Tag: compliance

Categories
Blog

Connected Compliance: Part 2 – From Risk Register to Risk Radar

An effective compliance program is not a collection of disconnected policies, training modules, hotline reports, and investigation files. It is an operating system. Culture determines whether employees will use it. Risk assessment tells the organization where it must adapt. Investigations test whether the system responds credibly. Whistleblower programs reveal whether employees trust it enough to speak. Blog 1 examined communication as the control that connects those elements. In this Part 2, we examine what compliance must do with the intelligence that communication produces.

The traditional risk assessment was built for a world that moved more slowly. Compliance gathered a group of leaders, reviewed enforcement trends, scored familiar risks, produced a heat map, and returned to the exercise the following year. That process still has value, but it is no longer enough.

Today, a new market restriction, customer demand, artificial intelligence deployment, supply-chain disruption, sanctions measure, or data rule can alter the company’s risk profile before the annual plan is approved. The central question is therefore not whether the organization has a risk register. It is whether compliance has a risk radar that can detect change, decide what matters, assign ownership, and translate the signal into action.

Every Compliance Risk Has a Political Dimension

Compliance obligations do not develop in a vacuum. They reflect choices made by governments about national security, trade, technology, labor, privacy, corruption, competition, and corporate accountability. For a multinational company, those choices may conflict, overlap, or change with little notice. Particularly in this political age, the single most-used byword is volatility.

That makes geopolitical awareness a compliance capability. It does not require the CCO to become a foreign-policy analyst. It requires the compliance function to understand how political priorities can become legal obligations, enforcement pressure, customer expectations, or operational constraints. Export controls can reshape product access. Sanctions can alter payment and counterparty risk. Forced-labor requirements can reach deep into a supply chain. AI rules can change how a business collects data, develops products, and makes decisions.

The practical lesson is that legal change is often the last stage in a longer policy development process. Compliance should monitor the earlier signals: legislative proposals, agency speeches, enforcement patterns, trade measures, customer questions, supplier difficulties, and operational workarounds. These indicators do not all demand a program change, but they should enter a disciplined triage process.

What the DOJ Is Really Asking

The Department of Justice has made dynamic risk assessment part of the effectiveness inquiry. The 2024 Evaluation of Corporate Compliance Programs (ECCP) directs prosecutors to consider “emerging risks as internal and external circumstances impacting the company’s risk profile evolve.” This risk profile can change due to factors outside a company’s control or its own business decisions. Moreover, the ECCP language moves risk assessment beyond a scheduled document and into continuous management.

DOJ then asks: “Is the company’s approach to risk management proactive or reactive?” The distinction is critical. A reactive program updates controls after a failure, enforcement action, or audit finding. A proactive program uses operational information across functions to identify change before misconduct occurs. The ECCP also asks whether periodic review is merely a point-in-time exercise or draws on continuing access to operational data, and whether the results lead to updates in policies, procedures, and controls.

The enforcement question is not whether the company predicted every development. No program can. The question is whether the company had a reasonable process for identifying material changes, directing resources to higher-risk areas, documenting its decisions, and revising the program over time.

Build the Risk Radar From Multiple Signals

A dynamic risk process begins with a wider field of vision. Regulatory alerts and outside counsel updates are useful, but they show only part of the environment. Some of the earliest warnings come from inside the business. Sales may see unusual customer demands in a new market. Procurement may find suppliers unable to provide origin information. Finance may identify payment routes that no longer fit the expected transaction. Information security may discover employees using unapproved AI tools. Human resources may raise concerns about retaliation or pressure related to performance targets. Audit may identify recurring exceptions. Hotline reports and investigations may reveal a pattern that a heat map missed.

Compliance should bring these signals together through a repeatable cadence. A quarterly cross-functional review can examine changes in the business model, geography, products, third parties, technology, enforcement, and employee concerns. High-velocity risks may require monthly or event-driven review. The objective is not to create another committee. It is to establish a reliable place where weak signals are compared, challenged, and assigned.

Or simply look at the changes wrought by the Trump Administration in 2026 alone. Venezuela is now open for business. How about the Democratic Republic of Congo? See here and here. Of course there is Iran, but you have to ask what week it is and are we doing business with Iran or are we at war with Iran.

Give One Person the Clock

Emerging risks often fall between organizational boxes. Legal understands the rule. Compliance sees the control issue. Operations owns the process. Procurement controls the supplier relationship. Technology owns the system. To use a well-worn maxim, if everyone is in charge, no one is in charge. In the corporate world, when everyone is generally responsible, no one is specifically accountable. This is both why and where compliance needs to step up its game.

Every material risk needs a named owner with the authority to convene the necessary functions, set deadlines, escalate disagreements, and report on the disposition. That person does not perform every task. The owner keeps the clock, maintains the decision record, and ensures that the issue does not disappear between meetings.

Governance should also define escalation triggers. A credible framework identifies which developments require immediate executive attention, which can be handled through a working group, and which should remain under observation. Without thresholds, organizations either under-escalate material risk or flood leadership with undeveloped issues.

Use a Two-Speed Assessment

Not every signal requires an enterprise-wide risk assessment. Compliance needs two speeds. The first is rapid triage. A small group of subject-matter experts identifies the potential legal obligation, affected operations, time horizon, severity, available data, current controls, and immediate containment needs. This is where AI can play a key role in compliance, essentially superforecasting risks to enable quick, efficient risk management strategies when volatility hits. Additionally, such an approach may lead to a decision to monitor, take interim action, or launch a deeper review.

The second is formal assessment. Complex or high-impact risks may require structured interviews, data analysis, control testing, external counsel, forensic support, or scenario planning. The deeper process should be proportionate to the exposure, not triggered simply because the issue is new. This two-speed model protects agility without sacrificing rigor. It also creates evidence that the company made a reasoned decision. A short written triage record can show what information was considered, who participated, why the company chose its response, and when the issue will be reviewed again.

Convert Assessment Into Real Controls

The most common failure is not the inability to identify risk. It is the failure to convert assessment into a viable risk management strategy and then to implement, monitor, and improve your business operations. A new questionnaire, certification, or policy may create documentation, but documentation alone does not mitigate the underlying exposure.

