Tag: compliance

Categories
Blog

Dolly Parton and the Compliance Value of a Life Well Governed

Dolly Parton died this week. Her death closed one of the most remarkable careers in American entertainment, but it did not close the institutions, ideas, and expectations she built. For corporate compliance professionals, that durability is what makes her story more than a tribute. It becomes a lesson in how values can be converted into governance. Today I want to honor Parton, what she did, and what she stood for, and perhaps hope that her life will inspire all of us to be just a little better.

Parton was one of twelve children. Parton began singing on local radio and television as a child and appeared at the Grand Ole Opry at thirteen. She wrote her first song at age 6. She moved to Nashville after high school, established herself as a songwriter, and became a national star through The Porter Wagoner Show. She then built a solo career that crossed country, pop, film, television, theater, publishing, tourism, and philanthropy. She recorded more than fifty albums, wrote roughly 3,000 songs, won ten Grammy Awards, and created works such as “Jolene,” “I Will Always Love You,” and “9 to 5” that became part of the American vocabulary. One of the most amazing facts I learned while researching this piece was that “Jolene” and “I Will Always Love You” were written on the same day. How is that for creative inspiration?

Parton did not run a corporate compliance program, and her career should not be forced into that frame. Yet she demonstrated something every CCO and Board of Directors needs to understand: culture becomes credible when stated values, hard decisions, operating systems, and visible conduct reinforce one another over time. Her public identity rested on kindness, independence, dignity, humor, and respect. She repeatedly made those commitments tangible in contracts, businesses, philanthropy, and crisis response.

Her entrepreneurship deserves equal attention. Parton moved from performer to owner, producer, publisher, and partner, most visibly through Dollywood and the enterprises built around it. The portfolio was diverse, but it was not random. Music, storytelling, family entertainment, Appalachian identity, hospitality, and community investment all reinforced a coherent promise. Compliance professionals should recognize the governance advantage of that clarity. Diversification creates new legal, operational, third-party, and reputational risks, but a stable purpose helps leaders decide which opportunities fit, which controls must travel with the business, and which deals to decline.

Independence Before Applause

Parton understood the difference between access to power and surrender to it. She left Porter Wagoner in 1974 to build an independent career, expressing gratitude for the partnership without allowing it to define her future. She later declined an opportunity for Elvis Presley to record “I Will Always Love You” when his manager demanded a share of the publishing rights—saying no cost her an extraordinary short-term opportunity. Retaining ownership preserved the long-term value of her work, especially when Whitney Houston’s recording became a worldwide success. Business Insider called it “her smartest business move.”

That decision should resonate with compliance leaders. Independence is not a paragraph in a charter. It is the authority to resist pressure when revenue, status, or a powerful executive makes acquiescence attractive. A CCO needs direct access to the board, control over investigative escalation, sufficient resources, and protection against retaliation. Chuck Watson once said, “Sometimes the best deal is the one you don’t make.” A board should test whether that independence works when it is expensive, inconvenient, and unpopular. If compliance can say no only when nothing important is at stake, it is not independent.

Purpose Made Operational

Parton’s philanthropy offers an equally powerful lesson in program effectiveness. She created the Dollywood Foundation in 1988 to improve educational outcomes in her home county. Its Buddy Program paired students and offered a financial incentive for graduation; the dropout rate for the participating classes fell from 35 percent to 6 percent. In 1995, inspired by her father’s inability to read and write, she launched the Imagination Library. What began in Sevier County became a network operating across five countries that has delivered more than 300 million free books to young children.

This was not the purpose of branding. It was purpose translated into a defined population, a repeatable delivery model, local partnerships, funding, data, and measurable results. That is the same transition the Department of Justice asks companies to make when it evaluates whether a compliance program is well designed, adequately resourced, and working in practice. A value in the code of conduct must become an owner, a control, an escalation path, testing, and remediation. Intent is the beginning of a compliance program, not proof of one.

Listen to the People Who Experience Power

Parton’s film and song “9 to 5” gave popular form to workplace realities many employees already knew: power can be abused, unfairness can become routine, and people with the least authority often carry the greatest burden. The song endured because it recognized the lived experience behind organizational charts. It made a workplace issue visible without turning the people affected into abstractions.

Compliance programs fail when they listen only upward. Hotline statistics, exit interviews, culture surveys, investigation themes, retaliation allegations, and manager-level trends must reach leaders in a form that supports action. Boards should ask whether employees believe they can speak without losing status, opportunity, or employment. They should also ask whether the organization learns from weak signals before they become red flags. A speak-up system is not effective because a telephone number exists. It is effective when people trust the process and see consistent, fair outcomes.

