Tag: compliance

We continue our consideration of the intersection of The Odyssey and compliance by reviewing the tale of the Cattle of Helios.

Odysseus’s crew had been warned and not casually warned. Not “check the policy when you get a minute,” warned the manager. Not “Legal would prefer we avoid this,” warned. They were told clearly: do not touch the cattle of Helios. The cattle were sacred. The instruction was simple. The consequences were severe. Then hunger arrived.

Odysseus’s men were stranded. Supplies ran low—pressure built. Rationalizations followed. The crew looked at the sacred cattle and began doing what employees, managers, and executives have done in companies since the dawn of internal controls: they explained why the rule should not apply this time. They were desperate. The situation was unusual. The risk was theoretical. Surely the gods would understand. Surely survival mattered more than procedure. So they slaughtered the cattle. It did not end well.

For corporate compliance, the Cattle of Helios is a story about red-line rules: the things an organization says are non-negotiable. Do not falsify records. Do not retaliate. Do not bypass sanctions screening. Do not misuse customer data. Do not make unapproved payments. Do not obstruct an investigation. Do not conceal a conflict. Do not alter documents. Do not ignore a legal hold. Do not approve what you do not understand. Every company has sacred cattle. The real question is whether employees believe they are actually sacred.

The Corporate Translation

The Cattle of Helios are the company’s non-negotiables. They are not ordinary preferences. They are not “best practices.” They are not aspirational values printed on lobby walls next to a tasteful photograph of diverse employees pointing at a laptop. They are the rules that protect the organization’s license to operate.

In a strong compliance culture, employees know these rules. Managers reinforce them. Controls support them. Violations are escalated. Discipline is consistent. Pressure is acknowledged but does not excuse misconduct. In a weak compliance culture, everyone knows the words, but no one believes the consequences will be enforced. That is how red-line rules become folklore. A rule everyone knows, but no one enforces, is not a rule. It is a campfire story.

Pressure Does Not Create Character. It Reveals Controls.

Odysseus’s crew did not break the rule while comfortable, rested, and well-fed. They broke it under pressure. Most compliance breaches do not occur in calm conference rooms where everyone has read the policy, reviewed the risk matrix, and enjoyed a sensible lunch. They occur when the quarter is closing, the shipment is stuck, the customer is angry, the regulator is asking questions, the system is down, the executive is impatient, or the team is exhausted.

Pressure is the great compliance stress test. It reveals whether policies are operational or decorative. It reveals whether managers know how to supervise. It reveals whether employees believe escalation is safe. It reveals whether the organization has built controls that work when humans are hungry, tired, ambitious, afraid, or behind target.

The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) asks whether a company’s compliance program is not only well-designed but also applied earnestly and is working in practice. It also notes that prosecutors look at whether policies, reporting lines, training, incentives, and discipline are integrated into operations and the workforce. That is the key point. A red-line rule cannot live only in the Code of Conduct. It must live in approvals, workflows, monitoring, supervision, training, investigations, and consequences. Otherwise, when hunger comes, the cattle are on the menu.

Supervision Is Not a Ceremonial Role

There is another uncomfortable part of the myth. Odysseus is absent when the crew crosses the line. Depending on the telling, he is asleep or away praying. Either way, the leader is not effectively supervising when the critical decision is made. That should make every business leader shift slightly in their chair.

Many control breaches happen in the gap between policy and supervision. Senior leadership announces the rule. Compliance writes the policy. Legal reviews the language. Training pushes the module. Then the real decision is made by a frontline team under pressure, with a manager who either does not know, does not ask, or does not want to know. That is not a paperwork problem. That is an accountability problem.

Managers are the first line of ethical translation. They turn corporate expectations into daily behavior. If they treat compliance as an administrative burden, so will employees. If they reward results without asking how those results were achieved, employees will notice. If they punish bad news, problems will go underground. If they look away from “small” violations, they teach the business that red lines are negotiable.

Supervision is not hovering. It is not micromanagement. It is the disciplined act of identifying where the real risks lie and ensuring that employees have guidance, resources, and accountability before a breach occurs. Odysseus’s men knew the rule. What they lacked was effective control at the decisive moment.

Reporting Before the Cattle Are Slaughtered

A mature compliance program wants to hear about pressure before it becomes misconduct. That means employees need trusted ways to raise concerns, ask questions, and report violations. The ECCP identifies confidential reporting and investigation processes as hallmarks of a well-designed program, including mechanisms for reporting suspected misconduct, protection against retaliation, proper routing of complaints, timely investigations, and appropriate follow-up and discipline.