Consider third-party risk. A supplier questionnaire can identify missing information, but the control lies in what happens next: enhanced diligence, contractual protection, source verification, payment restrictions, audit rights, monitoring, remediation, or a decision not to proceed. The same principle applies to AI. An AI-use policy matters, but effective governance also requires an inventory of use cases, approval gates, data controls, human oversight, testing, monitoring, and accountability.

Each response should identify the control objective, owner, implementation date, evidence, and testing method. Compliance should also ask what existing control can be adapted before building a separate program. Strong governance, escalation, training, data access, and investigation processes are reusable infrastructure across risk domains.

Resource allocation is part of that conversion. If a changing risk profile calls for deeper third-party monitoring, faster export review, or additional AI oversight, the organization must decide what people, technology, and budget will support the response. Compliance cannot claim to be risk-based when yesterday’s priorities continue to dictate today’s resources. The allocation decision, including any accepted constraint, should be visible and documented.

Treat Change Management as a Control

A technically correct response can still fail if employees do not understand it or the business cannot implement it. New requirements frequently collide with established incentives, systems, customer commitments, and local practice. Change management should therefore be part of the control design. Explain why the risk changed. Identify which decisions and workflows are affected. Train the employees and gatekeepers who must act differently. Provide a practical escalation route. Test understanding. Gather feedback. Then revise the process when implementation exposes friction or unintended consequences. For a full discussion of change management as a compliance control, listen to the podcast Ronnie Feldman and I did with Caveni Wong on this episode of Creativity and Compliance.

This is where blog post 1’s communication discipline comes into play. Compliance cannot adapt to risk through broadcast messages alone. It needs a two-way channel that tells employees what changed and tells compliance whether the response works in practice.

Measure Adaptation, Not Activity

The number of risk meetings or completed assessments says little about effectiveness. Better measures test whether the organization moves from signal to decision and from decision to control. Useful indicators include the time required to triage a material development, percentage of actions with named owners and deadlines, overdue remediation, control implementation and testing results, repeat exceptions, unresolved ownership disputes, and lessons incorporated from investigations.

Compliance should also examine whether resources shifted when risk shifted. A program that identifies a higher risk but leaves staffing, monitoring, and controls unchanged has produced analysis without management. The result should be a closed loop: detect, assess, assign, mitigate, test, and learn. That loop turns risk assessment from an annual artifact into a management process.

That transition is where program credibility is tested. Join us tomorrow as we consider how organizations scope investigations, preserve independence, establish consistency, document decisions, and convert findings into remediation. A dynamic risk process helps the company see the signal. A credible investigation determines what happened and what the organization must do next.

Bonus Questions for Compliance Professionals

  1. Which internal and external signals can change the company’s risk profile between formal assessments?
  2. Who has specific ownership for emerging risks that cross legal, compliance, operations, procurement, finance, and technology?
  3. What criteria determine whether an issue is monitored, triaged, escalated, or formally assessed?
  4. Can the company show how a recent risk assessment changed a policy, control, resource allocation, or business decision?
  5. Do substantive mitigation and ongoing monitoring support questionnaires and certifications?
  6. How quickly can the organization move from a weak signal to a documented decision?
  7. What recent investigation finding should change the current risk assessment?
Categories
Blog

The Enterprise Incident: 5 Compliance Lessons from a High-Stakes Deception

In The Enterprise Incident, Captain Kirk appears to suffer a breakdown. He orders the USS Enterprise across the Neutral Zone and into Romulan territory, where three Romulan vessels immediately surround the ship. Kirk claims that a navigational error caused the incursion. Spock refuses to support that explanation. Instead, he testifies that Kirk has become irrational and is no longer fit for command. Dr. McCoy confirms the diagnosis. Kirk then appears to die after attacking Spock. Of course, none of this is what it seems.

Kirk, Spock, and McCoy are executing a classified Federation operation to steal a Romulan cloaking device. Kirk’s breakdown is staged. Spock’s betrayal is part of the plan. The supposed Vulcan death grip is a fiction. Kirk is surgically disguised as a Romulan, returns to the enemy vessel, steals the device, and escapes with the Enterprise.

The mission succeeds. Yet operational success does not necessarily establish that the underlying decisions were ethical, properly governed, or worth the risk. That tension makes The Enterprise Incident an outstanding study in compliance leadership. It presents five lessons for compliance professionals operating in high-pressure environments.

Lesson 1: Ethical Decision-Making Requires More Than Authorization

Kirk’s mission was not an impulsive act. He was operating under Federation orders. Nevertheless, the operation required deception, an illegal border crossing, theft of sensitive technology, and conduct that could have triggered an interstellar conflict. Authorization matters, but authorization alone does not resolve the ethical question.

Corporate misconduct is often defended with some variation of “senior management approved it” or “the business required it.” Those statements do not transform improper conduct into ethical conduct. They may instead reveal weaknesses in governance, escalation, and executive accountability.

Compliance leaders must ask whether a proposed course of action is consistent with the organization’s legal obligations, stated values, risk appetite, and long-term interests. They must also consider whether the action could withstand scrutiny from regulators, shareholders, employees, and the board. Under pressure, the temptation is to focus exclusively on the desired outcome. The stronger approach is to examine both the objective and the means used to achieve it.

A successful mission can still represent a governance failure. Compliance must help the organization distinguish between what it can do, what it should do, and what it must never do.

Lesson 2: Confidentiality Must Not Eliminate Accountability

The Enterprise crew succeeds because Kirk, Spock, McCoy, and Scotty understand their roles and trust one another. Within that small group, the plan is carefully coordinated. Outside the group, almost everyone is intentionally misled. This is a classic need-to-know operation. It also demonstrates the risk created when secrecy becomes a substitute for accountability.

