Tag: compliance

Categories
Blog

COSO’s Corporate Governance Framework: Component 5 – Communication

We continue our exploration of the recently released COSO  Corporate Governance Framework (the Framework) as a Public Exposure Draft.  Today, we begin a deep dive into the six individual components with a discussion of Component 5—Communication. Suppose culture is the heart of an organization, and people are its muscle. In that case, communication is the circulatory system, carrying oxygen (information), nutrients (values), and antibodies (escalations and feedback) to every part of the governance body.

Most assuredly, it is not a side note. Communication is a core governance function, equally as critical as oversight, strategy, and culture. This component affirms something that compliance professionals have long known: poor communication creates risk, while effective communication fosters trust, resilience, and accountability. The Framework lays out a comprehensive roadmap for governing the quality, flow, and purpose of information both inside and outside the enterprise. It addresses communication as both a technical capability and a leadership responsibility, making it a perfect area for compliance professionals to lead from the front.

Today, we examine what Component 5 encompasses and identify five actionable lessons for compliance professionals who are ready to champion the communication function in governance.

What Does the Communication Component Cover?

COSO organizes this component around four principles:

  1. Commit to Information Quality
  2. Engage Stakeholders Strategically
  3. Communicate Effectively with Internal Stakeholders
  4. Communicate Effectively with External Stakeholders

Taken together, these principles stress that communication is strategic, multidirectional, and accountable. It is not just about what is said; rather, it is about who says it, how it is said, where it flows, and whether the message enables ethical decision-making, risk awareness, and stakeholder engagement.

Why Communication Matters to Compliance

For compliance professionals, communication is both a tool and a test. How we communicate policies, processes, and expectations shapes how employees behave. How the board receives information determines the quality of its decisions. How stakeholders perceive our transparency defines our license to operate.

More than ever, regulators, investors, and employees demand not just disclosure but meaningful, timely, and values-driven communication. That means compliance must go beyond the whistleblower hotline and annual training; we must build communication systems that enable governance excellence.

Five Key Lessons for Compliance Professionals

Lesson 1: Information Quality Is a Governance Issue—Own the Integrity of the Message

Principle 17: Commit to Information Quality

Boards and management must ensure that all internal and external information is accurate, complete, timely, and relevant to the decisions being made. This includes maintaining systems and controls to validate data and eliminate ambiguity in terminology.

Compliance Tip: Perform a communication audit of compliance reporting. Are your dashboards jargon-heavy or decision-ready? Do your risk reports help the board prioritize issues or confuse the message? Work with IT, internal audit, and risk to deploy governance, risk, and compliance (GRC) platforms that centralize and standardize your reporting. Use these tools not just to track activities but to tell a governance story.

Lesson 2: Stakeholder Engagement Is Risk Management—Make Communication Strategic

Principle 18: Engage Stakeholders Strategically

Executive management must identify key internal and external stakeholders and ensure that appropriate channels exist to share information, solicit feedback, and address concerns. This includes employees, investors, regulators, customers, suppliers, and communities.

Compliance Tip: Map your stakeholder communication channels, including the messages sent to whom, when, and through which medium. Identify gaps where feedback isn’t captured or transparency is lacking. Lead a quarterly cross-functional stakeholder forum with representatives from legal, ESG, investor relations, operations, and compliance. Use it to review messaging consistency, flag potential disconnects, and align on communication strategy for high-impact governance topics.

Lesson 3: Internal Communication Must Flow in All Directions—Not Just Top-Down

Principle 19: Communicate Effectively with Internal Stakeholders

Effective communication within the entity must support timely, secure, and informed decision-making across all departments and levels. It must include not only top-down directives, but also cross-functional collaboration and bottom-up feedback.

Compliance Tip: Evaluate whether your policies and training materials are accessible and understandable to frontline employees. Simplify complex legal language. Reinforce messaging across multiple touchpoints, not just once a year. Establish a compliance “listening architecture.” This could include monthly manager check-ins, anonymous digital suggestion boxes, and cultural pulse surveys. Use the insights to adapt your messaging, identify unspoken risks, and refine your program in real-time.

