Tag: compliance

Categories
Blog

From Principle to Proof: Operationalizing AI Governance Through the ECCP and NIST

Artificial intelligence governance has officially crossed the threshold from theory to expectation. The Department of Justice has not issued a standalone “AI rulebook,” but it has provided a framework for compliance professionals to consider the issue: the 2024 Evaluation of Corporate Compliance Programs (ECCP). In this version of the ECCP, the DOJ laid out guidance that any technology capable of creating material business risk must be governed, monitored, and improved like any other compliance risk. That includes artificial intelligence.

Too many organizations still treat AI governance as an ethics exercise, a technical problem, or a future concern. That posture is not defensible. The DOJ does not ask whether your program is fashionable or aspirational. It asks three very old-fashioned questions: Is your compliance program well designed? Is it applied in good faith? Does it work in practice? Those questions apply with full force to AI.

In this post, I want to move the discussion from abstract frameworks to operational reality. I will show how compliance professionals can use the ECCP to structure AI governance, select board-grade KPIs, and demonstrate effectiveness in a way regulators understand. I will also show how the NIST AI Risk Management Framework (NIST Framework) fits neatly underneath this structure as an operating model, not a competing philosophy.

AI Governance Is Already an ECCP Issue

The DOJ has repeatedly emphasized that compliance programs must evolve as business risks evolve. Artificial intelligence is not a future risk. It is already embedded in pricing, hiring, credit decisions, customer interactions, fraud detection, and third-party screening. If an AI model can influence revenue, customer outcomes, or regulatory exposure, it is a compliance risk. Period.

The ECCP does not require companies to eliminate risk. It requires them to identify, assess, manage, and learn from it. AI governance, therefore, belongs squarely inside the compliance program, not off to the side in an innovation lab or technology committee.

The ECCP as an AI Governance Blueprint

The power of the ECCP is its simplicity. Every enforcement action ultimately traces back to the same three questions. Let us apply them directly to AI.

Is the Program Well Designed?

Design begins with risk assessment. If your organization cannot answer a basic question such as “What AI systems do we have, who owns them, and what decisions they influence,” you do not have a program. You have hope. A well-designed AI compliance program starts with an AI asset inventory that identifies models, tools, vendors, and use cases. Each asset must be risk-classified based on business impact, regulatory exposure, and potential harm.

Board-level KPIs here are coverage metrics. How many AI assets have been identified? What percentage has been risk-classified? How many high-impact models have completed an impact assessment before deployment? If your dashboard does not show near-full coverage, the design is incomplete.

Policies and procedures come next. The DOJ does not care how many policies you have. It cares whether they provide clear guidance for real decisions. AI policies should cover the full lifecycle, from design and data sourcing through deployment, monitoring, and retirement. A practical KPI is policy coverage. What percentage of AI assets operate under current, approved procedures? How often are those procedures refreshed? Annual updates are a reasonable baseline in a rapidly changing risk environment.

Is the Program Applied Earnestly and in Good Faith?

Good faith is demonstrated through action, not intent. Training is a central indicator. The DOJ expects role-based training tailored to actual risk. A generic AI awareness course does not meet this standard. Developers, model owners, compliance reviewers, and business leaders all require different training. Completion rates matter, but so does comprehension. Measuring post-training proficiency improvement is one of the clearest signals that training is more than a box-checking exercise.

Third-party risk management is another critical area. Many organizations rely on external models, data providers, or AI-enabled vendors. If you do not understand how those tools are built, governed, and updated, you are importing risk without controls. Strong programs use standardized AI diligence questionnaires, assign assurance scores, and require contractual safeguards for high-risk vendors. A board-ready KPI here is the percentage of high-risk AI vendors subject to enhanced diligence and contractual controls.

Mergers and acquisitions deserve special attention. AI risk does not wait for post-close integration. The DOJ has been explicit that pre-acquisition diligence matters. A defensible KPI is simple and unforgiving. 100% of acquisition targets with material AI usage must undergo AI due diligence before closing. Anything less invites inherited risk.

Does the Program Work in Practice?

This is where many programs fail. Paper controls do not impress regulators. Outcomes do. Incident reporting is a critical signal. A low number of reported AI issues may indicate fear, confusion, or a lack of safety rather than safety concerns. What matters is whether issues are identified, investigated, and resolved promptly. Mean time to investigate is a powerful metric. If AI-related concerns take months to resolve, the program is not working. Clear escalation paths, defined investigation playbooks, and documented root cause analysis are essential.

Continuous monitoring is equally important. High-risk AI systems must be monitored for performance drift, data changes, and unintended outcomes. The DOJ expects companies to use data analytics to test whether controls are functioning. KPIs here include validation pass rates before deployment, drift-detection coverage for critical models, and corrective action closure rates. These are not technical vanity metrics. They are evidence of effectiveness.

Where NIST Fits and Why It Matters

The NIST AI Risk Management Framework does not compete with the ECCP. It operationalizes it. The ECCP tells you what regulators expect. NIST helps you implement those expectations across governance, mapping, measurement, and management. For example, ECCP risk assessment aligns with NIST’s mapping function. ECCP’s continuous improvement aligns with NIST’s measurement and management functions. Using NIST terminology creates a shared language across compliance, legal, security, and data science teams. That shared language is governance in action.

