Tag: culture

Categories
Blog

Frankenstein and Compliance: Part 3 – Son of Frankenstein: You Inherited the Castle, You Inherited the Risk

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first two Frankenstein films present two distinct compliance failures. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands the risk but lets pressure, ambition, and rationalization override judgment. Son of Frankenstein (1939) presents the next stage: inherited risk, or in the business world, risks through acquisition.

Wolf von Frankenstein, played by Basil Rathbone, returns with his family to his ancestral estate hoping to restore the Frankenstein name. Instead, he encounters Ygor, played by Bela Lugosi, and discovers that his father’s Monster is still alive. Wolf had no role in creating the original problem, but his discovery forces him to decide how to address the legacy he has inherited.

That situation should be familiar to companies following acquisitions, leadership transitions, compliance investigations, or changes in the control environment. New management may have no connection to historical misconduct. An acquiring company may not have created the target’s problematic third-party relationships. A new CCO may inherit investigations and remediation projects that were initiated years earlier. Historical responsibility and current responsibility are different questions. The business issue is how management responds once a legacy risk becomes known.

The Castle Is an Acquisition

Think of Wolf’s return to the Frankenstein estate as an acquisition. He receives the property, assets, name, and opportunity to benefit from his father’s scientific legacy. He also assumes the consequences associated with that legacy. Corporate acquisitions work much the same way. Companies acquire revenue, customers, employees, technology, intellectual property, distribution networks, and market access. They may also inherit high-risk third parties, weak internal controls, questionable historical practices, unresolved investigations, government relationships, and cultural problems.

This is why compliance due diligence should focus on how the target actually conducts business rather than simply whether it has the expected compliance infrastructure. A target may have a Code of Conduct, an anti-corruption policy, annual training, and a hotline. Those are relevant data points, but they do not establish program effectiveness.

Compliance needs to understand the target’s business model and risk profile. Consider such questions as: Where does the business operate? Who are its customers? Does it interact with government agencies or state-owned entities? Which third parties generate or facilitate business? How does the company select and compensate those parties? What does the investigation history reveal? Are there recurring audit or control deficiencies? What does speak-up data indicate? Are significant policy exceptions concentrated in particular markets or business units? The objective is to understand the risk embedded in the business being acquired.

Due Diligence Is the Beginning, Not the End

Even well-designed pre-acquisition due diligence has limitations. Transactions operate under deadlines and time pressures. Access to employees and records may be restricted. (See: Opinion Release 08-02) Data may be incomplete. Privacy requirements may constrain review. Some risks simply do not become visible until the buyer gains access to systems, records, personnel, and financial information after closing. Those limitations make the connection between due diligence and post-acquisition integration critical.

If the buyer cannot complete diligence on a high-risk distributor before closing, that relationship should become a post-closing priority. If investigation records are incomplete, they should be reviewed during integration. If significant controls cannot be tested before the transaction, testing should be incorporated into the integration plan. Compliance should therefore document unresolved diligence issues and carry them forward with assigned owners and deadlines.

This discipline matters because closing creates competing priorities. Management quickly shifts to customers, systems, personnel, financial reporting, cost savings, and expected synergies. Compliance integration can become one workstream among many. An unanswered compliance question doesn’t become less significant once the transaction closes.

Post-Acquisition Integration Is the Operational Test

An acquiring company can conduct excellent due diligence and still create exposure if it fails to integrate the acquired business effectively. Post-acquisition integration is where the buyer’s compliance expectations become operational. Employees need to understand the acquiring company’s Code of Conduct, policies, reporting mechanisms, investigation procedures, third-party requirements, approval processes, and internal controls. High-risk third parties may require additional diligence. Contracts may need updated compliance provisions. Financial controls may need harmonization. Employees need risk-appropriate training.

Integration should also reflect the acquired company’s actual risk profile. A business operating primarily in lower-risk markets with direct sales may require a different approach than a company that depends on agents and distributors in jurisdictions with substantial government interaction. Do not apply the same integration checklist mechanically to every acquisition.

The CCO should know which issues require immediate attention, which can be addressed over a reasonable integration period, and who is accountable for each significant action. Without ownership and monitoring, temporary integration gaps can become lasting control weaknesses.

Ygor and the Informal Organization

Ygor provides one of the movie’s most useful compliance lessons. He understands the Frankenstein estate better than Wolf does. He knows its history, its secrets, and how things actually work. Every organization has a formal structure and an informal operating system. The organizational chart describes reporting relationships. Policies describe required processes. Procedures identify approvals. Employees know how business actually gets done.