Trust Earned Through Response

Parton’s businesses remained closely connected to the community that formed her. Dollywood became Sevier County’s largest employer, while its stated operating culture emphasizes hospitality, authenticity, collaboration, and respect. The company supports employee development, including tuition assistance. When wildfires devastated East Tennessee, Parton helped organize direct support for affected families. During the COVID-19 pandemic, her $1 million gift established a Vanderbilt research fund that supported work connected to the Moderna vaccine.

The compliance lesson is that reputation is a lagging indicator of accumulated conduct. Trust is built before a crisis through thousands of ordinary decisions about employees, customers, communities, and counterparties. A crisis tests it through the speed, fairness, transparency, and competence of the response. A company cannot purchase credibility with a campaign after years of contrary conduct. The best crisis communication remains a well-governed response supported by facts, accountable owners, and visible follow-through.

A Board Agenda Worthy of the Lesson

Parton’s legacy was unusually broad, but its organizing logic was simple. Know what matters. Protect it when pressure arrives. Build systems that carry values beyond the founder. Listen to people whose voices are easiest to overlook. Measure whether the work changes outcomes. Repeat the conduct long enough that stakeholders can rely on it.

  • For directors, that logic produces five practical questions. What principles will the company not trade away for a transaction or quarterly target?
  • Does the CCO possess real independence, resources, information, and access?
  • Which data prove that stated values operate at the employee and third-party level?
  • Are speak-up and investigation systems producing trust, learning, and remediation?
  • When the company faces a crisis, can the board see decisions, owners, deadlines, testing, and closure rather than a record showing only that management made a presentation?

Dolly Parton understood that a carefully created image can open a door, but only character and performance can keep it open for seven decades. Compliance leaders often describe their goal as building a culture of integrity. Her career reminds us what that requires: independent judgment, operational discipline, attention to the less powerful, measurable impact, and consistency when no applause is guaranteed. That is not only a fitting business lesson from her life; it is a demanding standard for every organization that wants to be trusted.

Categories
AI Today in 5

AI Today in 5: August 26, 2026, The 4 Places Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world on compliance, ethics, risk management, leadership, or general interest in AI.

Top AI stories include:

  1. Four places AI cuts paperwork in food compliance. (FoodIndustryExec)
  2. AI changing communications compliance. (UC Today)
  3. AI-powered compliance monitoring. (Plan Adviser)
  4. Americas want transparency around the use of AI in healthcare. (Pew Research Center)
  5. Nvidia becoming AI’s bank. (WSJ)

For more information on using AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.

Categories
Blog

From Gatekeeper to Navigator: Dr. Hemma Lomax on the Decision Intelligence Gap

Compliance failures are usually narrated backward. Once the outcome is known, every warning appears obvious, every missed escalation looks negligent, and every decision seems to point toward the result. The board asks who knew what and when. The investigation searches for the broken control. Management wants the person or moment that explains the failure.

Dr. Hemma Lomax has done it again, leading the discussion in the compliance community. Her most recent book, The Decision Intelligence Gap, asks compliance professionals to look earlier. What happened before the decision became visible? Which assumptions hardened into facts? When did reversal become more expensive? Who noticed something that never gained enough purchase to change the direction? The book’s central insight is that the distance between intention and execution is not space. It is an operating environment shaped by incentives, defaults, authority, silence, pressure, and the accumulated residue of earlier decisions.

That makes this an important book for CCOs, boards, in-house counsel, audit, risk, and business leaders. It is not a conventional compliance manual. It does not provide a new risk taxonomy or a checklist for program design. It offers something more foundational: a way to examine how organizational choices form while there is still time to influence them.

A Book About the Decisions Before the Decision

Lomax defines the Decision Intelligence Gap in two related ways. It is the distance between the responsibility people carry for decisions and the visibility they have into how those decisions form. It is also the space between intention and execution, where choice remains alive. The book develops that idea across five parts: how choice narrows, how decision architecture changes what remains possible, how leaders can redesign the environment, how organizations should respond when things go wrong, and how learning can scale.

The governing image is the trolley problem viewed upstream. Compliance professionals know the familiar last-minute choice between two unacceptable outcomes. Lomax is more interested in what happened before anyone reached the lever. Who laid the track? When did the brakes become unavailable? Which earlier choices reduced the available paths? This move from moral drama to decision architecture is the book’s most valuable contribution.

Several concepts give that architecture practical shape. The silent hijack occurs when a concern is heard but never alters the decision. The threshold paradox describes the point at which an option remains technically open but becomes materially more costly to exercise. Designed desperation arises when the system makes the wrong choice easier, safer, or more serviceable than the right one. Defaults then carry yesterday’s decisions forward until repetition begins to look like legitimacy. None of these concepts removes individual agency. They show why accountability must examine both the actor and the conditions the organization created.