Reporting AI Risk to the Board

Boards do not want technical detail. They want assurance. The most effective AI governance dashboards focus on a small set of indicators that answer the DOJ’s three questions: coverage, quality, responsiveness, and learning. Examples include the percentage of AI assets risk-classified, validation pass rates, investigation cycle times, and corrective action closure rates. When these metrics move in the right direction, they tell a credible story of control. More importantly, they show that compliance is not reacting to AI. It is governing it.

Five Key Takeaways for Compliance Professionals

  1. AI as Risk. Artificial intelligence is already within the scope of the ECCP. If AI can influence business outcomes, it must be governed like any other compliance risk.
  2. Risk Management Program. A well-designed AI compliance program begins with complete asset identification and risk classification. Coverage metrics are the first signal regulators will examine.
  3. Implementation. Good faith implementation is demonstrated through role-based training, disciplined third-party oversight, and pre-acquisition AI diligence. Intent without execution does not count.
  4. Outcomes, not Inputs. Effectiveness is proven through outcomes. Investigation speed, monitoring coverage, and corrective action closure rates matter more than policy volume.
  5. Complementary. The NIST Framework complements the ECCP by providing an operating model that compliance, legal, and technical teams can share. Together, they turn principles into proof.

Final Thoughts

AI governance is not about predicting the future. It is about demonstrating discipline in the present. The DOJ is not asking compliance professionals to become data scientists. It is asking us to do what they have always done well: identify risk, establish controls, test effectiveness, and improve continuously. The ECCP already gives you the framework. The only question is applying it.

Categories
From the Editor's Desk

From the Editor’s Desk – Aaron Nicodemus on the CW AI Conference Insights: Navigating the Practical Use of AI in Compliance

In this episode of ‘From the Editor’s Desk,’ Tom Fox visits with Aaron Nicodemus to discuss highlights from the recent Compliance Week AI Conference. Key takeaways include the importance of understanding the purpose and practical use of AI tools before implementation, the pressures from C-suite and boards to adopt AI, and the necessity of a human-in-the-loop approach. The conversation also touches on integrating trust and integrity into AI adoption, the evolving role of compliance as a trusted partner in AI initiatives, and the collective willingness to learn and apply AI across compliance operations.

Key highlights:

  • Importance of Understanding AI Implementation
  • Pressure from the Top: Compliance and AI
  • Human Oversight in AI Processes
  • Trust and Integrity in AI
  • Compliance as a Competitive Advantage
  • Real-World Examples: Robinhood and DocuSign
  • The Evolving Role of Compliance in AI
  • Conference Vibes and Final Thoughts

Resources:

Aaron Nicodemus on LinkedIn

Compliance Week

Categories
Blog

Roman Philosophers and the Foundations of a Modern Compliance Program: Part 4 – Marcus Aurelius and Ethical Leadership

I recently wrote a series on the direct link between ancient Greek Philosophers and modern corporate compliance programs and compliance professionals. It was so much fun and so well-received that I decided to follow up with a similar series on notable Roman Philosophers. This week, we will continue our exploration of the philosophical underpinnings of modern corporate compliance programs and compliance professionals by looking at five philosophers from Rome, both from the BCE and AD eras.

We have considered Cicero and the duties, law, and moral limits of business; Seneca on power, pressure, and ethical decision-making under stress; and Varro on corporate governance. Today, we consider Marcus Aurelius and ethical leadership and tone at the top. Tomorrow, we will conclude with Lucretius to explore rationality, fear, and risk perception. Today, we continue with Marcus Aurelius, Ethical Leadership, and Culture as a Compliance Control

I. Marcus Aurelius in Context: Power with Restraint

Imagine you are the single most powerful person on earth. Are you going to be an unrepentant narcissist in the manner of Donald Trump, who believes he should govern on his own twisted morality based simply on ‘gut instinct’? Or are you going to take a different approach, set out your reasoned approach to governing in a book, and then govern with the moral authority of thousands of years of philosophy?

Marcus Aurelius is often remembered as the philosopher-king, but that description understates the difficulty of his position. He ruled the Roman Empire during a period of war, plague, economic strain, and political instability. Unlike many philosophers, Marcus Aurelius did not write for an audience. His Meditations were private reflections, written to discipline his own thinking while exercising absolute power.

This matters for compliance professionals. Marcus Aurelius did not theorize about ethical leadership from a distance. He lived inside it. He understood that power magnifies temptation, insulates leaders from feedback, and creates opportunities for self-deception. His philosophy is therefore preoccupied with restraint, humility, consistency, and responsibility.

Marcus repeatedly reminded himself that leadership is not a privilege but a burden. Authority did not entitle him to indulgence; it imposed higher expectations. He believed that leaders set moral boundaries through conduct long before they issue instructions. In modern terms, Marcus Aurelius understood that culture flows downward from leadership behavior rather than upward from policy documents.

II. The Compliance Problem Marcus Aurelius Illuminates: Culture Eats Controls

One of the central lessons of modern compliance enforcement is that formal controls cannot compensate for poor culture. Organizations with detailed policies and sophisticated monitoring still fail when leadership behavior signals that results matter more than integrity. The DOJ Evaluation of Corporate Compliance Programs (ECCP) explicitly asks whether senior leaders demonstrate commitment to compliance through actions, not words. Regulators assess whether ethical behavior is encouraged, whether misconduct is addressed consistently, and whether leaders tolerate or reward problematic conduct.