They know which approvals receive meaningful scrutiny and which are largely administrative. They know which managers routinely approve exceptions. They know which third parties have special relationships with executives. They know which controls become flexible near quarter-end. They know whether raising a concern is welcomed or career-limiting. This is why compliance risk assessment cannot rely exclusively on documents.

Policies lay out how an organization is supposed to operate. Interviews, focus groups, hotline information, investigations, transaction testing, third-party monitoring, audit findings, and employee surveys can show how it operates in practice. That distinction becomes particularly important following an acquisition. The buyer needs to understand not only the target’s compliance architecture but also its operating culture.

Institutional Memory Is a Compliance Control

Inspector Krogh represents the other side of organizational knowledge. He remembers the consequences of the original Frankenstein experiment because he experienced them personally. His perspective is shaped by history, not by Wolf’s confidence that the past can be managed differently. Companies need mechanisms for preserving similar institutional knowledge.

Investigations produce knowledge. Internal audits produce knowledge. Regulatory inquiries produce knowledge. Compliance monitoring and remediation projects produce knowledge. That knowledge can disappear surprisingly quickly. Employees retire. CCOs leave. Executives change roles. Board members rotate. Investigations close. Outside counsel completes an engagement. Remediation projects are marked complete.

Years later, new management may propose a business arrangement, third-party relationship, market strategy, or control change similar to one the organization previously determined was problematic. An effective compliance program should prevent important lessons from depending entirely on the memories of individual employees.

Significant investigation findings should inform future risk assessments. Root causes should influence control design. Remediation lessons should affect monitoring. Historical third-party concerns should remain available when relationships are reconsidered. An investigation’s purpose is not simply to resolve an allegation. It should also improve the organization’s understanding of its risks.

New Leadership and the Risk of Exceptionalism

Wolf demonstrates another challenge common to leadership transitions. New leaders often believe they can manage risks that previous leaders could not. Sometimes they can. New leadership may bring stronger systems, better controls, additional resources, and improved judgment. The problem arises when confidence leads management to discount why earlier controls or restrictions were established.

A new sales executive may propose reengaging a distributor previously terminated for compliance concerns. A new CEO may reconsider a market that previous management considered too risky. A new business leader may conclude that an approval requirement imposed after earlier misconduct is unnecessarily restrictive. Any of those decisions may be appropriate. Controls should not remain in place indefinitely simply because they are old. But management should understand the history before changing them.

Before removing a control, determine why it was created. Before reengaging a third party, understand why the relationship ended. Before changing monitoring requirements, identify the risk they were designed to address. Some controls become obsolete. Others represent lessons learned. Good governance distinguishes between the two.

Red Flags and the Governance Response

The central compliance issue arises when Wolf learns the Monster is alive. At that point, the question moves from discovery to response. Corporate compliance systems serve a similar purpose. Internal controls, monitoring, Internal Audit, risk assessments, investigations, hotlines, and management reporting should surface significant information.

The effectiveness of those systems depends upon what happens after the information arrives. The Evaluation of Corporate Compliance Programs (ECCP) suggests such inquiries as: Was the issue investigated? Was it escalated appropriately? Did management assign remediation? Was completion tracked? Was effectiveness tested? Did significant information reach the board or appropriate committee? A sophisticated reporting system provides little protection if material concerns repeatedly reach decision-makers without producing action.

For a CCO, this means escalation protocols matter. The organization should understand which issues remain within normal management processes, which require senior management attention, and which warrant board notification.

Legacy Third Parties Require Fresh Review

Inherited third-party relationships deserve particular attention because longevity can create a false sense of security. The distributor has worked with the business for fifteen years. The consultant is well known locally. The customs broker has always handled interactions with government agencies. No significant problems have been reported previously. Those facts provide context. They do not replace risk-based oversight.

Acquisitions and leadership transitions provide an opportunity to reassess significant legacy relationships. Is the third party still necessary? Is the business rationale documented? Is beneficial ownership information current? Has the risk profile changed? Are payment arrangements appropriate? Are contracts current? Has monitoring identified concerns? Longstanding relationships should not automatically be grandfathered into the current compliance program. Some may warrant closer attention precisely because they were established under different controls, different management, and different expectations.

