off the compliance radar. That approach is increasingly difficult to defend.

The recently released 2025 CFIUS Annual Report to Congress shows that foreign investment oversight has evolved into a sophisticated regulatory regime that includes transaction screening, national security investigations, mitigation agreements, ongoing compliance monitoring, and enforcement. In an analysis by Thaddeus McBride and Faith Dibble, CFIUS Annual Report Reveals Enforcement Trends highlights several developments that should command the attention of Chief Compliance Officers (CCOs), General Counsel, and corporate boards.

The key takeaway is that CFIUS compliance must become part of an organization’s broader enterprise risk management and internal controls framework. For compliance professionals, this creates both new responsibilities and opportunities to demonstrate the strategic value of an effective compliance program.

CFIUS Activity Remains High, and Scrutiny Is Intensifying

The numbers tell an important story. During 2025, CFIUS reviewed or assessed 347 covered transactions through written notices and declarations. Overall filing volume increased about 7 percent from 2024, driven primarily by a 21 percent increase in declarations.

Written notices remained relatively stable, declining approximately 1 percent. At first glance, the growing popularity of declarations might suggest that companies are finding more efficient ways to navigate the CFIUS process. However, the underlying statistics tell a more complicated story.

In 2024, approximately 78 percent of declarations resulted in CFIUS concluding action. That figure declined to approximately 66 percent in 2025. Meanwhile, the percentage of declarations resulting in requests for full written notices increased from 15 percent to 26 percent. This is significant. A declaration provides an abbreviated review process, generally involving a 30-day assessment. A full written notice involves an initial 45-day review, potentially followed by an additional 45-day investigation. For companies pursuing cross-border acquisitions, these timelines create substantial transaction uncertainty.

The compliance lesson: CFIUS risk assessment must occur during the earliest stages of transaction planning, not after the parties have negotiated their principal commercial terms.

CCOs should work closely with legal, corporate development, finance, and business leadership to ensure national security considerations are integrated into acquisition due diligence. The objective is not simply to determine whether a filing is required. It is to understand how regulatory risk may affect transaction structure, timing, valuation, and post-acquisition operations.

National Security Risk Extends Beyond Traditional Defense Industries

Another important finding concerns the industries attracting CFIUS attention. In 2025, finance, information, and services accounted for about 49.5 percent of non-real estate notices, while manufacturing accounted for another 39.5 percent. Together, these sectors accounted for nearly 90 percent of notices.

This demonstrates that CFIUS scrutiny extends well beyond traditional defense contractors and aerospace manufacturers. Companies in financial services, technology, telecommunications, data analytics, advanced manufacturing, and other commercial industries may hold assets that raise national security concerns.

Those assets may include sensitive personal information, proprietary technology, critical infrastructure, government contracts, or supply chain capabilities. Consider a foreign investor acquiring a U.S. technology company whose principal business involves collecting and analyzing consumer data.

The transaction may appear commercially straightforward. However, access to sensitive personal information, cybersecurity systems, or technology infrastructure could introduce significant national security considerations.

For CCOs, this means traditional anti-corruption and sanctions diligence is no longer sufficient when evaluating cross-border investments. A comprehensive assessment should examine beneficial ownership, sensitive technology, cybersecurity, data access, export controls, government relationships, and supply chain dependencies.

This is where compliance can provide real business value. By identifying these risks early, compliance professionals can help leadership make informed investment decisions before the organization commits substantial financial and operational resources.

Mitigation Agreements Are Continuing Compliance Obligations

Perhaps the most consequential findings for compliance professionals concern mitigation and enforcement. During 2025, CFIUS imposed mitigation measures and conditions in approximately 12 percent of transactions. At year-end, the committee monitored 234 mitigation agreements and conditions and conducted 40 compliance site visits.

These figures show that CFIUS oversight often continues long after a transaction closes. A mitigation agreement is not simply a legal document negotiated to obtain regulatory approval.

It establishes operational obligations that may require continuing monitoring, reporting, restrictions on access to information or technology, and other safeguards. Failure to implement those obligations effectively can create significant compliance and enforcement exposure.

This should sound familiar to anyone who has followed the Department of Justice’s approach to corporate compliance. Although CFIUS operates under a distinct legal framework, the underlying compliance principles mirror those in the DOJ’s Evaluation of Corporate Compliance Programs.

The compliance lesson: Every CFIUS mitigation agreement should be translated into an operational compliance framework with clearly assigned responsibilities. That framework should include documented procedures, employee training, testing, escalation protocols, and periodic management reporting. Internal audit should evaluate whether the organization is meeting its obligations.

The board or an appropriate board committee should receive meaningful information about significant mitigation requirements and compliance performance. The objective is to show not merely that the company agreed to certain restrictions, but that those restrictions work in practice.

Non-Notified Transactions Are Becoming an Enforcement Priority

During 2025, the committee investigated 90 potential non-notified transactions, opened 62 formal inquiries, and requested filings in nine cases. Two additional transactions were voluntarily submitted before CFIUS issued formal filing requests. These statistics show that CFIUS does not rely exclusively on companies to identify and report potentially covered transactions.

The committee obtains information through government agencies, congressional notifications, media reports, commercial databases, public tips, classified information, and voluntary disclosures. This has profound implications for corporate compliance.

Historically, some organizations may have viewed not filing as the conclusion of their CFIUS analysis. That assumption is increasingly risky. CFIUS can examine completed transactions and require parties to address national security concerns after closing. In certain circumstances, those concerns may result in mitigation obligations or divestiture.