Marcus Aurelius would recognize this dynamic immediately. He believed that people learn how to behave by observing those in power. When leaders act inconsistently with stated values, cynicism follows. When leaders rationalize misconduct, that rationalization spreads. Compliance programs often falter when leadership treats ethics as a communication exercise rather than a lived expectation. Codes of conduct and training sessions cannot overcome the daily signals sent by executive decisions, incentive structures, and responses to failure.

Marcus teaches that culture is not accidental. It is created continuously by leadership choices, especially under pressure.

III. Modern Corporate Application: Marcus Aurelius, DOJ Expectations, and Leadership Accountability

Applying Marcus Aurelius to modern compliance reveals several concrete expectations that closely align with DOJ guidance.

First, leadership behavior must be consistent. Marcus believed hypocrisy was corrosive to authority. The DOJ similarly evaluates whether leaders follow the same rules they impose on others. Exceptions for senior executives undermine program credibility and weaken deterrence.

Second, leadership must respond to misconduct with moral clarity. Marcus wrote that anger and denial cloud judgment. In compliance terms, this means addressing issues promptly, transparently, and proportionately. Delayed or defensive responses signal tolerance, even when discipline eventually occurs.

Third, middle management matters. Marcus understood that culture is transmitted through layers of authority. DOJ guidance emphasizes the role of middle managers as culture carriers. Compliance programs should equip managers with the tools and incentives to reinforce ethical behavior, not merely deliver targets.

Fourth, incentives must reflect values. Marcus warned against leaders who chase reputation or reward at the expense of principle. Modern compliance programs must ensure compensation structures do not reward outcomes achieved through questionable means. The DOJ has repeatedly cited incentive misalignment as a root cause of misconduct.

Finally, leadership must create psychological safety. Marcus believed leaders should listen more than they speak. In compliance terms, this translates into openness to bad news, encouragement of dissent, and protection for those who raise concerns. A culture that punishes truth-telling cannot sustain compliance.

IV. Key Takeaways for Compliance Professionals

1. The Blueprint. Compliance professionals should view Marcus Aurelius and his writings as the blueprint for culture-based compliance. You can draw a direct line from the Meditations to both your compliance program and the leadership skills a CCO needs. Compliance should evaluate leadership behavior as a primary control, not a soft factor. This means not only reviewing employees who are promoted to management, but also a deep dive into their backgrounds. Also, thorough due diligence for any senior management hires from outside your organization.

2. Higher Standards. Compliance should hold senior leaders to higher standards of consistency and accountability.

3. Institutional Justice. Compliance should focus on how leaders respond to misconduct, not just how they prevent it. This is the CCO’s charge, and it must include an institutional fairness component in your compliance program.

  1. Compliance should ensure incentives reinforce ethical behavior at every level. The DOJ has consistently discussed the role of incentives in any compliance program, as far back as the 1st edition of the FCPA Guidance in 2012.
  2. Compliance should treat culture as an operational risk area subject to oversight and testing. Culture should be assessed, monitored, and improved. Simply because it is seen as a ‘soft’ part of an organization does not mean it should be treated differently.

4. Walk the Walk. Finally, Marcus Aurelius reminds us that ethical leadership is not performative. It is visible, daily, and decisive. In organizations, culture follows leadership long before it follows policy.

V. Conclusion

Marcus Aurelius brings the compliance lifecycle to its cultural apex. He shows that leadership behavior is not merely influential but determinative, shaping whether ethical expectations are taken seriously or quietly dismissed. Yet even the strongest ethical culture is not self-sustaining. Leaders are human, memory fades, and good intentions erode without reinforcement. This is where culture must be supported by systems that observe, test, and correct.

Marcus Aurelius teaches us how leaders should behave; Lucretius challenges us to examine how organizations think. If Marcus focuses on moral example, Lucretius turns our attention to rational observation, warning against fear, superstition, and self-deception. The transition from Marcus Aurelius to Lucretius mirrors the shift from cultural leadership to continuous improvement, from ethical intent to empirical verification. In compliance terms, it is the move from assuming the program works to proving that it does, using data, monitoring, and clear-eyed analysis rather than hope or habit.

Join us tomorrow for our concluding article on Lucretius and Rationality in Monitoring and Continuous Improvement. We will consider where culture gives way to systems, data, and the discipline of seeing risk clearly rather than through fear or superstition.

Categories
Compliance Into the Weeds

Compliance into the Weeds: The Reality of AI Adoption in Corporate Compliance

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly examine three recent surveys that examine the real-world impact of AI adoption in corporate environments.

Recording from Alexandria, Virginia, where Matt is attending a conference on ethical governance of AI, Matt and Tom discuss the differing perceptions of AI’s benefits between senior executives and other employees. They explore findings from PWC, Section, and Workday surveys, uncovering a significant gap in AI’s perceived value. The discussion highlights the challenges of integrating AI, the significant rework required by employees, and the struggle to build trust in AI tools. They also debate whether enterprise-scale AI deployment or incremental, point-specific adoption is the best path forward.