Organizations sometimes need to restrict information. Internal investigations, acquisition discussions, government inquiries, cybersecurity incidents, and sensitive personnel matters all require confidentiality. The mistake is assuming that confidentiality means normal controls no longer apply. Even the most sensitive matter should have an accountable owner, defined decision rights, appropriate legal oversight, protected documentation, and a process for reporting to the board when necessary. Information may be limited, but accountability should remain clear.

This lesson is particularly important in internal investigations. An investigation may require discretion, but the organization must still preserve evidence, manage conflicts, document decisions, protect against retaliation, and identify who receives the findings. The key distinction is between controlled confidentiality and organizational opacity. Controlled confidentiality protects the integrity of the process. Opacity protects decision-makers from scrutiny. Trust among a small team is valuable. It is not a replacement for governance.

Lesson 3: Sensitive Technology Demands Controls Across Its Entire Lifecycle

The Romulan cloaking device is more than a valuable piece of equipment. It is strategically significant technology capable of changing the balance of power. The Enterprise crew focuses first on acquiring the device. Scotty must then integrate an unfamiliar piece of Romulan technology into the ship’s systems while the Enterprise is under attack. There is little time for testing, security review, or compatibility analysis.

Modern organizations face similar issues with artificial intelligence, source code, proprietary algorithms, customer data, trade secrets, surveillance tools, and cybersecurity capabilities. The risk does not begin or end with acquisition. It extends across the technology’s entire lifecycle. The cloaking device also raises a broader question: Just because technology can create a strategic advantage, should the organization deploy it immediately?

That question is central to AI governance. A new AI system may promise speed, efficiency, and competitive advantage. It may also create risks related to privacy, discrimination, intellectual property, cybersecurity, and regulatory compliance. The organization needs more than an enthusiastic business sponsor. It needs governance, testing, documentation, human oversight, and clear accountability. Innovation without controls creates unmanaged exposure. Controls without an understanding of the technology create false assurance.

Lesson 4: Regulatory and Geopolitical Risk Must Be Built into Strategy

The Neutral Zone is not simply a line on a star chart. It represents a legal, diplomatic, and military boundary. Crossing it creates consequences that extend far beyond the Enterprise. International businesses operate across their own versions of the Neutral Zone. These include anti-bribery laws, sanctions, export controls, data localization requirements, competition rules, human rights expectations, and restrictions on technology transfers.

A decision that appears commercially attractive in one jurisdiction may create serious exposure in another. A third party that looks essential to market access may present corruption or sanction risks. A technology transfer may implicate national security restrictions. A routine payment may become evidence of an improper inducement. Compliance cannot be brought in after the business has crossed the border.

The compliance function should participate in market-entry decisions, transactions, major technology transfers, and relationships involving government touchpoints. This requires more than maintaining a regulatory inventory. It requires understanding how legal, political, cultural, and enforcement risks affect business strategy. The Enterprise had only one hour to respond to the Romulan demand for surrender. Corporate leaders often face similar pressure, although usually without disruptor beams. The time to establish decision protocols is before the crisis begins.

Lesson 5: Compliance Should Enable Calculated Risk, Not Eliminate It

Stealing the cloaking device was extraordinarily risky. It also offered a significant strategic benefit. Starfleet decided that the potential value justified the exposure. Every organization takes risks. The purpose of compliance is not to eliminate risk or prevent innovation. It is to help the organization understand risk, evaluate it intelligently, establish limits, and make accountable decisions.

A calculated risk is not simply a dangerous decision that happens to succeed. It is a decision supported by reliable information, appropriate expertise, documented assumptions, mitigation measures, clear ownership, and contingency planning. The Enterprise mission depended on several assumptions. The Romulans had to accept Kirk’s apparent instability. The commander had to believe Spock’s betrayal. Kirk’s disguise had to work. Scotty had to integrate the cloaking.

Compliance adds value when it helps the business take better risks. That requires early engagement, commercial understanding, credible challenge, and a willingness to say no when the proposed conduct crosses a legal or ethical boundary.

Final Thoughts

The Enterprise Incident ends with the Enterprise escaping Romulan space under the protection of the stolen cloaking device. The operation succeeds because of extraordinary coordination, technical skill, and trust. Yet the episode leaves compliance professionals with a harder question: Was the mission properly governed, or was it simply successful?

That distinction matters. Results do not validate weak processes. Senior approval does not cure unethical conduct. Confidentiality does not remove accountability. Innovation does not override controls. Strategic pressure does not suspend legal obligations. The compliance professional’s role is to help the organization navigate those tensions before it enters the Neutral Zone.

The final compliance lesson from The Enterprise Incident is straightforward: Bold leadership may take the organization into uncertain territory, but effective compliance ensures that it does not cross the line without understanding what lies on the other side.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 57 – Compliance Leadership Lessons from The Enterprise Incident

In this episode of Trekking Through Compliance, we consider the episode The Enterprise Incident, aired on September 27, 1968, Star Date 5031.3.

Story Synopsis

The Enterprise Incident follows Captain James T. Kirk and his crew as they undertake a daring and covert mission within the Neutral Zone, the border region between the United Federation of Planets and the Romulan Star Empire.

The episode begins with Captain Kirk displaying erratic behavior, directing the U.S.S. Enterprise into the Neutral Zone without explanation. This action provokes an aggressive response from Romulan ships, resulting in the Enterprise being captured. The Romulan Commander, a determined and intelligent woman, boards the Enterprise and questions Kirk and Spock.

Kirk’s seemingly unstable behavior escalates, leading Spock to declare his captain unfit for command. Kirk attacks Spock but is subdued, and Spock, following Vulcan discipline, appears to kill him with a nerve pinch. This move results in Kirk’s confinement, during which the Romulan Commander attempts to persuade Spock to defect, appealing to his Vulcan logic and offering him a position in the Romulan fleet.

In reality, the entire sequence is a meticulously planned ruse. Disguised as a Romulan, Kirk infiltrates the Romulan vessel to steal a highly advanced cloaking device. Dr. McCoy’s medical skills and Spock’s loyalty are crucial in maintaining the charade. Kirk successfully retrieves the cloaking device and returns it to the Enterprise. Meanwhile, Spock stalls the Romulan Commander, revealing the truth only when necessary.