The 2025 report identified seven transactions that parties abandoned after CFIUS could not identify acceptable mitigation or the parties declined proposed mitigation measures. Two matters also resulted in presidential orders prohibiting acquisitions or requiring divestment. For boards and senior executives, the implications are substantial.

The compliance lesson: Organizations should establish a documented process to evaluate CFIUS jurisdiction and filing obligations for relevant acquisitions and investments. Where management determines that a voluntary filing is unnecessary, the decision should be supported by a documented risk assessment. This documentation should explain the transaction’s ownership structure, relevant national security considerations, and rationale for the filing decision. A defensible decision-making process is essential to effective compliance governance.

Voluntary Self-Disclosure Must Be Part of the Compliance Conversation

The annual report also highlights CFIUS’s continued attention to voluntary self-disclosures involving potential mandatory-filing failures and violations of mitigation obligations. Importantly, the report notes that many instances of noncompliance do not result in penalties. This should not be interpreted as regulatory indifference. Rather, it reinforces the importance of identifying potential violations, investigating them promptly, and considering appropriate disclosure and remediation.

For compliance professionals familiar with the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, the broader principle is recognizable. Regulators place significant importance on how organizations respond when problems are discovered. However, CFIUS disclosure and enforcement procedures are distinct from DOJ criminal enforcement policies. Companies should not assume that DOJ disclosure incentives automatically apply to CFIUS matters.

The appropriate response starts with a credible internal process to identify and escalate concerns. Employees responsible for implementing mitigation agreements must understand their obligations and know how to report potential violations. Compliance teams should establish procedures to investigate concerns, preserve relevant evidence, determine root causes, and evaluate corrective action. Where a potential violation is identified, legal and compliance leadership should assess whether voluntary disclosure is appropriate under the applicable CFIUS framework.

What CCOs Should Do Now

The 2025 annual report provides a practical roadmap for strengthening foreign investment compliance.

  1. Incorporate CFIUS considerations into the enterprise risk assessment. Identify business activities, investment structures, and assets that may create national security exposure.
  2. Integrate CFIUS screening into transaction approval procedures. Require appropriate legal and compliance review before significant cross-border investments advance.
  3. Strengthen third-party and beneficial ownership diligence. Understanding who ultimately owns or controls an investor can be essential to identifying regulatory concerns.
  4. Establish ongoing monitoring for mitigation agreements. Assign control owners, set performance expectations, test periodically, and document remediation.
  5. Develop escalation and investigation procedures for potential violations. Ensure employees understand how to report concerns and management understands when disclosure decisions must be considered.
  6. Provide the board with meaningful reporting on material CFIUS risks, significant mitigation obligations, and emerging regulatory developments.

Conclusion: CFIUS Compliance Is a Lifecycle Responsibility

The 2025 CFIUS Annual Report reveals an enforcement environment characterized by sustained transaction activity, increased scrutiny of abbreviated filings, continuing mitigation oversight, and growing attention to transactions that were never submitted for review.

The fundamental lesson is straightforward. CFIUS risk begins before a transaction is signed and may continue long after the transaction closes. For CCOs, the challenge is to ensure that foreign investment compliance is integrated into governance, risk management, internal controls, and organizational accountability.

The companies best positioned to manage this environment will be those that identify national security risks early, make informed filing decisions, operationalize mitigation commitments, and continuously evaluate compliance effectiveness. CFIUS should no longer be viewed solely as a transaction approval process.

It is an ongoing compliance obligation that requires the same discipline, oversight, and commitment to continuous improvement expected of any effective corporate compliance program.

Categories
Blog

Frankenstein and Compliance: Part 4 – The Ghost of Frankenstein: Declaring the Monster Dead Is Not a Control

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first three Frankenstein films trace a recognizable progression in compliance. Frankenstein examined innovation without adequate governance. Bride of Frankenstein explored what happens when leadership recognizes a risk but lets pressure and rationalization override judgment. Son of Frankenstein shifts to inherited risk and the responsibility of new leadership to address problems its predecessors created. The Ghost of Frankenstein (1942) raises the next question. What happens when the organization believes the problem has already been addressed?

By the fourth film, no credible argument suggests that Frankenstein’s Monster represents an unknown risk. Communities have confronted him. Members of the Frankenstein family have attempted to control him. The consequences are well established. Yet the Monster remains. This time, Ygor, again played by Bela Lugosi, brings the Monster, now played by Lon Chaney Jr., to Ludwig Frankenstein, Henry Frankenstein’s other son. Ludwig initially wants nothing to do with his family’s legacy. He eventually concludes that he can solve the problem through a brain transplant. The proposed solution appears technically sophisticated. It is also compromised when Ygor and Ludwig’s colleague Bohmer secretly substitute Ygor’s brain for the intended brain.

For corporate compliance professionals, The Ghost of Frankenstein is a case study in remediation and control effectiveness. Companies routinely investigate misconduct, revise policies, conduct training, implement corrective actions, and close audit findings. Those activities matter, but they don’t prove the underlying risk has been reduced. The relevant compliance question is not whether management completed the remediation plan. It is whether the remediation worked.

Closure Is an Administrative Status

Compliance, Internal Audit, Legal, Finance, and business management are familiar with corrective-action plans. An issue is identified. Management develops remediation. Actions are assigned. Deadlines are established. Policies may be revised, systems changed, training delivered, or controls added. Eventually, the required actions are completed, and the finding is marked closed. That process is not inherently wrong. Organizations need a disciplined method for tracking remediation. The risk comes when administrative closure becomes confused with risk reduction.