Key highlights:

  • Conference on Ethical AI Governance
  • Reality Checks on AI Adoption
  • AI Rework and Employee Training Concerns
  • Trust Issues with AI

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
Blog

Roman Philosophers and the Foundations of a Modern Compliance Program: Part 3 Varro, System Design, and Making Compliance Governable

I recently wrote a series on the direct link between ancient Greek Philosophers and modern corporate compliance programs and compliance professionals. It was so much fun and so well-received that I decided to follow up with a similar series on notable Roman Philosophers. This week, we will continue our exploration of the philosophical underpinnings of modern corporate compliance programs and compliance professionals by looking at five philosophers from Rome, both from the Roman Republic and the Roman Empire.

We have considered Cicero and the duty, law, and the moral limits of business; and Seneca and power, pressure, and ethical decision-making under stress. Today, we consider Varro and corporate governance; upcoming blog posts include Marcus Aurelius and ethical leadership and tone at the top, and we will conclude with Lucretius to explore rationality, fear, and risk perception. Today, we continue our discussion of Varro and compliance governance structures.

I. Varro in Context: Order as Institutional Survival

Marcus Terentius Varro was not a moralist in the way Cicero was, nor a psychological observer like Seneca. He was Rome’s great systematizer. Varro cataloged language, religion, agriculture, history, and civic life with a single objective: to make complex institutions intelligible and durable. He believed that civilizations fail not first from immorality, but from disorder. Although very little of his writings survives, Plutarch described him as “Rome’s Third Great Light” behind Virgil and Cicero.

Varro lived through the collapse of the Roman Republic. He watched institutions grow so complex, fragmented, and inconsistent that they could no longer govern themselves. His response was not exhortation or outrage, but classification. By defining categories, standardizing language, and organizing knowledge, Varro sought to preserve Rome’s ability to function even as political pressures mounted.

For modern compliance professionals, Varro is essential precisely because he does not begin with ethics. He starts with structure. He understood that values cannot operate within incoherent systems. Before leadership can model ethics and before culture can reinforce integrity, the institution must be governable.

II. The Compliance Problem Varro Illuminates: Program Sprawl and Structural Entropy

Modern compliance programs rarely fail because they lack policies or commitment. They fail because they become structurally unmanageable.

Over time, compliance programs accumulate:

  • Policies written for different risks, jurisdictions, and moments in time
  • Risk assessments that do not align with controls
  • Training modules disconnected from decision-making
  • Escalation paths that vary by function or geography
  • Metrics that track activity but do not integrate

This is compliance sprawl. No one intentionally designs it. It emerges gradually as organizations respond to enforcement actions, audits, mergers, new regulations, and internal incidents. Eventually, the program exists everywhere and nowhere at once. Varro would recognize this immediately. He believed that when systems grow faster than understanding, governance becomes ceremonial. Rules exist, but they do not guide behavior. Oversight exists, but it cannot see clearly.

The DOJ Evaluation of Corporate Compliance Programs (ECCP) reflects Varro’s concern by asking whether a program is well-designed, consistently applied, and understood by employees. These are not ethical questions. They are structural ones.

III. Modern Corporate Application: Varro, DOJ Expectations, and Compliance Architecture

Applying Varro to modern compliance highlights the importance of architecture over accumulation.

First, compliance programs must classify risk consistently. Varro believed that naming and categorizing were a form of control. In compliance terms, this means standardized risk taxonomies, consistent issue classifications, and shared definitions across legal, compliance, audit, and HR. Without this, trend analysis and root cause assessment become unreliable.

Second, integration must replace layering. Varro linked systems rather than allowing them to multiply independently. Modern compliance programs should map risks to controls, controls to training, training to behavior, and behavior to metrics. The DOJ increasingly expects compliance to be embedded in business operations rather than treated as a parallel system.

Third, ownership must be explicit. Varro rejected ambiguity about responsibility. In compliance programs, unclear ownership of controls, investigations, and remediation creates delay and finger-pointing. A governable program clearly and visibly assigns responsibility.

Fourth, institutional memory must be preserved. Varro understood that institutions that forget repeat mistakes. Compliance programs must retain investigation outcomes, remediation decisions, and lessons learned to inform future risk assessments and controls. DOJ guidance increasingly focuses on learning and continuous improvement, which cannot occur without memory.

Finally, language discipline matters. Varro studied language because confused language produces confused action. In compliance, inconsistent terminology across policies, reports, and board materials undermines oversight. Precision is not pedantry. It is governance.