The episode culminates with the Enterprise escaping with the cloaking device. The Romulan Commander, realizing Spock’s deception, is left with a sense of betrayal and admiration for her adversaries. This mission highlights the strategic acumen and boldness of the Starfleet crew, as well as the complex interplay of loyalty and deception in espionage. “The Enterprise Incident” remains a standout episode for its suspenseful plot and the nuanced portrayal of its characters.

 Commentary

The discussion focuses on key leadership lessons for compliance professionals, including ethical decision-making under pressure, maintaining transparency, managing sensitive information and technology, navigating complex regulatory environments, and balancing risk and innovation. The episode highlights how Captain Kirk and his crew’s risky mission to steal a Romulan cloaking device illustrates these principles.

Key highlights:

  • Story Synopsis: The Enterprise Incident
  • Fun Fact: Spock’s Romantic Scene Controversy
  • Reception and Critique of the Episode
  • Compliance Leadership Lessons from the Enterprise Incident

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Fiona is an AI-generated voice

Categories
Blog

Connected Compliance: Part 1 – Communication as the Operating System of Compliance

An effective compliance program is not a collection of disconnected policies, training modules, hotline reports, and investigation files. It is an operating system. Culture determines whether employees will use it. Risk assessment tells the organization where it must adapt. Investigations test whether the system responds credibly. Whistleblower programs reveal whether employees trust it enough to speak. Over this four-part blog post series, we will examine those connections, beginning with the discipline that makes every other element work: communication.

Compliance professionals often describe communication as one element of a program. That description is too narrow. Communication is the operating system through which employees learn expectations, seek advice, identify risk, report concerns, and judge whether management means what it says. If that system is slow, generic, inaccessible, or untrusted, even well-designed controls can fail in practice.

This matters because a compliance program does not become effective when a policy is published or training is completed. It becomes effective when an employee facing pressure knows what to do, understands where to go, and believes that asking for help will not create a career problem. Communication is therefore not simply messaging. It is a preventive control, a detection mechanism, and a source of management information.

Communication Is a Control, Not a Campaign

Many organizations still approach compliance communication as a calendar exercise. They send a Code of Conduct message, deliver annual training, publish a hotline reminder, and count distribution. Those activities may be necessary, but they do not establish whether the message reached the employee at the moment of risk.

An effective communication control has four characteristics.

  1. It is accessible, so employees can find guidance without having to navigate a maze.
  2. It is relevant, so examples reflect the decisions employees actually face.
  3. It is interactive so that employees can ask questions and test judgment.
  4. It is responsive, so the organization uses employee feedback to improve policies, training, and controls.

These distinctions are important. A campaign pushes information out. A control creates a reliable exchange of information. That exchange gives compliance an early view of confusion, pressure, process weakness, and emerging misconduct. It also gives employees a practical path to lawful and ethical decisions.

What the DOJ Is Really Asking

The Department of Justice has moved the compliance discussion away from paper design and toward operational effectiveness. The three fundamental questions in the 2024 Evaluation of Corporate Compliance Programs (ECCP) examine the program’s design, empowerment, and whether it works in practice.

For culture, the DOJ asks, “Does the company seek input from all levels of employees?” It then asks, “What steps has the company taken in response to its measurement of the compliance culture?” Those questions place two obligations on compliance. First, the company must listen across levels, functions, and locations. Second, it must demonstrate that listening changed something. Data without response is observation, not effectiveness.

The ECCP also directs prosecutors to examine policy accessibility, training effectiveness, the availability of guidance, and whether employees know when to seek advice. Taken together, these questions make communication evidence. A company should be able to show not only what it said but also who could access it, whether employees understood it, how they used it, and what management learned from it.

Build Channels Around Employee Behavior

Employees do not experience the company through a single channel. They communicate through managers, messaging platforms, internal websites, employee groups, town halls, mobile devices, and informal workplace networks. A compliance program that relies on one formal channel will miss important signals.

The practical response is a channel portfolio. Policies should be searchable and written in language employees can use. Guidance should be available through live compliance contacts and appropriate digital tools. Reporting options should include the hotline, web intake, direct contact with compliance or human resources, and management escalation. Communications should reach operational employees who may not sit at a computer, as well as global employees who may face language or cultural barriers.

Compliance also needs to listen where employees are already speaking. That may include internal collaboration channels, employee surveys, focus groups, office visits, and patterns in questions received by the compliance team. Any monitoring must be consistent with law, privacy expectations, company policy, and records-management requirements. The goal is not surveillance. The goal is to understand the employee experience before a cultural weakness becomes a control failure.

Face-to-face contact remains especially valuable. A visit to a business unit can reveal whether employees understand a policy, whether managers create pressure, and whether the local process matches the written procedure. It also changes how employees see compliance. A familiar adviser is easier to contact than a distant function that appears only during training or an investigation.

Replace Training Completion With Decision Readiness

Completion rates answer whether an employee opened a course. They do not answer whether the employee can recognize a conflict, challenge a questionable payment, escalate an export-control concern, or pause the use of an unapproved AI tool. As Hui Chen continually reminds us, it is about results, not inputs.

Training should therefore be built around decision readiness. Scenario-based sessions allow employees to work through realistic gray areas and explain why one course of action is safer than another. Shorter, targeted modules can address risk by role. Experienced employees may be able to demonstrate proficiency through testing, while supervisors may require additional training because they receive concerns and translate policy into daily conduct.

Relevance is a control feature. Employees are more likely to retain training that reflects their workplace, business model, and actual risk. A procurement team needs different scenarios from a sales team. A manager needs to understand retaliation and escalation. An engineer needs clear boundaries around data, cybersecurity, and AI. Localization must also address more than translation. Examples, delivery methods, and escalation paths should make sense in the local operating environment. The measurement should move beyond completion. Useful indicators include questions asked after training, repeat areas of confusion, scenario performance, requests for advice, policy-page use, control exceptions, and whether similar misconduct declines over time.