Practical Actions for the CCO

Son of Frankenstein suggests a practical agenda for compliance leadership. Due diligence should examine actual business operations, not just the existence of policies. Unresolved diligence issues should move directly into the integration plan with defined ownership and deadlines. Integration should be risk-based and should include controls, training, reporting mechanisms, investigations, and third-party oversight.

Significant legacy third parties should be reassessed rather than automatically accepted. Preserve investigation findings and past control failures as institutional knowledge and incorporate them into future risk assessments. New leadership should understand why significant controls were established before deciding to eliminate or weaken them. Finally, significant inherited risks should have clear owners. Issues that sit between the transaction team, business leadership, Legal, Compliance, Finance, and Internal Audit can otherwise remain unresolved because everyone assumes someone else is responsible.

The Compliance Lesson

Son of Frankenstein demonstrates the difference between responsibility for creating a problem and responsibility for managing one. Organizations routinely inherit compliance risks through acquisitions, leadership transitions, longstanding business practices, third-party relationships, and unresolved control weaknesses. New management should not be treated as responsible for conduct that occurred before it arrived. Its responsibility begins with the response.

Effective compliance requires the organization to identify inherited risks, prioritize them by significance, assign ownership, integrate acquired operations, preserve institutional knowledge, and verify corrective actions. That is the business lesson from Wolf von Frankenstein’s return to the family estate. The value of an inheritance cannot be separated from its risks.

The next stage of the Frankenstein story raises another familiar compliance issue. Organizations can identify problems, investigate them, revise policies, conduct training, complete remediation plans, and close findings. Yet sometimes the same problem returns.

In our next selection, we consider The Ghost of Frankenstein. In this movie, the compliance issue is no longer discovery or inheritance. It is program effectiveness. If management says the problem has been remediated, what evidence demonstrates that the remediation actually worked?

For a discussion on these topics and a review of the movie, check out Timothy and Fiona in this episode of Popcorn and Compliance.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 2: Bride of Frankenstein Dr. Pretorius and the Compliance Problem of Knowing Better

This October, Tom Fox returns to one of his all-time favorites: the Universal Pictures classic monsters. Over the years, Tom has covered classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, and has also explored films by Val Lewton and Hammer Studios. This year, he’s back with a deep dive into the first five Frankenstein movies. The series covers the original Frankenstein, Son of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This second episode tackles what many viewers call the greatest horror movie of all time: Bride of Frankenstein (1935). Tom’s AI friends, Timothy and Fiona, comment throughout.

Film Synopsis

Bride of Frankenstein picks up after Henry Frankenstein and the Monster survive the original film. Henry wants to leave his experiments behind, but the wonderfully sinister Dr. Pretorius pulls him back toward creation, ultimately forcing him to help create a female companion for the Monster. Meanwhile, the Monster himself develops emotionally and intellectually, experiences both human kindness and cruelty, and desperately seeks companionship. The experiment succeeds technically, but the Bride immediately rejects the Monster, setting up the film’s tragic conclusion.

Key highlights:

  • Knowing better changes everything.
  • Pretorius represents the dangerous adviser.
  • Culture is learned behavior.
  • Speak-up systems require psychological safety.
  • Ethical leadership is tested when ethics becomes expensive.

Popcorn and Compliance takeaway: The most dangerous compliance failure may occur when leadership already knows the right answer and allows someone to persuade it otherwise.

Timothy and Fiona are AI-generated voices courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 2 – Bride of Frankenstein: When Leaders Know Better

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox takes a deep dive into the first five Frankenstein movies. Over October, he will cover Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. The blog post accompanies the podcast series.

The compliance problem in Frankenstein was innovation without governance. Henry Frankenstein became so focused on whether he could create life that he failed to consider adequately what would happen if he succeeded. He had extraordinary technical capabilities but almost no governance infrastructure around his experiment. There was no meaningful risk assessment, no effective challenge function, no contingency planning, and no clear accountability for the consequences. In Bride of Frankenstein (1935), the compliance problem is different and considerably more troubling. Henry now knows better.

Henry has survived the consequences of his original experiment. He has seen the Monster die and the destruction it caused. He understands that his scientific ambition created risks he could not control. At the beginning of the sequel, Henry appears ready to put his experiments behind him and build a life with Elizabeth. Then Dr. Pretorius arrives.