IV. Key Takeaways for Compliance Professionals

  1. Compliance Governance. Compliance professionals should view Varro as the architect of governable compliance. Varro teaches that ethics cannot function without a structure that allows oversight, consistency, and understanding. A compliance program that cannot be clearly explained cannot be effectively governed. Governable compliance is the prerequisite for ethical leadership, accountability, and continuous improvement.
  2. Well Designed. Compliance should prioritize coherence over accumulation. Adding more policies, controls, and tools does not strengthen a compliance program if they do not align with one another. Varro would warn that unchecked accumulation creates confusion rather than protection. Coherence ensures that each element of the program reinforces the others instead of competing for attention.
  3. Risk Measurement. Compliance should standardize risk classification and language across functions. Varro understood that shared language is essential for coordinated action. When legal, compliance, audit, and business teams describe the same risk differently, oversight becomes fragmented. Standardized terminology allows trends to be identified, lessons to be learned, and governance to function effectively.
  4. Written Program. Your compliance should integrate policies, controls, training, and metrics into a single operating model. Varro rejected isolated systems in favor of interconnected ones. A compliance program works only when policies inform controls, controls shape training, and training influences measurable behavior. Integration transforms compliance from a collection of activities into an operational system.
  5. Remember. Compliance should preserve institutional memory to prevent repeat failures. Varro believed institutions must remember their own history to avoid repeating mistakes. Compliance programs fail when lessons learned from investigations or audits are lost with personnel changes or reorganizations. Preserving institutional memory enables trend analysis, informed risk assessments, and durable remediation.
  6. Enabler. Compliance should treat structure as an ethical enabler, not a bureaucratic burden. Structure is often misunderstood as red tape rather than support. Varro shows that clear structure empowers ethical action by reducing ambiguity and inconsistency. Well-designed systems make it easier for individuals and leaders to do the right thing.
  7. Simplicity. Finally, Varro reminds us that ethical intent cannot survive inside incoherent systems. Compliance programs do not fail only because people act under pressure. They fail because the system itself becomes too complex to operate. Ethical breakdown is often preceded by structural breakdown. When compliance systems become fragmented, opaque, or unmanageable, even well-intentioned actors struggle to act responsibly. Varro’s lesson is that simplicity, clarity, and integration are not administrative preferences but governance necessities.

V. Conclusion

Varro’s enduring contribution to modern compliance is his insistence that ethics cannot function in systems that cannot be understood, managed, or governed. He reminds compliance professionals that before culture can shape behavior and before leadership can model integrity, the program itself must be coherent, integrated, and durable. In an era where compliance programs risk collapsing under their own complexity, Varro offers a sobering but practical lesson: clarity is not a luxury, simplicity is not weakness, and structure is not bureaucracy. They are the conditions that allow ethical intent to survive pressure, scale, and time.

Varro stabilizes the compliance program by making it governable. But structure alone does not produce integrity. A well-organized system can still fail if those who lead it do not model ethical restraint. This is where Varro yields to Marcus Aurelius. If Varro ensures that the compliance program holds together, Marcus Aurelius determines how it behaves. The transition from Varro to Marcus Aurelius mirrors the shift from system design to ethical leadership, from architecture to example. Compliance becomes durable only when principled leaders animate coherent systems.

Join us tomorrow in Part 4 for a look at Marcus Aurelius, stoicism, and leadership.

Categories
AI Today in 5

AI Today in 5: February 3, 2026, The AI Undergrad Degree Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider five stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. UW-Whitewater offers an undergraduate degree in AI. (Channel3000)
  2. The race to build an operating system for investment advisors. (InvestmentNews)
  3. Cramer says AI changing companies fortunes. (YahooFinanceSingapore)
  4. Is your business’s speed a risk? (FinTechGlobal)
  5. Where is AI taking us? 8 thinkers report. (NYT)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

Categories
Red Flags Rising

Red Flags Rising: S01 E36: How to Prepare for 2026 – The Fraud Diamond Framework (SM) Applied

Mike Huneke and Brent Carlson return for the new year with a refresher on The Fraud Diamond Framework (SM) introduced in Episode 34 and an explanation of how it would apply in practice as trade compliance professionals try to expect the unexpected in 2026. They discuss the importance of designing and implementing “compliance backstops” as geopolitical guardrails (01:47), how Stoic philosophy and the good work of Mo Bunnell (CEO and Founder of Bunnell Idea Group, author of Give to Grow) help build resiliency (03:40), review The Fraud Diamond Framework(SM) (05:57), describe how the framework can help trade compliance personnel to make and defend triage decisions (10:59), the implications of many trade compliance programs reaching a point in their evolution where they need to be able to demonstrate true integrity and effectiveness (13:45), the new 25% tariffs on certain semiconductors (14:38), and notable economic sanctions enforcement decisions related to lawyers’ advice or lawyers themselves (15:56). They conclude with Brent’s first Managing Up of 2026 (21:04).

Resources:

Brent’s email: brent@redflagsrising.com

Mike’s email: michael.huneke@morganlewis.com

Categories
Blog

Roman Philosophers and the Foundations of a Modern Compliance Program: Part 2 Seneca on Pressure and Compliance

I recently wrote a series on the direct link between ancient Greek Philosophers and modern corporate compliance programs and compliance professionals. It was so much fun and so well-received that I decided to follow up with a similar series on notable Roman Philosophers. This week, we will continue our exploration of the philosophical underpinnings of modern corporate compliance programs and compliance professionals by looking at five philosophers from Rome, both from the Roman Republic and the Roman Empire.

Yesterday, we considered Cicero and the duty, law, and the moral limits of business; today, we will look at Seneca and power, pressure, and ethical decision-making under stress; upcoming blog posts include Marcus Aurelius and ethical leadership and tone at the top; Varro and corporate governance; and Lucretius to explore rationality, fear, and risk perception. Today, we continue with Seneca on pressure and when compliance matters the most.

I. Seneca in Context: Ethics from Inside Power

Lucius Annaeus Seneca did not write philosophy from a safe distance. He lived at the center of Roman power, wealth, and danger. As tutor and later advisor to Emperor Nero, Seneca understood how quickly ethical intentions could be compromised by fear, ambition, loyalty, and survival. He also understood how people justify those compromises to themselves.