Lesson 4: External Communication Requires Guardrails—Balance Transparency and Confidentiality

Principle 20: Communicate Effectively with External Stakeholders

Boards and executive management must govern external communications with care, thereby ensuring transparency while protecting sensitive information and aligning with legal, regulatory, and reputational considerations. This includes formal disclosures, media engagement, investor briefings, and even social media interactions.

Compliance Tip: Coordinate with legal, investor relations, and public affairs to ensure external compliance disclosures (e.g., investigations, regulatory actions, ESG updates) are accurate and strategically timed. Recommend creating or expanding the entity’s disclosure committee beyond financial reporting. Include ethics, cybersecurity, and ESG in its scope. This ensures consistent governance over all public-facing statements, not just 10-Ks and earnings calls.

Lesson 5: Escalation Protocols and Whistleblower Systems Are Core Communication Channels

COSO stresses that communication is not simply about planned messaging, but it is about creating pathways for critical issues to reach decision-makers quickly. That includes whistleblower programs, hotline escalation, and crisis protocols that support real-time visibility and accountability.

Compliance Tip: Review your escalation policy. Is it clear when, how, and to whom an issue must be reported? Is there redundancy if a leader is implicated? Does the board know what “red lines” exist? Include whistleblower trends and escalation effectiveness as standing items in your board or audit committee materials. Go beyond volume and share insights about culture, responsiveness, and process quality. That’s how you earn board confidence and budget support.

Building a Governance Communication Program

To operationalize COSO’s Communication Component, compliance leaders should help lead the development of an integrated governance communication program with the following features:

  • Message alignment across all internal and external platforms;
  • Defined roles for who speaks, who approves, and who responds;
  • Feedback mechanisms like surveys, listening sessions, and open-door policies;
  • Secure reporting systems that support anonymity and protect whistleblowers; and
  • Crisis playbooks that define escalation paths, communications teams, and messaging protocols.

The goal? To ensure that communication is not just noise, but a narrative that guides behavior, enables decisions, and builds trust with all stakeholders.

What Boards Need to Hear from Compliance

Here’s what to communicate to your board:

  • The quality of governance depends on the quality of information.
  • Misaligned or confusing communication creates regulatory and reputational risk.
  • Stakeholders expect timely, truthful, and values-aligned information, not just compliance.
  • Compliance has a unique view into cross-functional communication gaps and whistleblower data.
  • The board should actively monitor communication systems and protocols, just as it does financial reporting.

When the board understands that communication is a control, not just a convenience, they will begin to ask better questions and set higher expectations.

Final Thoughts: Communication Is Governance in Motion

To determine whether your governance program is effective, listen to what people say and, equally importantly, what they do not. COSO’s Communication Component reminds us that in governance, silence is a risk, confusion is a vulnerability, and transparency is a strength.

As compliance professionals, we are communicators by necessity, but COSO invites us to become communicators by design. That means building systems that convey messages, address concerns, and connect people to their purpose. Governance is not just about structure; in many ways, it is about story. Make sure yours is told well.

To read or comment on the full CGF Public Exposure Draft, click here. The comment period closes July 11, 2025.

Categories
Daily Compliance News

Daily Compliance News: July 9, 2025, The TACO Don Caves Again Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, including compliance, ethics, risk management, leadership, or general interest, relevant to the compliance professional.

Top compliance stories:

  • What happens when your bot goes antisemitic? (⁠NYT⁠)
  • Spanish PM announces new ABC laws amid graft probe. (⁠Bloomberg)⁠
  • Trump pushes back on tariff dates yet again. (⁠WSJ⁠)
  • Vibe coding for compliance. (⁠WSJ⁠)

You can donate to flood relief for victims of the Kerr County flooding by going to the Hill Country Flood Relief ⁠here⁠. 