Suppose an investigation finds that employees circumvented a third-party approval requirement. Management revises the policy and retrains the business. Both actions may be appropriate. They also may have little effect if the original problem arose because sales targets encouraged employees to bypass the process and local managers routinely approved exceptions. The policy was not necessarily the root cause. Training was not necessarily the solution. A closed action item therefore tells management that a required activity occurred. It does not automatically establish that the control environment changed. That distinction is central to compliance program effectiveness.

Start With Root Cause

Ludwig Frankenstein approaches the Monster as a technical problem. Replace the brain, and the problem is solved. Compliance can fall into the same trap with remediation. Organizations sometimes start corrective action before they have adequately identified why the failure occurred. Effective remediation should begin with root-cause analysis.

Suppose a salesperson makes an improper payment through a third-party distributor. The immediate facts may be straightforward. The employee violated policy, the payment was inappropriate, and the third party was involved. A root-cause analysis goes further.

Why was the third party selected? Was due diligence adequate? Were red flags identified? Did anyone override the process? Was the compensation structure unusually aggressive? Did management communicate unrealistic sales expectations? Were invoices sufficiently detailed? Did Finance question the payments? Had similar issues occurred previously? Did employees believe management would support them if they delayed the transaction? These questions shift the analysis from the individual event to the system that allowed it to happen.

Individual accountability remains important. A company should not use systemic explanations to excuse deliberate misconduct. But disciplining an employee does not repair a control environment. A strong remediation plan addresses both.

Repeat Findings Are Information

Recurring compliance issues should receive particular attention.

  • If Internal Audit repeatedly identifies the same control weakness, that is information.
  • If multiple investigations identify similar conduct in the same business unit, that is information.
  • If hotline reports repeatedly raise concerns about the same management behavior, that is information.
  • If third-party monitoring continually identifies the same documentation gaps, that is information.

Repeat issues may indicate that previous remediation addressed symptoms rather than causes. They may also indicate weak implementation, insufficient resources, inadequate supervision, or management resistance. The CCO should therefore have a mechanism to identify recurrence across data sources.

An audit finding may appear unrelated to a hotline complaint. A hotline complaint may appear unrelated to a third-party exception. A third-party exception may appear unrelated to an investigation. Viewed together, they may demonstrate a common control problem. This is where compliance data becomes more valuable than compliance statistics. The objective is not simply to count investigations, audit findings, policy exceptions, or hotline reports. The goal is to identify patterns that tell management how the organization operates.

Bohmer and Management Override

The brain-transplant sequence provides the film’s strongest internal-control lesson. Ludwig develops a plan to replace the Monster’s brain. Whatever one thinks of the underlying objective, the process is defined, and the outcome is intended. Then Bohmer and Ygor subvert it.

Control isn’t defeated because nobody designed a process. It fails because individuals with access and opportunity manipulate the process. That is management override. Corporate controls often assume authorized individuals will use their authority as intended. That assumption requires testing.

  • A manager can approve an expense.
  • A finance executive can authorize a journal entry.
  • A procurement leader can approve a vendor.
  • A senior executive can authorize a policy exception.
  • An administrator can change system permissions.
  • A business leader can influence a third-party decision.

Those authorities are necessary for business operations. They can also create risk when one individual possesses excessive discretion or when oversight is weak. Segregation of duties, approval thresholds, access controls, audit trails, independent review, exception reporting, and transaction monitoring exist partly to address this problem. For the CCO, the question is not simply whether a control exists. It is whether someone can circumvent it and whether the organization would know.

COSO and the Broader Control Environment

The Ghost of Frankenstein also provides an opportunity to consider the COSO Internal Control Integrated Framework. Controls do not operate in isolation. The control environment establishes expectations, authority, accountability, and standards of conduct. Risk assessment identifies threats to organizational objectives. Control activities translate those risks into specific preventive or detective measures. Information and communication ensure the right people receive relevant information. Monitoring determines whether the system continues to operate effectively.

Compliance failures often occur when organizations focus too narrowly on a single control activity. A company identifies misconduct involving gifts and entertainment, so it lowers approval thresholds. That may be useful.

  • But what if managers continue encouraging employees to find ways around the limits?
  • What if expense descriptions are vague?
  • What if Finance does not review unusual patterns?
  • What if senior executives routinely receive exceptions?
  • What if employees believe questioning an expense submitted by a powerful executive will damage their careers?

The approval threshold may be well designed. The broader control environment remains weak. This is why compliance should work closely with Internal Audit, Finance, HR, Legal, and business management. Compliance risk rarely fits neatly within one control owner.

Design Effectiveness and Operating Effectiveness

One of the most useful distinctions in controls work is between design effectiveness and operating effectiveness. A control may be well designed. That does not mean it operates effectively. Consider third-party due diligence. The company may have a strong written process requiring risk classification, beneficial ownership review, screening, business justification, approval, contractual protections, and periodic monitoring. On paper, the control appears robust. Then testing reveals that business sponsors routinely submit incomplete information, reviewers approve files without resolving red flags, contracts are signed before diligence is complete, and periodic reviews are months overdue. The control design is not necessarily the problem. It is execution.

Conversely, employees may execute a poorly designed control exactly as instructed, even as it fails to address the relevant risk. Compliance needs to understand both. This matters especially when validating remediation. Management should not simply confirm that a new control was implemented. Someone should determine whether the control is appropriately designed and whether it operates consistently in practice. That is how an organization moves from remediation activity to evidence of effectiveness.

Investigations Should Improve the Program

Investigations represent one of the richest sources of compliance intelligence available to a company. They show where actual conduct differs from expected conduct. Yet organizations sometimes treat investigations primarily as case-management exercises. An allegation arrives, the company investigates, decides whether to substantiate it, takes disciplinary action where appropriate, and closes the matter. That process resolves the case. It does not necessarily improve the compliance program.