Seneca’s writings, particularly Letters from a Stoic and On Anger, are not abstract moral treatises. They are practical examinations of how human beings behave when placed under stress. He was deeply concerned with emotional excess, not because emotions were immoral, but because unchecked emotion distorts judgment. Anger, fear, greed, and the desire for approval all lead otherwise rational people to make decisions they later defend as necessary.

For Seneca, ethical failure was rarely sudden. It was incremental. People crossed lines not because they intended to be corrupt, but because they convinced themselves that circumstances demanded flexibility. This insight makes Seneca indispensable to the modern compliance professional, whose greatest challenge is not policy design, but behavior under pressure.

II. The Compliance Problem Seneca Illuminates: Rationalization Under Stress

Most compliance programs are designed around rules, controls, and reporting structures. Far fewer are designed with human psychology in mind. Seneca would argue that this is a critical oversight. Modern compliance failures often occur in high-pressure environments: aggressive sales targets, looming deadlines, competitive markets, political instability, or financial distress. In these moments, individuals do not typically reject ethical norms outright. Instead, they rationalize deviations as temporary, necessary, or harmless.

Common rationalizations include:

  • “This is how business is done here.”
  • “We will fix it later.”
  • “No one is really harmed.”
  • “Leadership expects results.”
  • (and my personal favorite) “We’ve always done it this way.”

Seneca warned that these internal narratives are more dangerous than ignorance. Once people justify unethical conduct to themselves, external controls become less effective. A policy cannot compete with a story someone tells themselves to preserve status, income, or safety. The DOJ, particularly in its various iterations of the Evaluation of Corporate Compliance Programs (ECCP), has increasingly focused on this dynamic. In recent enforcement actions, regulators have emphasized root-cause analysis, asking not only what rule was broken but also why individuals felt compelled to break it. Pressure, incentives, and cultural signals consistently appear as contributing factors.

Seneca teaches that compliance programs must anticipate rationalization. It is not enough to say “do not do this.” Organizations must understand when and why people will convince themselves that doing it is acceptable.

III. Modern Corporate Application: Seneca, DOJ Expectations and Behavioral Compliance

The ECCP explicitly asks whether a company’s risk assessment and controls account for “the types of misconduct most likely to occur” and whether the company has “addressed the root causes of misconduct.” These questions align directly with Seneca’s insights. Consider major enforcement actions involving systemic bribery, fraud, or manipulation of controls. In cases such as the Wells Fargo fraudulent accounts scandal or the Volkswagen emissions testing scandal, both of which involved employees operating under intense performance pressure. While not all wrongdoing can be excused by culture, regulators repeatedly noted environments where employees felt trapped between expectations and ethics.

A Seneca-informed compliance program would focus on several practical measures.

First, risk assessments should explicitly identify pressure points. Compliance should map where incentives, deadlines, or market conditions increase the likelihood of rationalization. This includes sales functions, third-party relationships, emerging markets, and crises.

Second, training should move beyond rules into scenario-based discussions. Seneca believed self-awareness was an ethical discipline. Modern compliance training should confront common rationalizations directly, helping employees recognize them before they take hold. DOJ guidance increasingly favors practical, tailored training over generic training.

Third, escalation pathways must be realistic under stress. A hotline that exists only on paper will not be used when fear of retaliation or failure dominates. Seneca understood that fear silences conscience. Effective compliance programs must demonstrate that speaking up under pressure is protected, valued, and acted upon.

Fourth, leadership messaging matters most during crises. Seneca warned that leaders set moral boundaries through behavior, not speeches. The DOJ has emphasized that how management responds to misconduct is a key indicator of program effectiveness. When leaders excuse results achieved through questionable means, rationalization spreads quickly.

Finally, compliance must be present before the crisis, not introduced afterward. Seneca would view reactive compliance as inherently weak. Ethical resilience must be built in advance, when judgment is clear, and stakes are lower.

Key Takeaways for Compliance Professionals

1. Behavioral Risk. Compliance professionals should view Seneca as a guide to behavioral risk, not philosophical pessimism. Seneca focuses on how real people behave under pressure rather than on abstract ethical ideals. He recognizes that stress, fear, ambition, and loyalty distort judgment long before formal rules are broken. For compliance professionals, Seneca provides a framework for understanding why misconduct occurs even in organizations with well-designed programs.

2. Pressure Points. Compliance should identify and manage pressure points where rationalization thrives. High-performance targets, crises, and competitive markets create environments where ethical shortcuts are easily justified. Seneca teaches that rationalization flourishes when people feel trapped between expectations and consequences. Compliance programs must proactively map and mitigate these pressure points rather than react after misconduct occurs.

3. Training Design. Compliance should design training that addresses how people actually make decisions under stress. Traditional rule-based training assumes calm, rational decision-making, which rarely occurs in real-world situations. Seneca reminds us that ethical failure often occurs in moments of emotional intensity rather than in deliberation. Effective compliance training should use scenarios and realistic dilemmas that reflect pressure, ambiguity, and competing incentives.