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Internal Control Deficiencies

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with concise, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we look at how to deal with and report internal control deficiencies.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Assessing Internal Controls

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we look at how to assess your internal controls under COSO.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Adventures in Compliance

Adventures in Compliance: The Novels – The Hound of the Baskervilles, Introduction and Compliance Lessons Learned

In this new season of Adventures in Compliance, host Tom Fox takes a deep dive into the Sherlock Holmes novels. Throughout this season, Tom will delve into each novel in a four-part series. The four novels we will consider from the ethics and compliance perspective are A Study in Scarlet, The Sign of Four, The Hound of the Baskervilles, and The Valley of Fear.

In this episode (and for the entire month of July), we focus on the most famous Holmes novel, ‘The Hound of the Baskervilles.’ Timothy and Fiona are back to explore the key elements of the novel, connecting them with compliance themes and investigative techniques. They dissect the storyline, reveal insights, and discuss timeless lessons in rational thinking, the perils of unquestioned beliefs, and the power of meticulous observation and teamwork. Additionally, Tom invites listeners to provide feedback on the use of AI voices and offers to help those interested in starting their podcasts.

Highlights include:

  • Deep Dive into The Hound of the Baskervilles
  • The Mysterious Case Unfolds
  • Holmes’ Investigation and Revelations
  • Lessons from The Hound of the Baskervilles

Resources:

The New Annotated Sherlock Holmes

Sherlock Holmes FAQ by Dave Thompson

Sherlock Holmes, The Novels, with an introduction by Michael Dirda

Connect with Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

COSO’s Corporate Governance Framework: Component 2-Strategy

We continue our exploration of the recently released COSO  Corporate Governance Framework (the Framework) as a Public Exposure Draft.  Today, we begin a deep dive into the six individual components with a discussion of Component 2—Strategy. This component prioritizes compliance at the forefront of value creation. This is not just about watching for missteps. It’s about enabling the entity to pursue bold goals while staying grounded in ethics, purpose, and accountability.

For compliance professionals, this is a welcome and long overdue shift. Strategy is no longer just a business conversation; it’s a strategic imperative. COSO makes it clear: strategy is governance, and governance must include compliance at every stage—from definition to execution to performance monitoring. Today, we extract five key lessons for compliance professionals ready to step into a new leadership role.

I. Strategy in the COSO CGF: What It Covers

The Strategy Component of COSO’s CGF focuses on aligning the entity’s strategic direction with its purpose, values, and long-term objectives. It’s made up of four core principles:

  1. Define Purpose and Core Values
  2. Develop and Communicate the Strategy
  3. Execute the Strategy
  4. Measure Performance Against Strategy and Adjust

These principles provide a governance framework that not only connects the board and executive management but cascades responsibility throughout the entity, from strategy rooms to front-line decision-making.

Why Strategy Matters to Compliance

For years, strategy has been seen as the exclusive domain of the CEO, CFO, and business development leaders. Compliance was invited in after the fact, to clean up, audit, or assess risks. But COSO’s framework changes the conversation.

As compliance professionals, we bring a risk-aware, ethics-focused, stakeholder-sensitive perspective to the table. In an era of ESG mandates, AI disruption, global volatility, and regulatory scrutiny, strategy without compliance is incomplete. If your compliance function is not integrated into the strategy process, you are not practicing governance; you are essentially doing damage control.

II. Five Key Lessons for Compliance Professionals

Lesson 1: Start with Purpose—Not Just Policy

Principle 7: Define Purpose and Core Values

Boards and management must define the entity’s fundamental purpose, the “why” behind the business, and articulate the core values that guide decision-making, behavior, and stakeholder relationships. These values must be embedded into operations, strategic priorities, and performance incentives.

Compliance Tip: Tie your compliance policies, training, and reporting to the entity’s purpose and values. Do not discuss rules; instead, focus on alignment. Offer to help HR and communications integrate purpose into onboarding, annual certifications, and code of conduct messaging. When purpose becomes the language of the enterprise, compliance becomes a strategic partner.