Pretorius is one of the great characters in the Universal horror canon, but anyone who has spent time in corporate compliance will recognize him. He is intelligent, sophisticated, persuasive, and completely convinced that conventional ethical boundaries should not interfere with extraordinary achievement. More importantly, he understands Henry. Pretorius knows which arguments will appeal to Henry’s ambition and which pressures will overcome his judgment.

This changes the compliance analysis. Henry cannot claim that the risk is unknown. He has already experienced the consequences. The question is whether he has learned from them. That distinction provides the central compliance lesson of Bride of Frankenstein. A significant difference exists between an organization that fails to identify a new risk and one that identifies it, experiences the consequences, and then allows the same underlying conduct to return.

Knowledge Changes the Governance Obligation

Corporate compliance programs generate information. Risk assessments identify vulnerabilities. Internal audits identify control weaknesses. Investigations identify misconduct. Hotline reports identify cultural problems. Due diligence identifies third-party risks. Compliance monitoring identifies patterns that may require further attention. The value of that information depends upon what the organization does with it.

An investigation that establishes what happened but produces no organizational change has limited compliance value. The same is true of an internal audit finding that is administratively closed without determining whether the underlying risk has been reduced. Knowledge must lead to action. This is where Henry fails. He possesses precisely the information that should prevent him from returning to the laboratory. He knows his previous experiment had catastrophic consequences. Nevertheless, Pretorius gradually pulls him back toward the same underlying conduct.

For a CCO, this raises an important question about repeat misconduct. When the same type of compliance problem appears more than once, the organization should ask whether the earlier incident was treated as an isolated event rather than a systemic warning. Questions you might ask include: Did the investigation identify root causes? Were controls changed? Were incentives examined? Was management behavior considered? Was remediation tested? Were lessons incorporated into the next risk assessment? Once an organization knows where a material risk exists, future failures become more difficult to characterize as unforeseeable.

The Pretorius Problem

Pretorius represents a particular type of organizational risk: an influential individual who consistently finds reasons why normal controls shouldn’t apply. Every experienced compliance professional has encountered some version of this problem. A business executive explains that a particular transaction is unique. A salesperson argues that a questionable practice is standard in the local market. A manager insists that due diligence must be completed after onboarding because the customer cannot wait or you will cause the company to miss the quarter’s numbers. None of those statements necessarily establishes misconduct. They should nevertheless cause a compliance professional to ask additional questions.

The danger often comes through rationalization rather than an explicit request to violate the law. The transaction is too important. The amount is too small. The customer relationship is too valuable. The competitor already does it. The process takes too long. The documentation can be completed later. Pretorius works on Henry in much the same way. He does not persuade Henry that the original experiment was harmless. He persuades him that there is a sufficiently compelling reason to cross the boundary again. That is a leadership problem because effective ethical leadership requires executives to recognize when commercial, personal, or organizational pressure is changing their risk tolerance.

When Exceptions Become the Business Process

One of the most important implications for a compliance program is managing exceptions. Most corporate policies need some mechanism for legitimate exceptions. Business circumstances are too complex to assume every rule applies equally in every situation. The problem arises when exceptions become routine.

Consider third-party due diligence. A distributor needs to begin work immediately because of a time-sensitive commercial opportunity. Management approves an exception that lets work begin before diligence is complete. The exception may be entirely defensible. Then another distributor receives the same treatment. Then another. Eventually, business personnel begin viewing due diligence as a process that can routinely be completed after onboarding. The written policy has not changed. The actual control environment has.

The same issue can arise with gifts and entertainment, conflicts of interest, expense approvals, sanctions screening, contracting requirements, AI approvals, cybersecurity requirements, or financial controls. Each exception may have a plausible business explanation. Taken together, the exceptions may demonstrate that the organization has developed an operating practice inconsistent with its stated policy.

Compliance should therefore monitor exceptions as data. How many are being granted? Which business units request them? Which executives approve them? Are the same reasons repeatedly used? Do temporary exceptions become permanent arrangements? A pattern of exceptions can early indicate the normalization of deviance.

Culture Becomes Visible When the Stakes Rise

Bride of Frankenstein also provides an important lesson about corporate culture. Culture is relatively easy to discuss when ethics and commercial objectives don’t conflict. The real test comes when the two appear to diverge.

Suppose Compliance identifies significant concerns about the company’s highest-revenue distributor. What happens next? Suppose an investigation substantiates allegations involving a senior executive responsible for a strategically important business. How does management respond? Suppose an AI application promises significant cost savings, but Legal, Privacy, Information Security, or Compliance recommends delaying deployment for additional testing. Does the company wait? Those decisions reveal more about corporate culture than a values statement.