Make Leadership Visible and Consistent

Tone at the top loses force when it sounds scripted or appears only once a year. Employees judge leadership commitment through repeated choices: which risks receive attention, whether high performers are disciplined, whether managers welcome questions, and whether business pressure routinely overrides control requirements.

Compliance communication is stronger when leaders explain expectations in their own voices and connect them to business responsibilities. The chief executive can frame integrity as part of strategy. Finance can address books and records. Human resources can speak to respect, retaliation, and accountability. Business leaders can explain why escalation protects customers and sustainable growth.

Middle management is equally important. Most employees experience culture through their direct supervisor. Managers should be trained to receive concerns, avoid promises they cannot keep, protect confidentiality, escalate promptly, and prevent retaliation. If employees hear an ethical message from senior leadership but experience dismissal from a supervisor, the local message will win. Consistency completes the control. The organization must apply standards across rank, geography, and commercial importance. Unequal treatment communicates more powerfully than any policy statement.

Use Data Without Losing the Human Signal

Technology can help compliance measure reach and engagement. Policy-page analytics can show whether employees use key resources. Digital guidance tools can identify common questions. Investigation and reporting data can reveal trends by issue, region, or function. Training results can show where judgment remains weak.

These data points should be treated as signals, not verdicts. High question volume may indicate confusion, but it may also show that employees trust compliance. An increase in reports may reflect more misconduct, a successful awareness campaign, or greater confidence in the reporting process. Low reporting may indicate a healthy environment, or it may be a warning that employees believe speaking up is futile.

The best analysis combines quantitative and qualitative evidence. Compliance should compare usage data with employee interviews, survey responses, investigation themes, audit findings, exit information, and observations from business partners. It should protect privacy, limit access, and avoid metrics that encourage the wrong behavior. A target that simply seeks fewer reports can suppress the very information the company needs.

Convert Listening Into Action

The strongest evidence of culture is not the survey itself. It is what the company does next. If employees cannot find a policy, redesign access. If repeated questions reveal ambiguity, rewrite the guidance. If a region reports little despite known risk, test for fear or channel barriers. If investigations identify manager misconduct, adjust training, incentives, supervision, and discipline.

This requires a closed-loop process. Gather information. Analyze it for themes and root causes. Assign ownership for action. Document the decision. Communicate appropriate changes. Then measure whether the change worked. That process turns communication into continuous improvement and creates a defensible record of program evolution.

It also connects this first installment to the rest of the series. Employee questions and reporting patterns are early risk indicators. Investigation quality tells employees whether the company acts on what it hears. Whistleblower-program credibility determines whether critical information enters the system at all. Each element depends on the others.

From Culture to a Shifting Risk Environment

Communication gives compliance something more valuable than reach. It provides intelligence. Questions about a new market, an AI application, a third party, a customer demand, or a supply-chain disruption may be the first evidence that the risk environment has changed.

Join us tomorrow for our next installment, where we will examine how compliance can convert those signals into dynamic risk assessment, clear ownership, and adaptive controls. A shifting risk environment cannot be managed by an annual exercise alone. It requires the listening discipline established here.

Bonus Questions for Compliance Professionals

  1. Can employees find practical guidance at the moment they face a risky decision?
  2. Which groups, locations, or shifts are least engaged with compliance resources, and why?
  3. What evidence shows that employee feedback has changed the program?
  4. Are managers prepared to receive concerns, escalate them, protect confidentiality, and prevent retaliation?
  5. Do current metrics reward learning and trust, or do they unintentionally reward silence?
  6. What recent employee question should be treated as an emerging-risk signal?
Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 56 – Business Continuity Lessons from Spock’s Brain

In this episode of Trekking Through Compliance, we consider the episode “Spock’s Brain,” which aired on September 20, 1968, and occurred on Star Date 5431.4.

Story Synopsis

Almost universally panned as the worst Star Trek TOS episode, the story involves a race of beings who kidnap Spock’s brain to run a planet-wide computer system for insipid male and female beings.

“Spock’s Brain” is the first episode of the third season of “Star Trek: The Original Series.” The USS Enterprise, commanded by Captain Kirk, encounters a mysterious and advanced woman who boards the ship, renders the crew unconscious, and steals Spock’s brain. The crew awakens to find Spock alive but in a comatose state. Using the ship’s sensors, they trace the woman’s path to a primitive planet with a technologically advanced underground civilization.

Kirk, Dr. McCoy, and a landing party beam down and discover that the civilization is composed entirely of women who rely on a central computer, the “Controller,” to manage their society. The Controller, now revealed to be Spock’s brain, is essential for their survival. McCoy uses a special device to temporarily enhance his surgical skills, allowing him to reattach Spock’s brain while keeping him conscious enough to guide the procedure.

Ultimately, Spock’s brain is successfully reconnected, and he recovers fully. The crew leaves the planet, disrupting civilization’s dependence on the Controller and initiating a new development phase. The episode is often noted for its unusual and campy premise, becoming one of the more infamous entries in the Star Trek series.

Let’s boldly go where few compliance trainers have gone before and extract five key compliance training lessons from the Enterprise’s wild quest to retrieve Spock’s missing brain. Along the way, we will see that even the quirkiest stories can teach us how to build smarter, more resilient compliance cultures.

Lesson 1: When the Unimaginable Strikes, Training Must Enable Action, Not Panic

Illustrated by: The crew awakens to chaos. Spock is incapacitated. The bridge officers, stunned and confused, look to Kirk for leadership.

Compliance Lesson: The true test of a compliance training program is not how well it’s received during routine times but how effectively it empowers employees to act decisively under pressure.

Lesson 2: You Can’t Train for Every Event, But You Can Teach Problem-Solving

Illustrated by: There is no manual for “what to do when someone steals your first officer’s brain.”

Compliance Lesson: No training program can anticipate every possible scenario. What you can train, however, is a culture of problem-solving, adaptability, and continuous learning.

Lesson 3: Communication Bridges the Knowledge Gap

Illustrated by: The landing party discovers a society split in two: the technologically advanced women who control the planet’s systems and the men, who live in primitive conditions below.