The reporting question is not simply, “Do we have a hotline? “The better question is, ‘Would the crew have used it before dinner?’ Would an employee say, ‘We are being asked to ship without required approval’? “Would a finance analyst say, “This invoice looks wrong”? Would a sales manager say, “The customer is pushing us to use an unapproved intermediary”? Would an IT employee say, “Someone wants access they shouldn’t have”? Would anyone say, “We are about to cross a line”? If the answer is no, the reporting mechanism may exist, but trust does not.

That is where anti-retaliation becomes central. Employees will not report sacred cattle violations if the organization quietly punishes the person who notices the knife. A speak-up culture is not built by posters. It is built on what happens to the first person who speaks up when the business does not want to hear it.

Discipline Must Be Consistent, Not Theatrical

After a breach, companies often want to show seriousness. That is understandable. But discipline must be more than corporate thunderbolts. It must be fair. It must be consistent. It must be documented. It must address both supervisors and direct actors. It must consider incentives and pressure. It must ask whether the rule was clear, whether training was adequate, whether controls failed, and whether leaders tolerated or encouraged the behavior.

The ECCP specifically focuses on consequence management, including procedures to identify, investigate, discipline, and remediate violations, consistent enforcement across the organization, and consequences regardless of position or title. It also asks whether companies track disciplinary outcomes and measure consistency across levels, geographies, units, and departments. That is where many companies stumble.

They discipline the employee who touched the cattle but ignore the manager who set impossible targets. They terminate the junior person but coach the rainmaker. They punish the region that got caught but ignore similar conduct elsewhere. They announce “zero tolerance” and then create exceptions for people with large books of business.

Employees are excellent readers of organizational reality. They know whether discipline is consistent. They know whether some people are protected. They know whether “non-negotiable” means non-negotiable or merely “please do not embarrass us.” A compliance program loses credibility when consequences depend on rank, revenue, geography, or internal politics.

Incentives: Who Made the Crew Hungry?

The crew was hungry. That does not excuse what they did, but it helps explain why the rule failed. Corporate compliance must ask similar questions. Were employees under unrealistic sales targets? Were bonuses tied only to revenue? Were managers rewarded for speed without regard to control quality? Were teams understaffed? Were approvals too slow? Was the policy clear but operationally impossible? Did leadership create pressure and then act shocked when employees cut corners?

The ECCP asks whether companies have considered the impact of financial rewards and other incentives on compliance, including whether commercial targets are achievable while operating in a compliant and ethical manner. That question should be posted in every executive compensation meeting. If the business model requires employees to choose between meeting targets and following the rules, do not be surprised when the cattle start disappearing.

What a Better Program Does

A better program defines its non-negotiables clearly and repeats them often. It trains employees on real pressure moments, not abstract policy language. It gives managers supplemental guidance. It builds controls around red-line rules. It monitors for breaches and near misses. It makes escalation easy. It investigates fairly. It disciplines consistently. It addresses root causes. It tests whether employees actually understand which rules cannot be bent. Most importantly, it refuses to let pressure become a universal solvent.

Pressure may explain why misconduct occurred. It should not erase accountability. When a red-line rule is breached, the organization should ask four questions.

First, did the employee know the rule?

Second, did the controls make compliance practical?

Third, did supervision reinforce the rule?

Fourth, did incentives or leadership pressure make violations more likely?

Those questions move the company beyond blame and toward remediation.

The Compliance Takeaway

The Cattle of Helios remind us that non-negotiable rules are only real when they survive pressure. It is easy to honor sacred cattle when the pantry is full. The test comes when the team is hungry, the deadline is looming, and someone says, “We have no choice.” That is when compliance has to mean something.

A company’s most important rules must be known, operationalized, monitored, and enforced. They must apply to senior leaders and junior employees. They must survive business urgency. They must be supported by reporting channels, investigations, discipline, and incentives that tell the same story.

Do not falsify records.

Do not retaliate.

Do not bypass screening.

Do not misuse data.

Do not make unapproved payments.

Do not conceal misconduct.

Do not touch the cattle.

Because if the organization says a rule is sacred but treats violations as negotiable, employees will soon learn the real policy. And by then, dinner may already be served.

Join us tomorrow as we conclude our series with a homecoming in Ithaca.