Why Compliance Leaders Should Read It

The book challenges the compliance function’s instinct to become the gatekeeper for every uncertain choice. Lomax does not argue against approvals, bright lines, or specialist authority. Some risks require them. Her sharper point is that a program can become excellent at routing questions to experts while failing to build decision capacity in the business. The CCO answers the immediate question, but the next employee facing similar terrain remains dependent on the same escalation.

Lomax proposes a navigation layer instead. Expertise should travel without automatically taking ownership of the decision. Employees need to understand the objective, the boundary being protected, the conditions that change the answer, the discretion that remains local, and the threshold for seeking another perspective. This is a powerful description of compliance as a business discipline. It moves the function from permission provider to designer of better choices while preserving hard stops where the risk requires them.

Her discussion of speak-up culture is equally strong. The important question is not only whether employees are permitted to report. It is what speaking has come to require and what happens when the room responds. A concern may be incomplete, inconvenient, or wrong. If the first response demands a finished case, the organization may force one employee to do the collective work of noticing, investigating, proving, and solving before the signal deserves attention. Lomax’s idea of being safe to learn goes beyond psychological safety. It asks whether people can contribute uncertainty, revise a position, or discover they were wrong without losing the standing to participate next time.

This insight should reshape investigations. A bad outcome does not prove poor reasoning, and a good outcome does not validate the process that produced it. Lomax’s account of outcome bias provides a disciplined basis for distinguishing accepted risk, ordinary mistake, flawed reasoning, reckless conduct, concealment, and misconduct. The compliance lesson is straightforward: reconstruct the information state at the time of the decision before hindsight rewrites what was knowable. Accountability then becomes more precise, more credible, and more useful to the next decision.

Lomax’s architecture also sharpens the familiar effectiveness question. A policy may be well designed on paper yet fail because the decision environment rewards delay, makes escalation costly, or teaches employees that exceptions are easier to approve than to revisit. Monitoring should therefore test not only control completion but also control use: who bypasses, who escalates, which questions recur, where decisions stall, and whether learning from one matter changes the next. This is where the book connects most directly to modern compliance evaluation.

The Most Useful Tool: HQDM

The book’s most immediately deployable framework is High-Quality Decision Making, or HQDM. It records five elements in proportion to the significance of the choice: the objective and what the organization is actually optimizing for; the thresholds that materially change the answer; the options genuinely available at the time; the rationale connecting facts, assumptions, uncertainty, and choice; and the learning plan, including what to monitor and what would trigger reconsideration.

For compliance professionals, HQDM offers a practical bridge between governance and evidence. It can improve a third-party exception, an AI use-case approval, an investigation disclosure decision, a market-entry choice, or a board risk-acceptance decision. It also creates a contemporaneous reasoning trace that can later help separate a defensible decision from one that merely benefited from luck. Lomax wisely cautions against turning inspectability into surveillance. The record should preserve decision-useful reasoning, not every tentative thought.

The framework also fits the board’s oversight role. A board cannot manage every operating decision. Still, it can ask whether management has identified the objective, made critical assumptions visible, established escalation thresholds, considered viable alternatives, and defined the conditions for returning to the decision. That is a better oversight record than a slide showing that the policy was approved and the training was completed.

Where the Book Requires Compliance Translation

The Decision Intelligence Gap is intentionally a thinking book, not an implementation guide. Its metaphors are memorable, its research base is broad, and its questions are often excellent. Yet compliance teams will still need to convert those ideas into governance mechanisms, owners, data, testing, and metrics. The book explains why a navigation layer matters, but it does not provide a detailed operating model for building one across a global enterprise.

The same issue appears with decision traces. The concept is sound, but the compliance application requires careful design. Records can create discovery, privilege, privacy, retention, and employee-relations consequences. A proportionate trace needs risk tiers, approved fields, access controls, retention rules, legal-hold integration, and guidance on what not to record. Otherwise, a tool intended to make reasoning visible may produce defensive writing or concealment.

AI adds another layer. Lomax correctly warns that putting a human in the loop is meaningless if the human merely approves the system’s preferred answer. A true navigation layer should expose sources, assumptions, uncertainty, alternatives, and override routes. Compliance leaders will need to add the control architecture: data governance, access management, validation, bias testing, monitoring, audit logs, incident response, and clear human accountability. NIST AI RMF and ISO/IEC 42001 can help operationalize that part of the vision.