Compliance Lesson: The episode’s iconic “teaching helmet” is a comical take on knowledge transfer, but it highlights a real challenge: bridging the gap between compliance expertise and employee understanding.

Lesson 4: Just-in-Time Training—When You Need It Most

Illustrated by: Faced with the daunting task of reattaching Spock’s brain, Dr. McCoy uses the teaching helmet to acquire the necessary surgical skills.

Compliance Lesson: The best compliance programs recognize this and provide “just-in-time” resources: quick-reference guides, FAQs, and on-demand training for when employees need to act.

Lesson 5: Teamwork and Psychological Safety Are the Real Secret Sauce

Illustrated by: With Spock’s brain reconnected, he awakens mid-surgery and begins to talk McCoy through the final steps.

Compliance Lesson: Effective compliance training creates this same sense of psychological safety.

Final ComplianceLog Reflections

“Spock’s Brain” might not win any awards for scientific realism or dramatic subtlety, but its outlandish premise is a powerful allegory for the daily realities of corporate compliance training. Unexpected risks will arise. Knowledge will lapse. Sometimes, you will need to act with incomplete information and under enormous pressure.

The crew of the Enterprise prevails not because they followed a script but because they were trained, through experience, teamwork, and relentless problem-solving, to adapt and respond to the unknown. The same should be true of your compliance training program.

A training program inspired by the lessons of “Spock’s Brain” will not only teach the rules but also empower employees to act ethically and effectively when it matters most. And that, ultimately, is how we boldly go forward together.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Timothy is an AI-generated voice.

Categories
Blog

Rewiring the Enterprise: What Spock’s Brain Teaches Us About Compliance Training

Few episodes of Star Trek: The Original Series are as infamous or as misunderstood as “Spock’s Brain.” Dismissed by many as campy science fiction, the episode nevertheless offers a wealth of practical insights for today’s compliance professionals, especially those tasked with building, maintaining, and delivering effective compliance training programs.

Let’s boldly go where few compliance trainers have gone before and extract five key compliance training lessons from the Enterprise’s wild quest to retrieve Spock’s missing brain. Along the way, we will see that even the quirkiest stories can teach us how to build smarter, more resilient compliance cultures.

Lesson 1: When the Unimaginable Strikes, Training Must Enable Action, Not Panic

Illustrated by: The crew awakens to chaos. Spock is incapacitated. The bridge officers, stunned and confused, look to Kirk for leadership.

Compliance Lesson: The true test of a compliance training program is not how well it’s received during routine times, but how effectively it empowers employees to act decisively under pressure.

Lesson 2: You Can’t Train for Every Event, But You Can Teach Problem-Solving

Illustrated by: There is no manual for “what to do when someone steals your first officer’s brain.”

Compliance Lesson: No training program can anticipate every possible scenario. What you can train, however, is a culture of problem-solving, adaptability, and continuous learning.

Lesson 3: Communication Bridges the Knowledge Gap

Illustrated by: The landing party discovers a society split in two: the technologically advanced women who control the planet’s systems, and the men, who live in primitive conditions below.

Compliance Lesson: The episode’s iconic “teaching helmet” is a comical take on knowledge transfer, but it highlights a real challenge: bridging the gap between compliance expertise and employee understanding.

Lesson 4: Just-in-Time Training—When You Need It Most

Illustrated by: Faced with the daunting task of reattaching Spock’s brain, Dr. McCoy uses the teaching helmet to acquire the necessary surgical skills.

Compliance Lesson: The best compliance programs recognize this and provide “just-in-time” resources: quick-reference guides, FAQs, and on-demand training for when employees need to act.

Lesson 5: Teamwork and Psychological Safety Are the Real Secret Sauce

Illustrated by: With Spock’s brain reconnected, he awakens mid-surgery and begins to talk McCoy through the final steps.

Compliance Lesson: Effective compliance training creates this same sense of psychological safety.

Final ComplianceLog Reflections

“Spock’s Brain” might not win any awards for scientific realism or dramatic subtlety, but its outlandish premise is a powerful allegory for the daily realities of corporate compliance training. Unexpected risks will arise. Knowledge will lapse. Sometimes, you will need to act with incomplete information and under enormous pressure.

The crew of the Enterprise prevails not because they followed a script, but because they were trained, through experience, teamwork, and relentless problem-solving, to adapt and respond to the unknown. The same should be true of your compliance training program.

A training program inspired by the lessons of “Spock’s Brain” will not only teach the rules but empower employees to act ethically and effectively when it matters most. And that, ultimately, is how we boldly go forward together.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 55 – Out of Time: Due Diligence Lessons from ‘Assignment: Earth

If there is one constant in the universe, it is that business, regulations, and politics never stand still. Each new venture, partnership, or acquisition brings a fresh set of risks, obligations, and opportunities. Yet too often, organizations approach due diligence as a box-checking exercise when, in truth, it is the essential safeguard that ensures they are not letting an unknown variable derail their mission. Nowhere is this more cleverly dramatized than in the Star Trek TOS episode “Assignment: Earth,” where the Enterprise crew finds themselves conducting the ultimate form of due diligence, investigating the mysterious Gary Seven and the true risks he poses to Earth’s future.

Lesson 1: Verify Identity—Trust, But Always Confirm

Illustrated by: When Gary Seven appears on the Enterprise, he claims to be a human agent from the future, sent to prevent Earth’s destruction. His credentials, demeanor, and even physiology confound the crew.

Compliance Lesson: In every business deal, knowing exactly who you are dealing with is non-negotiable. Vendors, acquisition targets, third-party agents, and partners all come with their backgrounds and histories.

Lesson 2: Investigate the Full Scope—Understand Intent, Capability, and History

Illustrated by: The crew’s investigation into Gary Seven doesn’t stop with his identity.

Compliance Lesson: Surface-level information often fails to reveal the entire story. In business, a potential partner’s capabilities and intent matter as much as their identity. Due diligence is not just about who someone is but what they are capable of and what they plan to do with that capability.

Lesson 3: Control Information—Monitor and Secure Sensitive Data

Illustrated by: Much of “Assignment: Earth” revolves around the management of sensitive information.