Lesson 2: Compliance Must Be at the Strategy Table

Principle 8: Develop and Communicate the Strategy

Executive management, in consultation with the board, is responsible for developing the strategic plan, which encompasses competitive positioning, market risks, stakeholder expectations, and capital allocation. Strategy development must consist of scenario planning and risk alignment to maximize long-term value.

Compliance Tip: Join strategic planning conversations early. Provide insight on regulatory trends, reputational risks, geopolitical shifts, and stakeholder concerns that could derail strategy if not addressed upfront. Offer to run a pre-mortem exercise: If this strategy fails, why will it fail? Use compliance-led facilitation to identify blind spots in the business model.

Lesson 3: Execution Is Where Ethics Live or Die

Principle 9: Execute the Strategy

Executing the strategy requires a well-defined operating model, clear accountability, aligned incentives, and integrated reporting. Middle management translates strategic goals into action, and it’s here that ethical risk often emerges.

Compliance Tip: Get involved in operational risk reviews. Ask how incentives are aligned with values. Review whether performance metrics encourage long-term thinking or shortcut-taking. Collaborate with the COO or HR to incorporate ethical conduct and risk awareness into performance evaluations and team KPIs. This helps you drive a values-based strategy from the ground up.

Lesson 4: Metrics Matter—And So Does What You Measure

Principle 10: Measure Performance Against Strategy and Adjust

Management must develop and track both financial and non-financial KPIs to assess progress against strategic goals. The board oversees these metrics and ensures that adjustments are made when results or risks shift.

Compliance Tip: Contribute to KPI development. Suggest ethical culture indicators, hotline trends, third-party risk metrics, or audit closure rates as part of strategy dashboards. Push for the inclusion of lagging and leading indicators. It’s not enough to track what went wrong. Compliance needs metrics that alert us to potential issues before they occur. Compliance analytics is your secret weapon.

Lesson 5: Agility Requires Structure—Be the Change Advisor

COSO’s Strategy Component emphasizes the need for strategic agility. This is the ability to pivot in the face of market disruptions, new risks, or regulatory change. But agility does not mean chaos. It requires disciplined change management, escalation procedures, and decision-making protocols.

Compliance Tip: Be a Governance Resource During Change. Whether it’s a reorg, a product launch, a merger, or a crisis response, help ensure that the right people are consulted, documented, and accountable. Offer a compliance impact assessment for major strategic shifts. Show how culture, third-party relationships, data privacy, or anti-bribery obligations will be affected and what the plan is to stay in control.

III. Strategy Is a Compliance Priority—Not Just a Business One

COSO’s Framework makes something crystal clear: strategy is no longer “off-limits” to compliance. The board must oversee it. Executive management must align it with the purpose. And the compliance function must embed integrity, risk foresight, and stakeholder accountability into every strategic decision. We should break the old model that treated compliance as a back-end reviewer. We are now co-pilots. COSO has provided compliance with the governance language to claim its seat at the strategy table. Now it is up to us to use it.

How to Put This Into Practice

Here are five actionable steps for compliance teams:

  1. Review your company’s strategic plan through the lens of COSO’s four strategy principles. Start by mapping your organization’s current strategic plan against the four COSO Strategy principles: defining purpose and core values, developing the strategy, executing it, and measuring performance. Ask critical questions—Does the plan reflect your core values? Are ethical risks explicitly considered? Do compliance concerns inform strategic KPIs? This exercise helps compliance professionals identify gaps where compliance can bring additional value, ensuring the organization’s long-term strategy is rooted in accountability, integrity, and transparency. It also positions compliance as a proactive contributor to governance, not a reactive afterthought.
  2. Schedule a briefing with strategy or finance leaders to explore how risk and ethics are being integrated into the process. Establish a strategic dialogue with your CFO, head of strategy, or business development leadership to understand how ethical considerations and compliance risks are being integrated into planning. Bring COSO’s Strategy principles to the table as a common framework and ask how the company’s strategic models account for reputational risk, regulatory change, and stakeholder expectations. Use this time to identify areas where compliance can provide valuable insights, such as in ESG, M&A due diligence, or geopolitical risk assessment. These conversations open doors for cross-functional collaboration and foster trust with executives as they manage high-impact decisions.
  3. Develop compliance metrics that align with strategic objectives, such as trust, resilience, and stakeholder engagement, to ensure effective management and oversight. Move beyond traditional compliance outputs (e.g., number of training sessions or hotline reports closed) and align your metrics with enterprise-level strategic outcomes. Consider how to measure ethical culture, employee trust, third-party integrity, and the entity’s overall resilience to misconduct. Develop dashboards that can be integrated into strategic performance reviews or presented to executive management and the board of directors. Metrics might include culture survey participation, average investigation time, or third-party onboarding risk ratings. When compliance shows it can measure what matters to business leaders, it becomes a strategic asset, not a regulatory cost center.
  4. Pilot a strategic compliance review for a major initiative (product launch, M&A, market expansion). Choose a significant upcoming business initiative, perhaps a new product launch, geographic expansion, or merger, and embed compliance into the project team from the start. Conduct a compliance risk assessment tailored to the initiative’s strategy, market, and operating model. Ask how data privacy, third-party risk, anti-bribery compliance, and ethical culture will be protected during execution. Create an action plan that includes clear governance checkpoints, escalation triggers, and controls. This pilot not only demonstrates the value of compliance in driving strategic success, but it also establishes a replicable model for integrating compliance into future enterprise initiatives.
  5. Educate your board on the compliance implications of COSO’s Strategy Component—especially in strategy execution and performance monitoring. Prepare a board-level briefing or an audit committee presentation that focuses on how the compliance function supports strategic execution and long-term value creation. Use COSO’s Strategy principles to show how compliance intersects with business model design, culture, risk oversight, and scenario planning. Discuss how your function contributes to measuring non-financial performance indicators and adjusting strategy considering regulatory shifts or reputational risks. Reinforce the message that compliance is a governance tool, not just a defensive mechanism. By educating the board on these dynamics, you elevate the role of compliance in strategy and support a culture of forward-looking governance.

Final Thoughts: The Future of Strategy Is Compliance-Infused

We often say that strategy sets the tone for the business. However, as compliance professionals, we now have the tools and the COSO framework to ensure that our tone is ethical, risk-aware, stakeholder-conscious, and purpose-driven. Compliance should not simply review strategy; we should all move to shape it. Bring your questions, our insights, and our integrity to the table where the most important business decisions are made. That is what governance leadership looks like. COSO just gave compliance the playbook.

To read or comment on the full CGF Public Exposure Draft, click here. The comment period closes July 11, 2025.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 33 – Investigative Lessons from Star Trek’s “Mirror, Mirror”

In the episode titled “Mirror, Mirror,” Captain Kirk, Dr. McCoy, Uhura, and Scotty encounter a transporter accident that thrusts them into a parallel universe. This alternate reality is a distorted mirror image of their universe, familiar yet different, governed by violence, suspicion, and fear rather than trust and mutual respect. Drawing directly from this episode, we examine five investigative lessons that compliance professionals can apply in their roles to ensure ethical resilience and organizational integrity.

Lesson 1: Quickly Recognize the Unexpected

Illustrated by: In the opening sequence, Kirk and his team are transported into the Mirror Universe.

Compliance Lesson: Compliance professionals must maintain heightened situational awareness during investigations, promptly identifying unexpected deviations, whether subtle discrepancies in financial reports, irregularities in third-party behaviors, or suspicious communications.

Lesson 2: Adapt and Blend into the Environment

Illustrated By: Realizing their perilous situation, Kirk instructs his crew to blend into the mirror universe’s ruthless culture.

Compliance Lesson: Compliance officers often operate within organizational cultures that vary significantly in terms of transparency, openness, and ethical climate.

Lesson 3: Secure Critical Information Discreetly

Illustrated By: A pivotal moment occurs when Kirk and Scotty clandestinely access the computer system in the mirror Enterprise to gather data discreetly.