The Verdict

This is a thoughtful, humane, and unusually relevant book for the compliance profession. Its strength lies in refusing the easy choice between individual blame and system excuse. People retain agency, but they exercise it inside conditions that can make signals harder to share, boundaries harder to hold, and reversals harder to justify. Effective compliance must examine both.

CCOs should read The Decision Intelligence Gap not as a substitute for the DOJ’s Evaluation of Corporate Compliance Programs, COSO, investigations protocols, or AI governance frameworks, but as a connective operating philosophy. It explains why policies can be clear while decisions remain poor and why speak-up programs can be available. At the same time, silence persists, and why lessons learned can be documented while organizational capability barely grows. It is especially valuable for compliance leaders ready to move from owning answers to building an organization that decides, learns, and adapts with integrity.

Questions for CCOs and Boards

Decision visibility. Which high-risk choices are becoming expensive to reverse before they reach formal approval?

Speak-up response. What does the organization do with an unfinished concern, and what does that response teach the next employee?

Accountability. Can investigations distinguish a bad outcome from poor reasoning and a mistake from misconduct without losing either fairness or rigor?

Learning loop. Where do investigation findings, exceptions, overrides, and near misses change the conditions of the next decision?

Navigation. Is compliance increasing the business’s capacity to recognize thresholds and exercise sound judgment, or merely increasing the number of questions routed to Compliance?

Categories
Everything Compliance - Shout Outs and Rants

Shout Outs and Rants: AI, Investigations, Kickbacks and Kids

Welcome to a new season of Everything Compliance – Shout Outs and Rants. We have a new host, Adam Turteltaub, and a new panelist, Rebecca Walker, who joins returning regulars Jonathan Armstrong and Karen Moore for the next iteration of Everything Compliance Shout Outs and Rants.

  • Adam shouts out to the Boeing documentary Free Fall and Peter Robison’s book Flying Blind for lessons on culture, whistleblowers, and safety, and praises United Airlines for returning a plane to address a mechanical issue.
  • Rebecca raises a compliance training dilemma: employees using company AI tools to answer test or “test-out” questions, which may look like cheating and undermine training records in an investigation, yet could mirror desired real-world behavior if employees are expected to consult policies, compliance, or an AI chatbot when issues arise.
  • Jonathan recounts a scandal involving Scotland’s First Minister John Swinney, including FOI-revealed travel costs (about £45,000 in flights and significant car hire) allegedly contrary to policy and justified as meetings in Kentucky.
  • Karen shouts out to the 25 incoming Fordham MSL Introduction to Corporate Compliance students and reflects on the shift from accidental to intentional compliance careers.

Everything Compliance Shout Outs and Rants is a production of the Compliance Podcast Network.

Categories
FCPA Compliance Report

FCPA Compliance Report: Charisma Doesn’t Scale, Controls Do: Compliance Lessons from Ted Lasso

In this episode, I take things in a very different direction. Last week I did a 5-part blog post series on leadership lessons from the hit TV show Ted Lasso. I took those 5 blog posts and fed them into Notebook LM. What came out, in the AI voices of Timothy and Fiona, is what I posted for this podcast.

Timothy and Fiona use Ted Lasso characters as operational profiles to show why empathetic leadership and “good vibes” are insufficient under compliance frameworks like the DOJ ECCP, COSO, and the Caremark Doctrine. Some of the analysis includes:

  • Ted Lasso creates psychological safety but introduces key-person risk by relying on an open-door culture without institutional “listen-up” systems, case logging, escalation, and anti-retaliation protections; his immediate forgiveness of Rebecca’s sabotage illustrates why mercy cannot replace investigation, evidence preservation, root-cause analysis, and remediation.
  • Rebecca Welton exemplifies corrupted tone at the top and conflicts of interest, including her relationship with Sam, before shifting toward accountable governance by rejecting unethical commercial moves and selling 49% to fans.
  • Keeley Jones highlights governance debt from rapid scaling, affinity hiring, and investor conflicts, leading to incident-response and third-party concentration failures.
  • Roy Kent demonstrates “tone in the middle,” accountability, and root-cause diagnosis, but also risks of unchecked informal authority.
  • Nate Shelley shows the danger of promoting technical skill without evaluating leadership ethics, enabling “relocating harm,” data silos, and a major confidentiality leak—reinforcing that auditable controls, oversight, and monitoring must outlast charisma.

I would really like to hear your thoughts on this podcast and the approach I have taken. I would greatly appreciate it if you left a comment or emailed me your reaction to both my use of Notebook LM for this analysis and the AI-generated voices for Timothy and Fiona.