Henry believes he has changed after the events of Frankenstein. Pretorius tests that belief. Once scientific ambition, pressure, and personal consequences enter the equation, Henry’s commitment to walking away begins to erode. Companies experience the same tension. A business may have strong written values and an extensive compliance program, but employees pay attention to what happens when adherence to those values becomes costly.

This is particularly important for boards. Boards cannot assess culture solely through training completion rates, hotline statistics, or employee surveys. Those metrics can help, but directors should also understand how management handles difficult decisions involving high performers, major customers, significant third parties, and substantial revenue. Culture becomes visible in decisions.

The Monster and the Importance of Organizational Experience

One of the most significant developments in Bride of Frankenstein is the Monster’s evolution. In the original film, he is largely reactive. In the sequel, he begins to learn about human relationships and the world around him. The sequence with the blind hermit is particularly important. The hermit does not judge the Monster by his appearance. He provides food, companionship, music, and kindness. The Monster responds to that environment. For a brief period, we see how different surroundings produce different behavior.

That provides a useful analogy for corporate culture. Employees learn what an organization values through experience. They observe how their supervisors behave. They see who receives promotions and bonuses. They notice whether high performers receive exceptions from policies. They see whether the organization respects or marginalizes people who raise concerns. They learn whether management wants bad news delivered promptly or prefers problems to stay below the surface.

Compliance should therefore pay particular attention to management behavior. Employee surveys, exit interviews, hotline data, investigation trends, turnover information, disciplinary records, and audit findings can help identify business units where the local management culture differs from the company’s stated expectations.

Incentives Can Become the Corporate Pretorius

Pretorius uses Henry’s ambition as leverage. Corporations use compensation and performance systems to influence employee behavior every day. That makes incentives a central compliance issue. A company may tell employees that integrity is its highest priority while evaluating them primarily on revenue, growth, margin, or quarterly performance. Employees will quickly determine which message matters more.

This does not mean financial incentives are inappropriate. Companies exist to generate economic value, and employees should be rewarded for performance. The compliance issue is whether the incentive structure unintentionally encourages excessive risk-taking or undermines controls.

Compliance should understand how significant employee populations are compensated. The Evaluation of Corporate Compliance Programs (ECCP) makes similar inquiries. Should questions include: Are sales targets realistic? Do employees get rewarded for the quality and sustainability of performance, or simply for the amount of revenue generated? Does compliance performance affect bonuses or promotion decisions? Are managers held accountable for control failures within their teams? Can compensation be reduced or recovered following significant misconduct? The goal is alignment. Employees should understand that how results are achieved matters as much as the results themselves.

High Performers Are the Real Test of Accountability

Perhaps the clearest test of ethical culture comes when a high-performing employee violates policy. If the organization disciplines junior employees while protecting commercially valuable executives, employees will understand that there are two compliance systems. One exists in the policy manual. The other exists in practice.

Consistency does not require identical discipline in every case. Facts, intent, seniority, cooperation, prior conduct, and other circumstances can legitimately affect disciplinary decisions. But commercial value should not create immunity. Boards should understand how management handles misconduct involving senior leaders and significant revenue producers. The issue is not whether directors should participate in routine disciplinary decisions. They should not. The governance question is whether accountability applies throughout the organization.

Pretorius operates as though ordinary ethical constraints are for other people. Companies should ensure they do not inadvertently create executives who reach the same conclusion.

The Compliance Lesson

Bride of Frankenstein is ultimately about organizational learning. Companies will make mistakes. Controls will fail. Employees will engage in misconduct. Compliance programs will occasionally fail to identify risks before those risks become problems.

Program effectiveness shows up in what happens next. An investigation should generate knowledge. That knowledge should inform root-cause analysis. Root-cause analysis should drive remediation. Remediation should change controls, incentives, training, supervision, or business processes where necessary. Those changes should then be tested to determine whether they work.

Henry Frankenstein fails because he doesn’t turn knowledge into durable change. He knows what happened the first time. He understands the consequences. Yet Pretorius finds the ambition, pressure, and rationalization needed to pull him back into the laboratory.

That is why Bride of Frankenstein provides such an important compliance lesson. The greatest organizational risk may not be the risk management failed to identify. It may be the risk management already knows about but has learned to tolerate.