For significant matters, a compliance professional should ask what the investigation teaches the organization.

  • Did a control fail?
  • Was a policy unclear?
  • Was supervision inadequate?
  • Were incentives relevant?
  • Did the reporting system work?
  • Was retaliation alleged?
  • Were similar concerns raised previously?
  • Did management respond appropriately when warning signs appeared?
  • Should monitoring change?
  • Should the risk assessment change?

The investigation should feed the compliance program. Otherwise, the organization may become very efficient at investigating the same problem repeatedly.

Test the Remediation

Perhaps the most important lesson from The Ghost of Frankenstein is that remediation requires validation. Management implements a corrective action. Someone should return later and determine whether it worked. The timing and depth of testing should depend on risk. A significant control failure may require independent validation by Internal Audit, Compliance testing, or another qualified function. Lower-risk matters may be validated through management review or monitoring. The important point is that the organization should define what success looks like before declaring the remediation effective.

The Compliance Lessons

The Ghost of Frankenstein demonstrates a basic principle of compliance program effectiveness. Activity is not the same as effectiveness. A company can revise a policy, deliver training, add an approval, complete a corrective-action plan, and close an audit finding. Each action may be appropriate. The compliance question is whether those actions changed the risk.

That requires root-cause analysis, well-designed controls, disciplined implementation, monitoring, testing, and accountability. It also requires management to recognize that some failures are not caused by employees misunderstanding the rules. They may result from incentives, authority structures, management override, weak supervision, or a control environment that rewards the wrong behavior.

The goal of remediation is not to demonstrate that the organization did something. It is to demonstrate that the organization learned something and changed accordingly. That is why declaring the Monster dead is not a control. The evidence comes from whether he stays dead.

Our final installment of my Universal Classic Monster Movie Month for 2026 takes the Frankenstein compliance story in a different direction. After four films dealing largely with one persistent risk, Universal brings another major risk into the picture. In Frankenstein Meets the Wolf Man, the issue is no longer simply whether an organization can identify, govern, inherit, or remediate a single compliance problem. It is what happens when independently managed risks begin to interact. For modern companies confronting AI, cybersecurity, privacy, third-party, sanctions, anti-corruption, financial, and operational risks, that may be the most important governance question of all: What happens when the risks we manage separately collide?

For a review of the movie and audio analysis, check out Timothy and Fiona’s take on it in Popcorn and Compliance.

Categories
Daily Compliance News

Daily Compliance News: October 22, 2026, The CCOs as Strategic Advisors Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we cover four stories from the business world, compliance, ethics, risk management, leadership, or general interest for compliance professionals.

Top stories include:

  • The Cornell scandal offers lessons for high-stakes internal reviews. (Bloomberg Law)
  • You can use ‘compliance’ and corruption in laws. (Trend.az)
  • CCOs as strategic advisors. (CCI)
  • AML tech improving compliance. (TechBullion)

My first work of general non-fiction is now out: Deluge Before Dawn, the story of the 2025 flood in Kerr County, Texas, which killed 119 people and devastated a county. It is a story of tragedy, heartbreak, survival, and resilience.

It is available on the following sites:

Amazon.com

Stoney Creek Publishing

Barnes and Noble

Texas A&M University Press

Bookshop.org

Google.Books

Walmart

Categories
Great Women in Compliance

Great Women in Compliance: Defying the Odds: Cláudia Massaia on Betting on Yourself

They told her compliance was a dead-end career. They told her she’d never make it in the United States, that landing an internship with a U.S. government agency was impossible, and that passing the New York bar exam was a long shot.

Cláudia Massaia proved them wrong—every single time.

In this inspiring episode of Great Women in Compliance, host Sarah Hadden sits down with the Brazilian-born attorney and compliance professional whose remarkable journey is a master class in persistence, self-belief, and the power of simply refusing to take no for an answer.

From launching her career amid Brazil’s historic Operation Car Wash corruption scandal to earning dual master’s degrees, securing permanent U.S. residency, and becoming a New York-licensed attorney, Cláudia shares the setbacks, sacrifices, and occasional spectacular failures that shaped her success.

Along the way, Sarah and Cláudia explore how corporate compliance has evolved, why being a trusted business partner beats being the “department of no,” and what American executives misunderstand about doing business in Brazil.

But the biggest takeaway is personal: Bet on yourself. Invest in your future. And don’t let someone else’s definition of what’s possible become your own.

As Cláudia reminds us, discipline and consistency will take you further than intensity ever could.

A joyful, candid, and energizing conversation for anyone who’s ever been told, “You can’t do that.”

Connect with Cláudia on LinkedIn and subscribe to Great Women in Compliance wherever you listen to podcasts.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 3: Son of Frankenstein – Inheriting the Castle Means Inheriting the Risk

This October, Tom Fox returns to one of his all-time favorites: Universal Pictures’ Classic monsters. Over the years, Tom has explored classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, as well as films by Val Lewton and Hammer Studios. This year, he wanted to return for a deep dive into the first five Frankenstein movies. He has considered, or will consider, the original Frankenstein, Bride of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolfman. In this third episode, he considers what many viewers regard as the series’ best: Son of Frankenstein, released in 1939. This is the final film to feature Boris Karloff as Frankenstein’s Monster. In this exploration, Tom Fox uses his AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis:

Son of Frankenstein brings Basil Rathbone into the saga as Wolf von Frankenstein, who returns with his family to his father’s estate hoping to restore the Frankenstein name. Instead, he encounters Bela Lugosi’s extraordinary Ygor and discovers that his father’s Monster, played for the final time by Boris Karloff, is still alive but comatose. Wolf revives him, hoping to vindicate his father’s work, but Ygor has his own plans and uses the Monster to settle old scores. The result is another catastrophe created by a Frankenstein convinced that this time things will be different.