 

Blog Posts on the following Ted Lasso characters:

Ted Lasso

Rebecca Welton

Nate Shelley

Roy Kent

Keeley Jones

Other Takes on Ted Lasso

Tom and Matt Kelly on Ted Lasso in Compliance into the Weeds

Matt Kelly in Radical Compliance

Categories
Compliance and AI

Compliance and AI: Designing Compliance Into iGaming Products From Day One with Mouhcine Jalili

What is the intersection of AI and compliance? What about machine learning? Are you using ChatGPT? These questions are just three of the many we will explore in this cutting-edge podcast series, Compliance and AI, hosted by Tom Fox, the award-winning Voice of Compliance. Today, Tom visits with Mouhcine Jalili, VP of Growth – iGaming at Software Mind, to reframe iGaming compliance as a design, delivery, and platform challenge rather than an end-stage legal checklist.

Jalili brings 15 years of exclusive iGaming experience, having grown from operational roles into commercial, team growth, and technology-focused leadership, and he currently serves as Vice President for Growth in iGaming at Software Minds. He views operational compliance and governance as a design-and-delivery challenge rather than merely a legal checklist, because many of the biggest risks arise when product changes are rolled out across regulated markets without the right release management and controls. From his perspective, responsible gambling and other market-specific requirements should be engineered into the product from the start through automated controls, strong configuration management, and close collaboration between compliance, product, delivery, and engineering teams. Overall, Jalili believes iGaming governance works best when compliance is embedded directly into the system architecture and operational process, making the whole organization more resilient and easier to scale.

Resources:

Connect with Mouhcine Jalili on LinkedIn

Software Mind

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

Ted Lasso Week: Part 5 – Keeley Jones: Independence, Ethical Growth, and Governance Under Pressure

Season 4 of Ted Lasso is out. Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over five blog posts, I have considered Manager Ted Lasso, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today we conclude with Part 5, where we look at Keeley Jones, who starts as a social media influencer for AFC Richmond but goes on to found her own business. We explore what happens when a talented professional becomes a founder and must build the organization around her.

Keeley has judgment, courage, creativity, and empathy. She can read a room and recognize misconduct before people with greater status are willing to name it. Yet this only reveals that ethical instinct is not the same as governance. As her authority grows, decisions involving friends, investors, employees, personal relationships, privacy, and funding require processes that do not depend solely on the founder making the right call. For compliance professionals, Keeley’s story is about governance keeping pace with growth.

Ethical Leadership Begins Before the Title

Keeley earns influence before she has formal authority. In “The Diamond Dogs” (Season 1, Episode 8), she discovers that Rebecca arranged the paparazzi scheme involving Keeley and Ted. She confronts Rebecca and insists that she tell Ted the truth. The friendship does not excuse the misconduct, and Rebecca’s ownership of Richmond does not silence Keeley.

Keeley acts as Richmond’s missing speak-up system. Her intervention leads to Rebecca’s confession in “All Apologies” (Season 1, Episode 9). The lesson is not that every employee should conduct an investigation alone. It is that organizations need people who will raise difficult issues and systems that protect them when they do. A best-practice compliance program must have reporting and guidance mechanisms employees can use without fear of retaliation. Keeley dares to speak. A mature organization should not make courage the control.

Entrepreneurship Creates Governance Debt

Keeley’s public-relations work for Richmond turns into an opportunity to build her own firm. In “Inverting the Pyramid of Success” (Season 2, Episode 12), investors offer to fund Keeley’s venture, KJPR. Rebecca encourages her to take the opportunity. The funding provides staff, offices, and credibility. It also creates governance debt. Keeley now answers to a board she did not build and depends on a capital provider she does not control. The founder’s personal brand becomes part of the firm’s risk profile.

KJPR should know who approves hiring, client commitments, spending, external statements, workplace relationships, access to sensitive information, and crisis decisions. Growth does not eliminate the need for speed. It prevents speed from becoming uncontrolled discretion.

Hiring a Friend Tests Founder Judgment

In “(I Don’t Want to Go to) Chelsea” (Season 3, Episode 2), Keeley hires her friend Shandy after seeing her demonstrate creative ability during a commercial shoot. Keeley recognizes overlooked talent because she was once overlooked herself. That instinct is admirable. The process is weak. The decision appears to lack a defined role, structured assessment, reference checks, clear reporting line, or behavioral expectations. Shandy later makes unauthorized decisions and publishes an offensive campaign that damages a client relationship. In “Signs” (Season 3, Episode 5), Keeley fires her.

Keeley ultimately protects the firm. She also learns that loyalty cannot substitute for selection controls. A founder who hires a friend should disclose the relationship, use an independent reviewer, document qualifications, define authority, and establish measurable performance expectations. The safeguards protect the company, the team, and the friendship.