Compliance should ensure escalation mechanisms work when fear and incentives collide. A hotline or reporting channel is ineffective if employees do not trust it during high-risk moments. Seneca understood that fear silences conscience and discourages disclosure. Compliance programs must test whether escalation pathways function when the personal cost of speaking up feels high.

4. Leadership Engagement. Compliance should engage leadership on how their responses to pressure shape ethical behavior. Leaders signal ethical boundaries most clearly when responding to setbacks, failures, or missed targets. Seneca warned that inconsistent or emotionally driven leadership responses accelerate ethical decay. Compliance professionals must ensure leaders understand that their reactions under pressure become cultural instruction.

  • Compliance should focus on prevention through awareness, not punishment after failure. Seneca emphasized self-awareness as the first defense against moral error. Compliance messaging that only appears after misconduct reinforces fear rather than learning. Ongoing communication about pressure, rationalization, and ethical expectations strengthens resilience before problems arise.
  • Finally, Seneca instructs us that ethical systems fail not because people abandon values, but because they convince themselves that those values can wait. A compliance program that ignores pressure is a program designed to fail when it matters most. Rationalization is the quiet mechanism through which ethical erosion occurs. Seneca shows that delay, exception-making, and “temporary” compromises accumulate into systemic failure. Compliance programs that do not confront rationalization directly leave themselves exposed at their most vulnerable moments.

Conclusion

Seneca exposes the internal dynamics that cause compliance programs to fail under pressure. He shows us how fear, ambition, and rationalization erode ethical judgment, even when rules are clear and controls are in place. But Seneca largely examines the problem from the inside out, focusing on how individuals respond to external forces. That analysis leads directly to the next question in the compliance lifecycle: what responsibility does the individual retain when pressure is real, and authority is unequal? This is where Seneca gives way to Epictetus.

Join us tomorrow as we explore Varro and corporate governance for your compliance regime.

Categories
AI Today in 5

AI Today in 5: February 2, 2026, The On Thin Ice Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider five stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. OpenAI/Nvidia deal ‘on thin ice’. (WSJ)
  2. Wearable AI helping stroke victims. (FoxNews)
  3. Financial firms are facing new compliance risks over AI. (CPI)
  4. A playbook for AI compliance and governance. (FinTechGlobal)
  5. Will AI automate compliance? (LawFare)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

Categories
Blog

Roman Philosophers and the Foundations of a Modern Compliance Program: Part 1 Cicero on Duty and Ethics

I recently wrote a series on the direct link between ancient Greek Philosophers and modern corporate compliance programs and compliance professionals. It was so much fun and so well-received that I decided to follow up with a similar series on notable Roman Philosophers. This week, we will continue our exploration of the philosophical underpinnings of modern corporate compliance programs and compliance professionals by looking at five philosophers from Rome, both from the BCE and AD eras.

We will consider Cicero and the duty, law, and the moral limits of business;  Seneca and power, pressure, and ethical decision-making under stress; Marcus Aurelius and ethical leadership and tone at the top; Epictetus and accountability, control, and ethical agency; and we will conclude with Lucretius to explore rationality, fear, and risk perception. Today, we begin with Cicero and the ethical foundations of the compliance program.

I. Cicero in Context: Duty in an Age of Power and Commerce

Marcus Tullius Cicero lived at the intersection of law, politics, and commerce during the final decades of the Roman Republic. Rome was wealthy, expansive, and deeply corrupt. Provincial governors enriched themselves through bribery and extortion. Political power was routinely monetized. Legal technicalities were used to justify conduct that plainly violated any reasonable notion of fairness or justice.

It was in this environment that Cicero wrote De Officiis (On Duties), a work addressed not to philosophers, but to those who held power and responsibility. Cicero was not interested in abstract virtue. He was interested in how people entrusted with authority should behave when tempted by profit, pressure, or expediency.

For Cicero, duty was not optional. It arose from one’s role and the trust placed in that role. Public office, commercial activity, and leadership all carried moral obligations that custom, convenience, or legal loopholes could not waive. Most importantly, Cicero rejected the idea that what was profitable could excuse what was unethical. Where profit and moral duty conflicted, duty had to prevail.

This framing makes Cicero uniquely relevant to modern corporate compliance. Large organizations, like the Roman Republic, operate through delegated authority, complex incentives, and diffuse accountability. Cicero understood that without an ethical foundation grounded in duty, institutions eventually hollow out, even if they remain technically lawful.

II. The Compliance Problem Cicero Illuminates: When Law Becomes the Ceiling

One of the most persistent failures in corporate compliance programs is treating legal compliance as the ultimate objective rather than the minimum requirement. Organizations ask, “Is it legal?” far more often than they ask, “Is it right?” or “Is this consistent with our obligations as stewards of trust?” Cicero would have recognized this failure immediately. In De Officiis, he warned against the misuse of legal form to justify immoral conduct. He argued that clever interpretations of the law, when divorced from justice, ultimately destroy trust in institutions. This is not merely a moral observation. It is an operational one.

Modern enforcement actions repeatedly demonstrate that misconduct often occurs in plain sight, enabled by policies, approvals, and structures that technically comply with written rules. The Department of Justice has been explicit that a compliance program that exists only on paper, or that focuses solely on technical adherence, will not be viewed as effective. The DOJ Evaluation of Corporate Compliance Programs (ECCP) asks whether a company’s program is “well designed,” “applied in good faith,” and “actually works in practice.” These questions implicitly echo Cicero’s concern. A program that treats legality as the ceiling rather than the floor may satisfy internal counsel, but it fails as an ethical governance system.