Key highlights:

  • You can inherit risk without creating it.
  • This is the M&A compliance movie.
  • Ygor represents institutional knowledge used for the wrong purpose.
  • Inspector Krogh represents institutional memory.
  • Red flags transform governance responsibility.

Popcorn and Compliance takeaway: You may not have created the Monster, but once you know he is in the basement, he becomes your governance problem.

Timothy and Fiona are AI-generated voices courtesy of NotebookLM.

Categories
Blog

Frankenstein and Compliance: Part 3 – Son of Frankenstein: You Inherited the Castle, You Inherited the Risk

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first two Frankenstein films present two distinct compliance failures. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands the risk but lets pressure, ambition, and rationalization override judgment. Son of Frankenstein (1939) presents the next stage: inherited risk, or in the business world, risks through acquisition.

Wolf von Frankenstein, played by Basil Rathbone, returns with his family to his ancestral estate hoping to restore the Frankenstein name. Instead, he encounters Ygor, played by Bela Lugosi, and discovers that his father’s Monster is still alive. Wolf had no role in creating the original problem, but his discovery forces him to decide how to address the legacy he has inherited.

That situation should be familiar to companies following acquisitions, leadership transitions, compliance investigations, or changes in the control environment. New management may have no connection to historical misconduct. An acquiring company may not have created the target’s problematic third-party relationships. A new CCO may inherit investigations and remediation projects that were initiated years earlier. Historical responsibility and current responsibility are different questions. The business issue is how management responds once a legacy risk becomes known.

The Castle Is an Acquisition

Think of Wolf’s return to the Frankenstein estate as an acquisition. He receives the property, assets, name, and opportunity to benefit from his father’s scientific legacy. He also assumes the consequences associated with that legacy. Corporate acquisitions work much the same way. Companies acquire revenue, customers, employees, technology, intellectual property, distribution networks, and market access. They may also inherit high-risk third parties, weak internal controls, questionable historical practices, unresolved investigations, government relationships, and cultural problems.

This is why compliance due diligence should focus on how the target actually conducts business rather than simply whether it has the expected compliance infrastructure. A target may have a Code of Conduct, an anti-corruption policy, annual training, and a hotline. Those are relevant data points, but they do not establish program effectiveness.

Compliance needs to understand the target’s business model and risk profile. Consider such questions as: Where does the business operate? Who are its customers? Does it interact with government agencies or state-owned entities? Which third parties generate or facilitate business? How does the company select and compensate those parties? What does the investigation history reveal? Are there recurring audit or control deficiencies? What does speak-up data indicate? Are significant policy exceptions concentrated in particular markets or business units? The objective is to understand the risk embedded in the business being acquired.

Due Diligence Is the Beginning, Not the End

Even well-designed pre-acquisition due diligence has limitations. Transactions operate under deadlines and time pressures. Access to employees and records may be restricted. (See: Opinion Release 08-02) Data may be incomplete. Privacy requirements may constrain review. Some risks simply do not become visible until the buyer gains access to systems, records, personnel, and financial information after closing. Those limitations make the connection between due diligence and post-acquisition integration critical.

If the buyer cannot complete diligence on a high-risk distributor before closing, that relationship should become a post-closing priority. If investigation records are incomplete, they should be reviewed during integration. If significant controls cannot be tested before the transaction, testing should be incorporated into the integration plan. Compliance should therefore document unresolved diligence issues and carry them forward with assigned owners and deadlines.

This discipline matters because closing creates competing priorities. Management quickly shifts to customers, systems, personnel, financial reporting, cost savings, and expected synergies. Compliance integration can become one workstream among many. An unanswered compliance question doesn’t become less significant once the transaction closes.

Post-Acquisition Integration Is the Operational Test

An acquiring company can conduct excellent due diligence and still create exposure if it fails to integrate the acquired business effectively. Post-acquisition integration is where the buyer’s compliance expectations become operational. Employees need to understand the acquiring company’s Code of Conduct, policies, reporting mechanisms, investigation procedures, third-party requirements, approval processes, and internal controls. High-risk third parties may require additional diligence. Contracts may need updated compliance provisions. Financial controls may need harmonization. Employees need risk-appropriate training.

Integration should also reflect the acquired company’s actual risk profile. A business operating primarily in lower-risk markets with direct sales may require a different approach than a company that depends on agents and distributors in jurisdictions with substantial government interaction. Do not apply the same integration checklist mechanically to every acquisition.

The CCO should know which issues require immediate attention, which can be addressed over a reasonable integration period, and who is accountable for each significant action. Without ownership and monitoring, temporary integration gaps can become lasting control weaknesses.

Ygor and the Informal Organization

Ygor provides one of the movie’s most useful compliance lessons. He understands the Frankenstein estate better than Wolf does. He knows its history, its secrets, and how things actually work. Every organization has a formal structure and an informal operating system. The organizational chart describes reporting relationships. Policies describe required processes. Procedures identify approvals. Employees know how business actually gets done.

They know which approvals receive meaningful scrutiny and which are largely administrative. They know which managers routinely approve exceptions. They know which third parties have special relationships with executives. They know which controls become flexible near quarter-end. They know whether raising a concern is welcomed or career-limiting. This is why compliance risk assessment cannot rely exclusively on documents.

Policies lay out how an organization is supposed to operate. Interviews, focus groups, hotline information, investigations, transaction testing, third-party monitoring, audit findings, and employee surveys can show how it operates in practice. That distinction becomes particularly important following an acquisition. The buyer needs to understand not only the target’s compliance architecture but also its operating culture.