Compliance Lesson: Whether you are acquiring a company or onboarding a supplier, data security is central to modern due diligence. The risks of data leaks, cyber-attacks, or inadvertent disclosure can be devastating, especially if sensitive deal information falls into the wrong hands.

Lesson 4: Expect the Unexpected—Adapt When New Risks Emerge

Illustrated by: Kirk and Spock’s plan to detain Gary Seven is upended when he escapes and races to sabotage a nuclear missile test that could ignite World War III.

Compliance Lesson: Due diligence is not a static process. The best-laid plans are often disrupted by new information, sudden market fluctuations, or the revelation of previously unknown risks.

Lesson 5: Assess Impact and Alignment—Consider the Broader Consequences

Illustrated by: As the story unfolds, the crew realizes that Gary Seven’s actions, though seemingly dangerous, are intended to prevent an even greater catastrophe.

Compliance Lesson: Effective due diligence requires looking beyond the transaction itself. Will this deal, partnership, or acquisition align with your company’s mission, values, and long-term strategy? What are the potential downstream consequences?

Final ComplianceLog Reflections

“Assignment: Earth” might masquerade as a playful, spy-themed episode, but at its heart it is a meditation on trust, investigation, and the unpredictability of risk. For compliance professionals, its lessons ring true across the decades. Due diligence is not a one-time task, nor is it a matter of simply collecting signatures and ticking boxes. It is an ongoing, multi-dimensional practice rooted in skepticism, curiosity, and a willingness to adapt.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Fiona is an AI-generated voice

Categories
Blog

What Gary Seven and Assignment Earth Teach Us About Due Diligence

If there is one constant in the universe, it is that business, regulations, and politics never stand still. Each new venture, partnership, or acquisition brings a fresh set of risks, obligations, and opportunities. Yet too often, organizations approach due diligence as a box-checking exercise when, in truth, it is the essential safeguard that ensures they are not letting an unknown variable derail their mission. Nowhere is this more cleverly dramatized than in the Star Trek TOS episode “Assignment: Earth,” where the Enterprise crew finds themselves conducting the ultimate form of due diligence, investigating the mysterious Gary Seven and the true risks he poses to Earth’s future.

With its spy-fi trappings, high-stakes secrets, and moral ambiguity, “Assignment: Earth” is a goldmine for compliance professionals seeking fresh insights into what robust due diligence truly requires. Today, we beam down and explore five timeless lessons from this episode, each rooted in a scene that every compliance leader should remember the next time a critical business decision looms.

Lesson 1: Verify Identity—Trust, But Always Confirm

Illustrated by: When Gary Seven appears on the Enterprise, he claims to be a human agent from the future, sent to prevent Earth’s destruction. His credentials, demeanor, and even physiology confound the crew. Spock’s scans confirm some aspects, but other elements remain mysterious. Kirk is forced to weigh trust against hard evidence, deciding that until Seven’s story is verified, he must remain under close observation.

Compliance Lesson: In every business deal, knowing exactly who you are dealing with is non-negotiable. Vendors, acquisition targets, third-party agents, and partners each have their own backgrounds and histories. “Assignment: Earth” illustrates the risks of acting on assumptions or charm; as the Enterprise crew learns, even the most convincing story requires verification. For compliance teams, this means robust onboarding processes, identity verification, and background checks not only at the outset but throughout the relationship. Trust is good; verification is better.

What should you do? Deploy enhanced due diligence for high-risk or high-impact relationships. Use independent sources, cross-check credentials, and don’t hesitate to pause the process if any red flags arise.

Lesson 2: Investigate the Full Scope—Understand Intent, Capability, and History

Illustrated by: The crew’s investigation into Gary Seven doesn’t stop with his identity. They probe his capabilities, his advanced technology, his mysterious “servo,” and the highly sophisticated computer at his headquarters. Spock and Kirk ask probing questions about Seven’s mission, intent, and track record.

Compliance Lesson: Surface-level information often fails to reveal the entire story. In business, a potential partner’s capabilities and intent matter as much as their identity. Due diligence is not just about who someone is, but also what they are capable of and what they plan to do with that capability. A company’s operational strengths, compliance record, and ethical history all inform future risk. Teams must go beyond public filings and financials. Look for operational gaps, management weaknesses, and track records of regulatory engagement. Just as Kirk and Spock dig into Gary Seven’s motives and methods, compliance officers should investigate all relevant dimensions.

What should you do? Expand your checklist: evaluate litigation history, regulatory fines, press coverage, key executive backgrounds, and past compliance breaches. Interview multiple stakeholders to triangulate intent.

Lesson 3: Control Information—Monitor and Secure Sensitive Data

Illustrated by: Much of “Assignment: Earth” revolves around the management of sensitive information. Seven’s computer contains data that could alter the fate of the planet. Both Seven and the Enterprise crew are vigilant about access, using encryption, voice authentication, and physical security to ensure information is only available to those with a legitimate need.

Compliance Lesson: Whether you are acquiring a company or onboarding a supplier, data security is central to modern due diligence. The risks of data leaks, cyberattacks, or inadvertent disclosure can be devastating, especially if sensitive deal information falls into the wrong hands. Therefore, it is crucial to monitor who has access to key data during the diligence phase. Implement robust information barriers and control access to confidential material. Make cybersecurity a core part of your diligence process.

What should you do? Require non-disclosure agreements from all parties. Use secure data rooms and audit access logs. Include cybersecurity posture and data protection history in every due diligence report.

Lesson 4: Expect the Unexpected—Adapt When New Risks Emerge

Illustrated by: Kirk and Spock’s plan to detain Gary Seven is upended when he escapes and races to sabotage a nuclear missile test that could ignite World War III. The crew must adapt instantly, using every tool and resource at their disposal to prevent disaster, even as their understanding of the mission’s stakes evolves in real time.