Cicero teaches that compliance programs must be grounded in duty: to customers, markets, employees, shareholders, and society. Without that grounding, rules become tools for avoidance rather than instruments of integrity.

III. Modern Corporate Application: Cicero, DOJ Expectations, and Real-World Failures

The ECCP places increased emphasis on culture, leadership accountability, and the role of the board. These expectations align closely with Cicero’s insistence that those in power bear heightened ethical responsibility.

Consider enforcement actions involving bribery, corruption, or fraud in which senior leaders claimed ignorance while benefiting from the outcomes. In multiple Foreign Corrupt Practices Act resolutions, the DOJ has rejected arguments that misconduct occurred despite policies, rather than because governance systems tolerated or incentivized it. In cases such as Airbus and Goldman Sachs, regulators highlighted failures in oversight, escalation, and ethical decision-making at senior levels. From a Cicero-inspired perspective, these are failures of duty. Leaders accepted the benefits of authority without fully embracing its obligations. Compliance programs existed, but they were not anchored in a shared understanding that ethical duty limits what is acceptable in profit-seeking behavior.

Applying Cicero to modern compliance design suggests several concrete actions:

First, the code of conduct should be framed as a statement of duties rather than merely a list of prohibitions. Employees should understand not only what is forbidden, but why certain conduct violates the organization’s obligations to stakeholders.

Second, senior leadership accountability must be explicit. Cicero believed that authority magnifies moral responsibility. The DOJ now expects boards and executives to actively oversee compliance, not passively receive reports. A compliance program that cannot demonstrate meaningful leadership engagement will struggle under scrutiny.

Third, incentives matter. Cicero warned that when institutions reward success without regard to means, they invite corruption. Modern compliance programs must align compensation, promotion, and recognition with ethical behavior, not merely financial outcomes. The DOJ has repeatedly emphasized incentives and discipline as indicators of program effectiveness.

Finally, compliance should be positioned as a governance function, not a technical one. Cicero understood law as a moral instrument, not a procedural shield. Compliance professionals should frame their role as guardians of institutional duty, helping the organization navigate gray areas where legal guidance alone is insufficient.

Key Takeaways for Compliance Professionals

1. Ethical Foundation. Compliance professionals should view Cicero as the ethical foundation of a modern compliance program. Cicero establishes that compliance must be grounded in duty rather than fear of enforcement. He frames ethical behavior as an obligation arising from trust and authority, not as a discretionary choice. A compliance program without this foundation risks becoming a technical exercise divorced from purpose.

2. Law as a Floor. Compliance should treat law as the minimum standard, not the ultimate objective. Cicero warned against using legal formality to justify conduct that violates justice and fairness. Modern compliance failures often arise when organizations ask only whether conduct is legal rather than whether it is right. Effective compliance programs must push beyond legality to reinforce ethical judgment.

3. Governance and Stewardship. Compliance should be positioned as a core governance function. Cicero believed that those entrusted with authority act as stewards, not owners, of institutional power. Compliance should therefore be integrated into governance structures rather than treated as a peripheral control function. This positioning reinforces accountability to stakeholders and long-term institutional integrity.

4. Leadership Duty. Compliance should impose heightened ethical obligations on those with power. Cicero argued that authority magnifies moral responsibility rather than diminishing it. Senior leaders and boards must therefore be held to higher compliance expectations, not exempted for performance or status. Ethical leadership is essential to a program’s legitimacy.

  • Compliance should align incentives with integrity, not just results.
  • Cicero warned that rewarding success without regard to means invites corruption. Modern compliance programs fail when compensation and promotion structures undermine stated values. Incentive alignment is a critical control, not a human resources afterthought.

5. Cultural Legitimacy. Compliance should reinforce trust as an institutional asset.

Cicero understood that institutions survive only so long as they retain public and internal trust. A compliance program grounded in duty strengthens credibility with employees, regulators, and stakeholders alike. Trust is not a soft concept; it is the currency of effective governance.

6. Duty Over Expediency. Finally, Cicero teaches that ethical systems collapse when expediency displaces duty. A compliance program that exists only to manage risk or avoid penalties will eventually lose legitimacy. Compliance grounded in duty, by contrast, becomes a stabilizing force for the institution itself.

Conclusion

Cicero provides the compliance professional with the ethical foundation for a program: duty, legitimacy, and moral purpose. But he largely assumes that once duty is understood, it will be followed. Experience tells us otherwise. Modern compliance failures rarely occur because people do not know the rules or the obligations. They occur because pressure, fear, ambition, and rationalization overwhelm judgment at precisely the moments when duty matters most. That is where Cicero necessarily gives way to Seneca.

If Cicero explains why a compliance program must exist and what it must stand for, Seneca confronts the harder question of how ethical commitments erode under stress. The transition from Cicero to Seneca mirrors the transition from program design to real-world operation, when incentives tighten, stakes rise, and ethical clarity is tested. This is where compliance programs are no longer theoretical and where many begin to fail.

Join us tomorrow as we explore Seneca and compliance under pressure, using Cicero’s foundation as the explicit point of departure.