Institutional Memory Is a Compliance Control

Inspector Krogh represents the other side of organizational knowledge. He remembers the consequences of the original Frankenstein experiment because he experienced them personally. His perspective is shaped by history, not by Wolf’s confidence that the past can be managed differently. Companies need mechanisms for preserving similar institutional knowledge.

Investigations produce knowledge. Internal audits produce knowledge. Regulatory inquiries produce knowledge. Compliance monitoring and remediation projects produce knowledge. That knowledge can disappear surprisingly quickly. Employees retire. CCOs leave. Executives change roles. Board members rotate. Investigations close. Outside counsel completes an engagement. Remediation projects are marked complete.

Years later, new management may propose a business arrangement, third-party relationship, market strategy, or control change similar to one the organization previously determined was problematic. An effective compliance program should prevent important lessons from depending entirely on the memories of individual employees.

Significant investigation findings should inform future risk assessments. Root causes should influence control design. Remediation lessons should affect monitoring. Historical third-party concerns should remain available when relationships are reconsidered. An investigation’s purpose is not simply to resolve an allegation. It should also improve the organization’s understanding of its risks.

New Leadership and the Risk of Exceptionalism

Wolf demonstrates another challenge common to leadership transitions. New leaders often believe they can manage risks that previous leaders could not. Sometimes they can. New leadership may bring stronger systems, better controls, additional resources, and improved judgment. The problem arises when confidence leads management to discount why earlier controls or restrictions were established.

A new sales executive may propose reengaging a distributor previously terminated for compliance concerns. A new CEO may reconsider a market that previous management considered too risky. A new business leader may conclude that an approval requirement imposed after earlier misconduct is unnecessarily restrictive. Any of those decisions may be appropriate. Controls should not remain in place indefinitely simply because they are old. But management should understand the history before changing them.

Before removing a control, determine why it was created. Before reengaging a third party, understand why the relationship ended. Before changing monitoring requirements, identify the risk they were designed to address. Some controls become obsolete. Others represent lessons learned. Good governance distinguishes between the two.

Red Flags and the Governance Response

The central compliance issue arises when Wolf learns the Monster is alive. At that point, the question moves from discovery to response. Corporate compliance systems serve a similar purpose. Internal controls, monitoring, Internal Audit, risk assessments, investigations, hotlines, and management reporting should surface significant information.

The effectiveness of those systems depends upon what happens after the information arrives. The Evaluation of Corporate Compliance Programs (ECCP) suggests such inquiries as: Was the issue investigated? Was it escalated appropriately? Did management assign remediation? Was completion tracked? Was effectiveness tested? Did significant information reach the board or appropriate committee? A sophisticated reporting system provides little protection if material concerns repeatedly reach decision-makers without producing action.

For a CCO, this means escalation protocols matter. The organization should understand which issues remain within normal management processes, which require senior management attention, and which warrant board notification.

Legacy Third Parties Require Fresh Review

Inherited third-party relationships deserve particular attention because longevity can create a false sense of security. The distributor has worked with the business for fifteen years. The consultant is well known locally. The customs broker has always handled interactions with government agencies. No significant problems have been reported previously. Those facts provide context. They do not replace risk-based oversight.

Acquisitions and leadership transitions provide an opportunity to reassess significant legacy relationships. Is the third party still necessary? Is the business rationale documented? Is beneficial ownership information current? Has the risk profile changed? Are payment arrangements appropriate? Are contracts current? Has monitoring identified concerns? Longstanding relationships should not automatically be grandfathered into the current compliance program. Some may warrant closer attention precisely because they were established under different controls, different management, and different expectations.

Practical Actions for the CCO

Son of Frankenstein suggests a practical agenda for compliance leadership. Due diligence should examine actual business operations, not just the existence of policies. Unresolved diligence issues should move directly into the integration plan with defined ownership and deadlines. Integration should be risk-based and should include controls, training, reporting mechanisms, investigations, and third-party oversight.

Significant legacy third parties should be reassessed rather than automatically accepted. Preserve investigation findings and past control failures as institutional knowledge and incorporate them into future risk assessments. New leadership should understand why significant controls were established before deciding to eliminate or weaken them. Finally, significant inherited risks should have clear owners. Issues that sit between the transaction team, business leadership, Legal, Compliance, Finance, and Internal Audit can otherwise remain unresolved because everyone assumes someone else is responsible.

The Compliance Lesson

Son of Frankenstein demonstrates the difference between responsibility for creating a problem and responsibility for managing one. Organizations routinely inherit compliance risks through acquisitions, leadership transitions, longstanding business practices, third-party relationships, and unresolved control weaknesses. New management should not be treated as responsible for conduct that occurred before it arrived. Its responsibility begins with the response.

Effective compliance requires the organization to identify inherited risks, prioritize them by significance, assign ownership, integrate acquired operations, preserve institutional knowledge, and verify corrective actions. That is the business lesson from Wolf von Frankenstein’s return to the family estate. The value of an inheritance cannot be separated from its risks.

The next stage of the Frankenstein story raises another familiar compliance issue. Organizations can identify problems, investigate them, revise policies, conduct training, complete remediation plans, and close findings. Yet sometimes the same problem returns.

In our next selection, we consider The Ghost of Frankenstein. In this movie, the compliance issue is no longer discovery or inheritance. It is program effectiveness. If management says the problem has been remediated, what evidence demonstrates that the remediation actually worked?

For a discussion on these topics and a review of the movie, check out Timothy and Fiona in this episode of Popcorn and Compliance.