Compliance Lesson: Due diligence is not a static process. The best-laid plans are often disrupted by new information, sudden market fluctuations, or the revelation of previously unknown risks. Teams must be nimble, ready to reassess, escalate, and change course as new facts emerge. Establish protocols for escalating concerns and adjusting timelines when red flags appear. Build flexibility into your diligence process; sometimes, a deal should slow down or even pause while serious concerns are addressed.

What should you do? Schedule interim reviews, not just final sign-offs. Empower team members to call for additional investigation when new risks emerge, and document all changes to scope and focus.

Lesson 5: Assess Impact and Alignment—Consider the Broader Consequences

Illustrated by: As the story unfolds, the crew realizes that Gary Seven’s actions, though seemingly dangerous, are intended to prevent an even greater catastrophe. Kirk must weigh the consequences of intervening or not, understanding that the impact goes beyond the immediate crisis and could shape the entire future of humanity.

Compliance Lesson: Effective due diligence requires looking beyond the transaction itself. Will this deal, partnership, or acquisition align with your company’s mission, values, and long-term strategy? What are the potential downstream consequences? Does the opportunity support or threaten your compliance culture? Kirk’s willingness to consider the broader impact rather than just “following the rules” mirrors the best compliance thinking. Evaluate not just the legal and financial implications, but the reputational, cultural, and strategic impacts as well.

What should you do? Be sure to include cultural fit, values alignment, and long-term strategy in your final diligence reports. Consult with leadership about potential impacts, positive and negative, before greenlighting a deal.

Final ComplianceLog Reflections

“Assignment: Earth” might masquerade as a playful, spy-themed episode, but at its heart it is a meditation on trust, investigation, and the unpredictability of risk. For compliance professionals, its lessons ring true across the decades. Due diligence is not a one-time task, nor is it a matter of simply collecting signatures and ticking boxes. It is an ongoing, multi-dimensional practice rooted in skepticism, curiosity, and a willingness to adapt.

In today’s business environment, the threats and opportunities you face are more complex than ever. The partners, acquisitions, and investments you pursue all come with hidden variables. Like Kirk and his crew, your mission is to look deeper, ask more challenging questions, protect sensitive information, and never lose sight of the broader impact your decisions have on the world.

The next time your organization faces a pivotal deal or partnership, remember the spirit of “Assignment: Earth” and conduct your due diligence with the rigor, flexibility, and ethical perspective that the future demands.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 54 – Beneath the Surface: Uncovering M&A Risk with Guidance from ‘Bread and Circuses’

If there is one area in business where risk, opportunity, and culture collide, it is in mergers and acquisitions. The promise of new markets, talent, and technology is always balanced against the possibility of hidden liabilities, clashing values, and operational chaos. In the world of corporate compliance, no moment is more perilous or more revealing than when companies come together.

Star Trek: The Original Series’ episode “Bread and Circuses” offers an unlikely but fitting parable for M&A compliance professionals. Here are five key compliance-related M&A due diligence lessons from “Bread and Circuses.”

Lesson 1: Go Beyond Surface Appearances—Assess the True Culture

Illustrated by: On the planet 892-IV, Kirk and his landing party discover an authoritarian state built on forced entertainment and oppression.

Compliance M&A Lesson: It is easy to be seduced by a target company’s top-line numbers, glossy facilities, and impressive management presentations. However, proper due diligence requires a thorough examination beneath the surface.

Lesson 2: Identify Hidden Liabilities—Don’t Ignore the Risks Beneath the Entertainment

Illustrated by: The population of 892-IV, which is kept docile through violent gladiatorial games that serve as literal bread and circuses.

Compliance M&A Lesson: Effective due diligence involves identifying these concealed dangers. Compliance professionals must review litigation histories, regulatory filings, and environmental and safety records, as well as ongoing investigations and audits, to ensure compliance.

Lesson 3: Map Third-Party and Supply Chain Risks—Everyone in the Arena Matters

Illustrated by: Kirk discovers that the planet’s leader, Merikus, is a missing Starfleet captain who has chosen to assimilate rather than resist.

Compliance M&A Lesson: No company operates in isolation. A target company’s third-party relationships, joint ventures, and supply chains can be sources of immense risk; think FCPA, anti-bribery, human rights violations, or simply the risk of operational disruption.

Lesson 4: Understand Local Laws, Customs, and Power Structures—Context Is Everything

Illustrated by: Spock and McCoy are baffled by the local laws and power dynamics.

Compliance M&A Lesson: Every M&A deal is shaped by its legal, regulatory, and cultural context. Don’t assume what works in your home country will transfer easily.

Lesson 5: Don’t Underestimate the Human Element—Values and Ethics Matter

Illustrated by: Throughout the episode, it is the values and resolve of the Enterprise crew and the oppressed “Children of the Sun” that make resistance to tyranny possible. The episode ends not with a technical solution, but with an ethical stand.

Compliance M&A Lesson: Values alignment is not just a “soft” factor; it’s a predictor of post-merger success and resilience in a crisis.

Final ComplianceLog Reflections

“Bread and Circuses” is more than just a classic science fiction adventure. It is a powerful parable for today’s compliance professional navigating the high-stakes world of mergers and acquisitions. For compliance officers, the episode’s narrative reinforces that adequate due diligence must go far beyond the numbers and surface-level impressions. It requires a holistic investigation into the culture, values, and relationships that truly define an organization. The success or failure of a merger often hinges on the ability to identify hidden liabilities, assess third-party and supply chain risks, and deeply understand the legal and regulatory landscape unique to each deal.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
AI Today in 5

AI Today in 5: July 24, 2026, The It’s All About the Data Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today in 5. All from the Compliance Podcast Network. Each day, we consider five stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. Google says AI is helping workers. (WSJ)
  2. AI confidence outpaces adoption. (HealthCareFinance)
  3. AI is only as smart as the data. (Forbes)
  4. AI capture is the foundation of compliance. (UCToday)
  5. AI compliance failures could cost dearly. (FinTechGlobal)

For more information on the use of AI in compliance programs, Tom Fox’s new book, Upping Your Game, is available. You can purchase a copy of the book on ⁠Amazon.com⁠.

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on ⁠Amazon.com⁠.