Compliance Lesson: Compliance investigations frequently require discretion, confidentiality, and careful handling of sensitive data.

Lesson 4: Leverage Allies Within Complex Environments

Illustrated By: One crucial decision Kirk makes is trusting the mirror universe’s Spock enough to appeal to his logic and inherent sense of reason subtly.

Compliance Lesson: Building strategic relationships and leveraging internal allies can significantly improve investigation outcomes.

Lesson 5: Provide Actionable Guidance Based on Investigative Outcomes

Illustrated By: At the climax, Kirk directly confronts Mirror-Spock, presenting him with evidence and logical arguments to inspire long-term change within the oppressive Empire.

Compliance Lesson: Compliance officers are responsible for translating investigative findings into practical actions, guidance, process improvements, controls enhancements, or training recommendations that meaningfully mitigate future risk and promote an ethical organizational culture.

Final ComplianceLog reflections

The investigative narrative depicted in “Mirror, Mirror” presents powerful lessons for compliance professionals committed to conducting thorough, ethical, and effective investigations. Kirk and his crew were thrust into an environment of distorted realities, facing the daunting task of discerning truths within complex and dangerous situations. The strategies they adopted — early recognition, swift adaptation, discreet information gathering, strategic alliances, and actionable recommendations — mirror precisely the skills compliance officers require in navigating investigations.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 32 – Leadership Lessons for Compliance Professionals from “The Changeling”

Compliance, fundamentally, is about leadership. It is about guiding individuals and entire organizations to act ethically, responsibly, and effectively, even when the path is uncertain or challenging. Today, we venture boldly into the classic episode “The Changeling,” which offers rich lessons in leadership directly applicable to the world of corporate compliance. Here are five key lessons from the episode, illustrating critical skills compliance leaders must master.

Lesson 1: Clarity of Purpose is Essential

Illustrated By: Originally designed as a peaceful explorer, its mission was corrupted following a collision with an alien probe called Tan Ru, causing its core directives to merge and mutate dangerously.

Compliance Lesson. Compliance leaders must maintain absolute clarity about their purpose and objectives.

Lesson 2: Effective Communication Prevents Crisis Escalation

Illustrated by Kirk’s precise, deliberate communication with Nomad, it slows down its destructive tendencies and provides crucial time to develop a solution.

Compliance Lesson. Communication in compliance crises is similarly critical. Compliance leaders must communicate calmly and thoughtfully, particularly in high-stakes scenarios.

Lesson 3: Recognize When Adaptation is Necessary

Illustrated By: Initially, Kirk tries conventional diplomatic approaches. Recognizing that traditional methods have failed, he adapts swiftly and strategically.

Compliance Lesson. In compliance leadership, adaptability is essential. Regulatory landscapes and compliance risks are constantly evolving, necessitating swift pivots and agile leadership responses.

Lesson 4: Confront Problems Directly and Courageously

Illustrated By: When Nomad determines Captain Kirk himself to be flawed and thus a threat, Kirk faces Nomad directly, boldly confronting it without hesitation despite understanding the risk involved.

Compliance Lesson. Compliance leaders must similarly confront compliance issues directly and courageously. Avoiding difficult conversations or deferring tough decisions can magnify risks and vulnerabilities.

Lesson 5: Cultivate Critical Thinking Within the Team

Illustrated By: Throughout the episode, Kirk relies heavily on his team, particularly Spock’s analytical logic, Scotty’s technical skills, and Uhura’s linguistic insights after Nomad erases her memory.

Compliance is a collaborative discipline that requires collective critical thinking from diverse team members.