DOJ’s Evaluation of Corporate Compliance Programs (ECCP) asks whether organizations use risk-based processes: “Does the company deploy its compliance resources in a risk-based manner, with greater scrutiny applied to greater areas of risk?”; train people for their responsibilities, “targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions”; and finally apply discipline consistently, “Does the compliance function monitor its investigations and resulting discipline to ensure consistency?” Those questions matter at twenty employees as well as twenty thousand. Informality can be proportionate. It cannot be indistinguishable from favoritism.

Investor Influence Becomes a Conflict

KJPR’s most significant governance failure arises when Keeley begins a romantic relationship with Jack Danvers, the venture capitalist whose firm funds KJPR. Their relationship begins in “Signs” and becomes public inside the office in “The Strings That Bind Us” (Season 3, Episode 7). The central issue is not the relationship itself. It is the power structure around it. Jack influences the capital supporting KJPR and has access to its leadership and board. Keeley’s personal relationship is therefore inseparable from financing, employment stability, reputation, and strategic control.

A functioning conflicts process would require disclosure to disinterested board members, recusal from relevant funding and compensation decisions, independent review, anti-retaliation protections, and a plan for managing the relationship’s end. The organization would also need to consider whether gifts and public displays create obligations or perceptions of influence. KJPR appears to have no independent mechanism for doing any of this. The conflict remains personal until its consequences become corporate.

A Privacy Crisis Reveals Whose Reputation Matters

In “We’ll Never Have Paris” (Season 3, Episode 8), an intimate video Keeley previously sent to Jamie is leaked online. Jack’s lawyers prepare a public statement in which Keeley would apologize for making the video. Keeley refuses. Her refusal is an ethical decision. The statement would shift responsibility from the people who stole and distributed private material to the person whose privacy was violated. It would protect investor reputation by requiring the victim to accept blame.

An effective incident response would center Keeley’s safety and agency while preserving evidence, identifying the source and scope of the breach, assessing legal duties, seeking removal of the material, coordinating communications, and reviewing data security practices. It would also determine what the company knows, who decides, and when the board receives information.

Capital Concentration Threatens Independence

The conflict reaches its predictable conclusion in “International Break” (Season 3, Episode 10). Jack’s board withdraws KJPR’s funding, the office is dismantled, and Keeley learns that the firm will close within two days. She is the founder, but she is the last person meaningfully informed. This is third-party and concentration risk. KJPR depends on one financial sponsor whose governance rights, exit powers, and personal connections could end the business. DOJ’s ECCP asks whether companies understand the business rationale and risks of third-party relationships, use appropriate contractual controls, and monitor those relationships over time.

For a founder, due diligence must run both ways. Before accepting capital, leaders should understand board control, reserved powers, termination rights, communication duties, reputation expectations, data ownership, dispute mechanisms, and contingency funding. A capitalization table is also a control map. Rebecca ultimately offers financing, and Barbara leaves Jack’s organization to rebuild alongside Keeley. The outcome is hopeful, but the governance lesson remains. Replacement capital should not recreate the same dependency under a more trusted name. Friendship does not eliminate conflicts. It makes clear documentation more important.

Independence Does Not Mean Isolation

By “So Long, Farewell” (Season 3, Episode 12), Keeley has rebuilt the firm with Barbara and presents Rebecca with a proposal for an AFC Richmond women’s team. Her final act is not a return to the security of working for someone else. It is the launch of a new strategic opportunity grounded in purpose, partnership, and a broader vision for Richmond. Keeley also refuses to let Roy and Jamie reduce her future to a choice between them. She defines her professional and personal direction herself.

The strongest version of independence is not freedom from investors, colleagues, boards, or controls. It is the ability to make principled decisions within governance that protects the organization from dependency, favoritism, coercion, and the founder’s own blind spots.

Questions for CCOs

Keeley’s journey should prompt five questions:

  1. Are governance, compliance, and control responsibilities growing as quickly as the business?
  2. Do hiring and promotion processes manage friendship, affinity, and founder bias?
  3. Can a genuinely independent decision-maker review conflicts involving investors, directors, or founders?
  4. Does the incident-response plan protect affected people while addressing legal, technical, and reputational risk?
  5. Could the loss of one investor, client, platform, or vendor threaten the organization’s survival?

The Richmond Way

Across five character studies, AFC Richmond gives compliance professionals a complete operating model. Ted shows that culture begins with trust and psychological safety. Rebecca shows that power requires independent oversight. Nate shows that promotion can create culture risk. Roy shows that middle managers make standards real. Keeley shows that growth must be matched by governance.