Categories
Blog

The Locked-Room Compliance Problem: Seven Lessons from John Dickson Carr

I don’t just enjoy movies for my annual October Movie Monster-fest. I have been reading Tom Mead’s Joseph Spector mysteries, and the puzzles have brought me back to a question every compliance professional should recognize: What happens when the evidence shows that something occurred, but everyone insists the controls made it impossible?

Imagine an unauthorized payment. Finance says two approvals were required. Technology says access was restricted. Management says the procedures were clear. Yet the money left the company. There is your locked room.

John Dickson Carr offers a useful starting point. In Chapter 17 of The Hollow Man, his detective, Dr. Fell, describes seven categories of locked-room mystery. These are explanations of apparently impossible events, not seven mandatory writing rules or a compliance framework. Nevertheless, they invite a productive investigative habit: challenge the assumptions that make the evidence seem impossible. (See 7 Types of Locked Room Mystery)

Spoiler notice: This article discusses locked-room mechanisms that may reveal how some mystery plots work.

1. An Accident That Looks Like Murder: Test the Premise

Fell’s first category in The Hollow Man removes the murderer altogether. A fatal accident inside the room creates circumstances that suggest murder. The investigator, searching for an ingenious escape route, tries to explain something that never happened. That is a useful warning for internal investigations. Before asking how an employee defeated a control, establish whether anyone deliberately defeated it.

Consider a hypothetical duplicate payment. An investigator might suspect collusion between an employee and a supplier. But the explanation could be a poorly configured system, an ambiguous invoice reference, or overlapping responsibilities during a transition. Those possibilities require different evidence and different remediation.

The point is not to excuse misconduct. It is to avoid treating the allegation as the conclusion. An investigation should test competing explanations, including evidence that contradicts its opening theory. Finding an error rather than fraud should refine accountability, not end the inquiry.

Ask: What evidence would distinguish deliberate misconduct from error or process failure?

2. Poison Gas: Examine the Environment

In the second category, Fell describes poison gas overcoming the victim. The resulting distress may disturb the furniture, making it look like a struggle with an attacker. The room tells a story, but the apparent story misidentifies the cause. My compliance parallel is the operating environment.

Imagine investigators discovering that several analysts bypassed required reviews. Focusing only on individual decisions might produce several disciplinary recommendations. Looking at the environment could reveal something else: supervisors demanding immediate clearance, unresolved staffing requests, and employees learning that escalation brings criticism rather than assistance.

Those conditions would not automatically excuse individual decisions. They would become additional hypotheses to investigate. The mistake is to attribute a pattern entirely to personal failings without examining the conditions in which people worked. Another training module may address neither the workload nor the managerial instructions.

Ask: What pressures, incentives, and supervisory behaviors surrounded the decisions under investigation?

3. The Mechanical Trap: Look Before the Event

Fell’s third category in The Hollow Man involves a trap placed in the room and activated later by the victim. The murderer can be elsewhere when the fatal event occurs. An investigator who focuses only on who was present at that moment starts with an unnecessarily narrow timeline. The compliance equivalent is a process altered before an apparently routine transaction.

Suppose someone changes a supplier’s payment information. Weeks later, an ordinary payment run uses that information. The employees processing the payment may follow their assigned steps while relying on a record whose integrity was compromised earlier. The investigative question is therefore larger than who approved the final transaction. Who established the underlying data? Who could change it? What evidence shows which version the approvers saw? Do not confuse the moment a loss becomes visible with the moment its cause was introduced. Review the relevant changes, permissions, and dependencies leading up to the event.

Action: Reconstruct the setup as carefully as the execution.

4. Suicide Disguised as Murder: Challenge the Attribution

The fourth category concerns a suicide arranged to resemble murder, potentially to incriminate an innocent person. In Fell’s discussion, the apparent crime scene is not merely evidence of an event. It attempts to direct the investigator toward a particular explanation. The compliance analogy is staged attribution, not the death itself.

Consider a hypothetical manager who instructs an employee outside the formal workflow to process an exception. The employee’s name remains in the system. The manager subsequently presents that record as proof that the employee acted alone. The record might be authentic and still tell an incomplete story.

An investigator should examine who created the evidence, what it actually establishes, and what surrounding communications may qualify it. Neither a senior executive’s account nor a compelling accusation should substitute for corroboration. Apply that discipline without treating a reporting employee as presumptively unreliable.

Ask: Does this evidence establish responsibility, or merely show whose name appears in the file?

5. Impersonation After Death: Separate Identity from Appearance

In Fell’s fifth category, the murderer impersonates a victim who has already been killed. Observers believe they have seen the victim alive, placing the death later than it actually occurred. Identity and chronology reinforce the same mistaken conclusion. For compliance professionals, the analogy is an approval that appears to establish more than it does.

Imagine a transaction record carrying a director’s username. Does that prove the director personally reviewed the transaction? Before answering, examine delegated authority, account access, and how any automated workflow operates. A legitimate delegation and an unauthorized use could produce superficially similar records.

The timestamp needs equal attention. Does it record the decision, the system entry, or a later processing step? The mistake is turning a familiar name and precise-looking time into unquestioned proof. Precision in a record is not the same as certainty about its meaning.

Action: Verify the actor, authority, and meaning of the timestamp before assigning accountability.

6. Murder from Outside the Room: Reconsider the Boundary

Fell’s sixth category allows the murderer to act from outside while circumstances suggest that the killing required someone inside. The apparent impossibility depends on a mistaken assumption about where the attacker needed to be. This offers an analogy for control boundaries.

Imagine a restricted finance application receiving supplier information from another system. Investigators confirm that nobody improperly accessed the finance application and conclude that the transaction could not have been manipulated. But that conclusion leaves the incoming information unexamined.