Final ComplianceLog Reflections

Each leadership lesson in this episode—clarity of purpose, effective communication, adaptability, courageous confrontation, and fostering critical thinking—is fundamental to guiding organizations safely through the complex maze of modern compliance challenges. Compliance leaders today face situations not unlike the Enterprise crew: unexpected challenges, high stakes, and rapidly changing conditions. The effectiveness of compliance hinges significantly on leadership skills that navigate these complexities with clarity, confidence, and ethical fortitude.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Blog

COSO’s Corporate Governance Framework: Component 1 – Oversight

We continue our exploration of the recently released COSO  Corporate Governance Framework (the Framework) as a Public Exposure Draft.  Today, we begin a deep dive into the six individual components with a discussion of Component 1: Oversight. It is a pillar that every compliance professional should study with the care of a board director preparing for their first 10-K briefing. The Framework is a clarion call for compliance professionals to rethink how we engage with governance, board structure, and accountability. Today, we will break it down and then dive into five lessons we must take back to our programs.

What Is Oversight in the COSO Framework?

The CGF defines oversight as the foundation of effective governance and long-term value creation. It begins with a board that is informed, independent, and proactive in directing strategy, supervising executive leadership, and maintaining organizational integrity.

But COSO doesn’t stop at roles and titles. The Oversight Component is made up of six principles:

Principle 1: Establish Board Structure and Exercise Oversight

This principle emphasizes that the board must create a well-defined governance structure with clearly assigned roles, responsibilities, and committees. It must actively exercise its oversight duties to support management’s execution of strategy while maintaining accountability to shareholders and stakeholders. Compliance professionals should engage early to ensure that governance structures also include strong compliance and ethics coverage, whether as standalone committees or integrated into audit or risk structures.

Principle 2: Appoint Board Leadership and Members

Boards must appoint competent, diverse, and independent leaders who possess integrity, objectivity, and a range of skills necessary to guide the organization effectively. Board leadership, whether a chair or lead independent director, must also foster effective decision-making and conflict resolution within the boardroom. Compliance teams should be prepared to assess and brief leadership on whether the board’s independence and composition are suited to today’s complex risk environment.

Principle 3: Select CEO and Delegate Authority

The board is responsible for selecting the CEO and formally delegating authority for strategic execution and operational decision-making. This includes maintaining clarity over which powers the board retains and which are delegated to management, ensuring accountability and effectiveness. Compliance should help define these boundaries, ensuring they include escalation protocols for compliance violations, investigations, and significant legal risks.

Principle 4: Establish Executive Structure and Effectively Manage

Executive management, with board oversight, must implement a governance structure that clearly outlines roles and responsibilities while enabling strategic execution, risk management, and ethical conduct. It requires maintaining effective internal communication and accountability mechanisms across business units. This principle affirms the compliance officer’s role in building the scaffolding for transparency and internal integrity in decision-making.

Principle 5: Operate the Board Effectively

Boards must regularly evaluate and refine their processes, calendars, and communication practices to optimize their oversight role. This includes utilizing executive sessions, clear meeting agendas, providing director access to management, and maintaining structured documentation to promote effectiveness and accountability. Compliance can support this effort by briefing directors on best practices for board effectiveness and helping to integrate compliance topics into existing agendas.

Principle 6: Uphold Shareholder Rights and Accountability

Boards and executive leadership must ensure that shareholder rights are protected and that disclosures enable informed decision-making and active engagement. This includes facilitating transparent communication, majority voting, and responding to shareholder concerns with respect and accountability. Compliance should assist in evaluating disclosure risks, supporting governance transparency, and managing the evolving expectations of institutional and activist investors.

Why It Matters to Compliance

Here’s the bottom line: Oversight defines the altitude from which the board governs—and the depth to which management is held accountable. It is where compliance either has a voice or is left scrambling to clean up messes.

As COSO puts it, oversight is shaped by:

  • Legal and regulatory obligations
  • Listing exchange standards
  • Shareholder and stakeholder expectations
  • Evolving risks and strategic complexity

Crucially, effective oversight depends on trust, transparency, and the willingness of directors to challenge management when necessary. If you are a compliance officer, you are the steward of that trust every time you walk into the boardroom or brief an audit committee.

Five Key Lessons for Compliance Professionals

Lesson 1: Structure Drives Behavior—Support the Right Board Composition

COSO reminds us that structure is not simply about paperwork; rather, it is about performance in waiting. Boards must have the right mix of committees, including audit, compensation, and nominating/governance, as well as tailored structures for emerging risks such as cybersecurity, ethics, and compliance.