The connecting principle is effectiveness. DOJ, COSO, Caremark, and the Sentencing Guidelines all point to organizations beyond statements of intent. Leaders must design systems, empower people, monitor behavior, respond to warning signs, remediate failures, and test whether improvements work.

Belief can start a culture. Accountability sustains it.

Categories
AI Today in 5

AI Today in 5: August 20, 2026, The Between Scylla and Charybdis Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world on compliance, ethics, risk management, leadership, or general interest in AI.

Top AI stories include:

  1. AI for compliance in the trucking industry. (CCJ Digital)
  2. 6 top AI tools for compliance. (Impakter)
  3. Don’t let AI strategy outpace your network strategy. (Fedscoop)
  4. FTC puts companies between Scylla and Charybdis. (Law.com)
  5. AI governance and data analytics in healthcare. (Healthcare Innovation)

For more information on using AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.

Categories
Blog

Ted Lasso Week: Part 4 – Roy Kent: The Compliance Power of the Middle Manager

Season 4 of Ted Lasso is out. Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over five blog posts, I have considered Manager Ted Lasso, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today in Part 4, I consider the sometimes painful transition of an aging sports star into middle-management coaching.

In Part Three, Nate Shelley demonstrated the danger of promoting technical talent without preparing or monitoring the new manager. Roy Kent provides the counterpoint. He is demanding, impatient, and frequently intimidating, but he understands that leadership happens close to the work. Ted can articulate Richmond’s values. Rebecca can provide authority and resources. Roy determines whether those values survive contact with the locker room. He corrects behavior, confronts stars, coaches struggling employees, and translates general expectations into specific action.

For compliance professionals, Roy illustrates the power of the middle manager. He also shows the risk. The same informal authority that can strengthen culture can magnify poor judgment when it is not bounded by self-awareness, escalation, and accountability.

Authority Exists Before the Title

Roy begins the series as Richmond’s captain, not a member of management. Yet his teammates watch him, follow him, and adjust their behavior around him. He has informal authority, which often matters more than the organizational chart.

In “Trent Crimm: The Independent” (Season 1, Episode 3), Ted recognizes that Jamie Tartt and other players are bullying Nate. Rather than solve the problem solely through formal coaching authority, Ted pushes Roy to act. Roy confronts Jamie and forces the locker room to change. That is the tone in the middle. Employees often look to a respected supervisor, veteran, or peer leader to determine whether the code of conduct is real. If that person laughs at an offensive joke, ignores a control override, or protects a top performer, the policy loses. If that person intervenes, the standard gains operational force.

The DOJ Evaluation of Corporate Compliance Programs (ECCP) directs prosecutors to examine how managers at all levels encourage or discourage compliance through their words and actions. Compliance leaders therefore need to identify informal influencers, not merely designated supervisors. On this point, the ECCP states, “it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” Culture travels through both. The ECCP goes on to state “[t]he company’s culture of compliance, including awareness among employees that any criminal conduct, including the conduct underlying the investigation, will not be tolerated.”

Standards Must Apply to Stars and to the Manager

Roy’s credibility comes partly from his willingness to confront Jamie, Richmond’s most talented player. He refuses to accept the idea that performance excuses selfishness or abuse. That is a central compliance principle. Standards that bend around revenue generators and star executives are not standards.

Roy faces the same test personally in “All Apologies” (Season 1, Episode 9). His age and injuries have reduced his performance, but his identity is tied to being captain and playing every match. When Ted decides to bench him, Roy initially resists. He ultimately reports for training in the reserve bib and supports the team. The decision matters because accountability becomes credible when the influential employee accepts the rule applied to everyone else. Roy does not enjoy the outcome, but he demonstrates that status does not confer immunity.

Effective Coaching Diagnoses the Cause

In “The Hope That Kills You” (Season 1, Episode 10), Roy selects Isaac McAdoo as the next captain. By “Rainbow” (Season 2, Episode 5), Isaac is struggling under the weight of that role. Ted asks Roy for help. Roy does not respond with another motivational speech or a threat. He takes Isaac to the neighborhood pitch where Roy learned to play and places him in an informal match. The intervention helps Isaac rediscover that football is a game he loves.

This is root-cause analysis at the individual level. The visible problem is poor performance. The underlying issue is that responsibility has displaced purpose and confidence. Roy changes the environment, observes Isaac, and chooses an intervention connected to the cause. The compliance application is substantial. When an employee misses a control, a manager should not automatically assign retraining. The cause may be an unrealistic target, conflicting procedures, poor system design, inadequate staffing, fear of escalation, or a supervisor who rewards shortcuts. Training cannot repair a misaligned incentive. Discipline cannot correct an unusable process.