Follow the transaction upstream. What information did procurement, an outsourced service provider, or a business partner provide? Which team validated it? What changes could occur before the finance control began operating?

A control may function as designed within its boundary while leaving a consequential dependency outside the investigation. The appropriate response isn’t necessarily to abandon the control but to understand and address that dependency.

Ask: What can influence this process without passing through the control we tested?

7. Murder During Discovery: Preserve the Scene

Fell’s seventh category reverses the timing assumption again. The victim is initially unconscious, not dead. The murderer joins those forcing entry and commits the killing amid the confusion. Everyone assumes the fatal act preceded discovery, although discovery provided the opportunity. For an investigator, this raises a different concern: what happens after the problem is reported?

Suppose a manager immediately “cleans up” the relevant records. Technology changes permissions. Finance corrects the supplier file. Each action may have a legitimate purpose, but investigators now face a changed environment. Do not mistake the condition you encounter for the condition that existed when the event occurred.

Contain ongoing harm, but document interventions and preserve pre-change evidence wherever possible. Identify who accessed relevant records after the allegation and what they changed. Helpful intent should not remove an action from the chronology.

Action: Include the response to discovery in the investigation, not merely the events preceding it.

What the CCO and Board Should Take Away

Carr’s categories suggest a discipline for compliance: separate the event from its explanation. Carry that discipline into your next program review, including a DOJ ECCP or COSO-based assessment. Select a closed investigation and ask whether its conclusion addressed the original assumptions, the evidence that challenged them, and the conditions that allowed the event.

For the CCO, the practical task is to connect findings to corrective action. Establish ownership, define what successful remediation means, and test whether the change addresses the demonstrated cause. For directors, move beyond asking whether the control existed. Ask management: What did the investigation establish about how the control actually operated, and what evidence supports the proposed fix?

Never close a locked-room compliance problem with the statement, “That could not have happened.” That statement belongs at the beginning of the investigation. In compliance, the locked door is not an explanation. It is an assumption to test.

Categories
Great Women in Compliance

Great Women in Compliance: The Paradox of Ethics & Compliance: Corporate Conscience or Façade?

Is your organization designed to hear the truth—or to explain it away?

Corporations have Enterprise Risk Management, established Ethics & Compliance Programs, Internal & External audits, risk assessments, multiple risk and compliance heat maps and dashboards, and boards charged with oversight.

So why do major corporate scandals keep happening?

What if the problem isn’t a lack of controls but the organizational structures that prevent those controls from making a difference?

In this episode of Great Women in Compliance, we speak with Astrid Yee-Sobraques, Risk Sherpa and author of The Structural Capture of Corporate Conscience, about the uncomfortable relationship between ethics, commercial pressure, corporate governance, and power.

We explored whether the Ethics & Compliance functions can identify risks but cannot meaningfully influence how the risk will be mitigated, and whether the Ethics & Compliance Program is effective—or simply a system for documenting concerns.

We asked:

  • Can a company with ethical people still be structurally designed to produce unethical outcomes?
  • When does legitimate business risk acceptance become a way to rationalize unacceptable conduct?
  • If Ethics & Compliance can identify the risk but cannot change the outcome, is that independence—or an illusion of it?
  • How can boards uncover the risks that management’s reporting and assumptions may obscure?

For Ethics & Compliance professionals, the discussion raises difficult questions about independence, professional responsibility, escalation, and the pressure to protect revenue-producing relationships.

For directors and board members, it challenges the assumption that more reporting and better dashboards do not necessarily translate into better oversight and decisions.

Categories
Innovation in Compliance

Innovation in Compliance: Dr. David Gruder on Collaborative Accountability and the Psychology of Compliance

Innovation comes in many areas, and compliance professionals need to not only be ready for it but embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom interviews Dr. David Gruder, a clinical and organizational development psychologist.

Dr. Gruder is trained in long-range master planning and is an ordained interfaith rabbi, bringing psychological and spiritual principles to business, culture, and compliance. He introduces “collaborative accountability” as a growth-oriented alternative to coercive, shame-based accountability and outlines four interlocking procedures: accountability-capable agreements, consistently elevating best practices, converting breakdowns into growth opportunities, and collaborative disengagement. He defines accountability as taking responsibility for the impacts of how one spends life energy on those to whom commitments are made, distinguishing good intentions from measurable commitments. Gruder describes three competing futures, regressionism, “Homo machina” transhumanism, and “Homo spiritus,” and urges leaders to align vision, mission, and ethics accordingly. He defines organizational nimbleness as resilience plus innovation and emphasizes marrying legal and psychological compliance.

Key highlights:

  • Spiritual Lens at Work
  • Collaborative Accountability
  • Why Psychology Matters
  • Defining True Accountability
  • Humanity’s Three Futures
  • Business Ethics and Influence

Resources:

  • DrGruder.com
  • TheCESS.com
  • Facebook: @davidgruder / @drdavidgruder
  • X (Twitter): @davidgruder
  • LinkedIn: linkedin.com/in/gruder
  • Instagram: @drgruder
  • YouTube: @DavidGruder

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

My first work of general non-fiction is now out: Deluge Before Dawn, the story of the 2025 flood in Kerr County, Texas, which killed 119 people and devastated a county. It is a story of tragedy, heartbreak, survival, and resilience.

It is available on the following sites:

Amazon.com

Stoney Creek Publishing

Barnes and Noble

Texas A&M University Press

Bookshop.org

Google.Books

Walmart

Innovation in Compliance was recently honored as the Number 4 podcast in Risk Management by 1,000,000 Podcasts