Compliance Tip:

Be proactive in suggesting committee enhancements. If you see ESG risks mounting, propose a joint compliance-risk-ESG working group. If your board lacks a compliance-specific charter, now is the time to offer a draft. Offer benchmarking from peer organizations or industry regulators. Bring data to the table when proposing changes to board governance.

Lesson 2: Director Independence and Expertise Matter—Help Evaluate It

The CGF emphasizes that a supermajority of the board should be independent and that independence extends beyond a lack of financial ties; it also encompasses freedom from undue influence, appropriate tenure, and cognitive diversity.

Compliance Tip:

Your compliance and risk reports can shape how directors perceive their effectiveness. Provide clear, factual, and nuanced briefings, especially around risk appetite, incident investigations, and policy gaps. Encourage your board to adopt a skills matrix and evaluate directors on competencies related to ethics, compliance, and oversight, in addition to finance and operations.

Lesson 3: Board–Executive Relationships Are a Two-Way Street—Support the Feedback Loop

COSO emphasizes that executive management and the board need a trust-based, collaborative relationship. This means access to information, clarity of delegation, and open channels of communication, especially in a crisis.

Compliance Tip:

Use your role as a bridge, not a barrier, between management and the board. Ensure the board has access to accurate, real-time insights into investigations, emerging compliance issues, and root cause analyses. Help define and document escalation protocols. In times of crisis, ambiguity kills. Clear lines of escalation protect both the board and the business.

Lesson 4: Oversight Extends to Culture—Not Just Numbers

One of the most progressive moves COSO makes in this component is tying board oversight to organizational culture and behavior modeling. Directors must demonstrate ethics, respect, and transparency, just like the CEO.

Compliance Tip:

Start including culture indicators in your regular reporting, such as hotline trends, employee engagement results, training completion rates, and code of conduct violations. Do not simply report metrics; instead, contextualize them to make them more meaningful for your audience. Invite board members to participate in listening sessions or ethics town halls. Direct exposure to employee sentiment builds empathy and accountability.

Lesson 5: Shareholders Are Oversight Partners—Prepare for Transparency

The CGF challenges entities to uphold shareholder rights and engagement through transparent disclosures, majority voting for directors, and stewardship activities.

Compliance Tip:

Work closely with investor relations and legal to ensure your compliance-related disclosures are accurate, meaningful, and aligned with shareholder expectations. Don’t wait until an activist investor demands it. Conduct a pre-mortem with your team and board: If an activist investor were to challenge our compliance program, where would they strike first? Fix that area today.

What’s New and Noteworthy?

There are several leading-edge considerations embedded in the Oversight section that every compliance officer should note:

  • Expanding compensation committee roles to include culture, diversity, and talent oversight
  • Increased use of executive sessions for confidential discussions without management
  • Policies to prevent overboard, especially for sitting executives and CEOs
  • Structured onboarding and offboarding for directors to maintain freshness and avoid stagnation

These are not just governance best practices. They are compliance enablers. A stagnant board is a blind board. A distracted director is a dangerous one.

Final Thoughts: Oversight Is a Team Sport

Too often, compliance professionals think of board oversight as something that happens to us; we prepare the decks, present our updates, and answer tough questions. But COSO’s Oversight Component invites us to flip the narrative. We are not bystanders in governance; we are builders of it. Tell the story.

When we engage with the board with clarity, courage, and consistency, we not only raise the profile of compliance but also enhance our credibility. We help shape an oversight model that can weather disruption, lead through crisis, and deliver long-term value. Let your voice be heard in the boardroom. Do not just brief on the risks; build the systems that make risk manageable. This is our moment. Let’s own it.

To read or comment on the full CGF Public Exposure Draft, click here. The comment period closes on July 11, 2025.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – COSO Objective 2 – Risk Assessment

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we continue our look at the 5 COSO Objectives. Today, Number II—Risk Assessments.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.