Coaching Can Turn a Risk Into an Asset

Roy’s relationship with Jamie becomes his strongest management case. He begins by confronting Jamie’s entitlement. In “Man City” (Season 2, Episode 8), after Jamie finally strikes back at his abusive father, Roy recognizes the pain beneath the conduct and embraces him. The response is neither a lecture nor an endorsement of violence. It is a manager recognizing that the employee needs support before instruction.

In “4-5-1” (Season 3, Episode 3), Jamie asks how he can become better than Zava. Roy offers to train him. The work continues through “Sunflowers” (Season 3, Episode 6), when their training in Amsterdam becomes reciprocal, and Jamie teaches Roy to ride a bicycle. Roy does not lower the standard for Jamie. He gives him the discipline, attention, and feedback needed to meet a higher one. This is what good remediation should accomplish. It should protect the organization while creating a credible path for behavioral improvement.

Managers need tools for these conversations: clear expectations, documented feedback, measurable improvement goals, support resources, escalation thresholds, and follow-up. Candor without structure can become hostility. Compassion without standards can become avoidance. Roy is most effective when he combines both.

Informal Power Can Also Amplify Bad Judgment

Roy is not a flawless compliance model. In “Big Week” (Season 3, Episode 4), he and Coach Beard show the players security footage of Nate tearing the “BELIEVE” sign, despite Ted’s decision not to use it as motivation. The team becomes enraged, loses discipline, receives multiple red cards, and falls to West Ham. Roy intends to motivate. He instead weaponizes internal security footage and emotional injury.

The failure offers three lessons. First, managers must understand the limits of delegated authority. Silence or ambiguity from senior leadership is not permission to bypass its stated judgment. Second, incentives built on anger can produce foreseeable misconduct. Third, a result-driven culture can make an improper method appear acceptable until the damage becomes visible.

Roy’s training methods can also cross from demanding into unsafe or humiliating, as the red-string exercise in “The Strings That Bind Us” (Season 3, Episode 7) demonstrates. A strong manager should challenge employees. The organization must still set boundaries around safety, dignity, and acceptable conduct. This is why middle-management training cannot be limited to explaining policy. Managers need scenario-based practice on investigations, privacy, retaliation, discipline, escalation, health and safety, conflicts, and the use of employee information.

The Best Managers Remain Coachable

Roy’s development is possible because he gradually accepts that leadership does not require invulnerability. In “So Long, Farewell” (Season 3, Episode 12), he joins the Diamond Dogs, asks whether people can change, and later begins therapy. He becomes Richmond’s manager, but his promotion is framed as the next stage of development, not proof that the work is finished.

That distinction matters. Organizations often treat promotion as validation rather than increased risk. The best managers remain open to feedback, seek guidance, acknowledge uncertainty, and use available expertise. Middle managers are a critical source of that information. They should not filter out bad news to protect their numbers. Boards and executives should ask whether managers escalate emerging risks, whether the organization rewards such escalation, and whether retaliation or fear is blocking the flow of information.

Questions for CCOs

Roy’s journey should prompt five questions:

  1. Who are the organization’s informal culture carriers, and how are they engaged?
  2. Are managers evaluated and rewarded for how they achieve results, not only for the results themselves?
  3. Do managers know how to diagnose root causes, escalate concerns, and document behavioral coaching?
  4. Are high performers subject to the same conduct standards as everyone else?
  5. Does manager training distinguish productive candor from intimidation, retaliation, humiliation, and unsafe pressure?

Roy Kent demonstrates that middle managers are the operational heart of compliance. They make standards visible, detect weak signals, and decide whether employees experience accountability as fair. Compliance cannot succeed around them. It must succeed through them.

Next in the Series: Keeley Jones and Governance Under Pressure

Roy’s challenge is translating established values into frontline behavior. Keeley Jones faces the next organizational stage: building a business, accepting investor capital, managing employees, and preserving independence while personal and commercial pressures converge. Join us in our series finale, where we will examine founder risk, conflicts of interest, privacy, third-party influence, and why governance must grow as quickly as the company it is designed to protect.

Categories
AI Today in 5

AI Today in 5: August 19, 2026, The Failing Safeguards Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world on compliance, ethics, risk management, leadership, or general interest in AI.

Top AI stories include:

  1. How AI is changing communications compliance. (UC Today)
  2. How financial institutions can use LLMs. (FinTechMagazine)
  3. The future of enterprise AI sovereignty. (TechTarget)
  4. AI reliability. (ESGDive)
  5. AI breaches show AI falling short on safeguards. (FT)

For more information on using AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.