The next stage of the Frankenstein story moves the problem forward again. Leadership changes. A new generation arrives. Wolf von Frankenstein did not create his father’s Monster and bears no responsibility for the decisions that originally brought him to life. Then Wolf discovers what he has inherited.

In Son of Frankenstein, the compliance question becomes one every acquiring company, new CEO, board member, and CCO should understand: You did not create the problem. Once you know it exists, what will you do about it?

Check out Timothy and Fiona’s commentary on the compliance lessons from the Bride of Frankenstein here.

Categories
Blog

Ted Lasso Week: Part 1 – Ted Lasso: Ethical Leadership, Psychological Safety, and the Limits of Good Intentions

Season 4 of Ted Lasso has begun dropping (a new episode releases each Wednesday). Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over the next 5 blog posts, I will consider team owner Rebecca Welton, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today in Part 1, we begin with compliance lessons through the character of Ted Lasso.

Ted Lasso arrives at AFC Richmond with no meaningful knowledge of English football, a skeptical locker room, a hostile press, and an owner who secretly hired him to fail. On paper, he is an obvious control failure. In practice, he becomes the architect of Richmond’s cultural transformation.

For compliance professionals, that transformation is the point. Ted demonstrates how a leader can create trust, encourage candor, and turn values into daily behavior. He also demonstrates the limits of values-led leadership. Good intentions do not investigate misconduct. Empathy does not test a control. Forgiveness does not remediate a root cause.

The compliance lesson from Ted is not simply to “believe.” It is to build a culture in which accountability, information, controls, and oversight support belief.

Culture Is What the Leader Does

Ted’s first contribution is not tactical. It is behavioral. He learns names, asks questions, listens to people with little formal authority, and treats the kit man, Nate Shelley, as a colleague whose observations matter. In “Trent Crimm: The Independent” (Season 1, Episode 3), Ted recognizes that Jamie Tartt and other players are humiliating Nate. Rather than deliver a speech about respect and move on, Ted engages Roy Kent, the informal leader whose intervention can change locker-room conduct.

That is tone at the top connected to conduct in the middle. The DOJ Evaluation of Corporate Compliance Programs (ECCP) asks how senior leaders and managers have encouraged compliance through their words and actions. It states in part, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.”

The Principles of Federal Prosecution of Business Organizations (Justice Manual) likewise directs prosecutors to examine culture at all levels, including discipline, treatment of complaints, and incentives. 9.28.300 states in part that prosecutors shall consider “the pervasiveness of wrongdoing within the corporation, including the complicity in, or the condoning of, the wrongdoing by individuals in corporate management”. In Section 9-28.800, it directs the DOJ to review a “company’s culture of compliance”.

Ted understands instinctively that culture does not travel through posters. It travels through managers, peer leaders, everyday decisions, and the behavior an organization tolerates. A chief compliance officer can publish a code. Only operational leaders can make that code real during the meeting, on the sales call, and inside the locker room.

Psychological Safety Requires a Response System

Ted creates space for people to speak before they have status. He accepts tactical input from Nate, invites dissent from Coach Beard, and builds the Diamond Dogs as an informal forum for candid discussion. By “La Locker Room Aux Folles” (Season 3, Episode 9), Richmond can confront Colin Hughes’s sexuality and Isaac McAdoo’s reaction with empathy. Ted initially hears the team’s claim that Colin’s identity makes no difference, then corrects the underlying message: the team should care because Colin’s experience matters.

This is psychological safety in practice. Employees must be able to raise a concern, disclose vulnerability, or challenge a decision without humiliation or retaliation. Yet a compliance program needs more than an approachable leader. Equally importantly, a culture of Speak Up must be paired with a culture of Listen Up.

Richmond relies heavily on Ted’s availability and temperament. That is a strength while Ted is present and a key-person risk when he is absent. A mature speak-up program requires intake standards, anti-retaliation controls, escalation criteria, case tracking, trend analysis, and board reporting. An open door is valuable. It is not an operating system.

Accountability Must Apply to Stars and Friends

Ted’s strongest accountability moment comes in “Tan Lines” (Season 1, Episode 5), when he benches Jamie after the star player refuses to follow the team’s approach. Ted chooses collective standards over short-term performance. That is exactly the decision many organizations avoid when the employee at issue is a top salesperson, rainmaker, founder, or executive.

He is less decisive when loyalty clouds his judgment. In “All Apologies” (Season 1, Episode 9), Beard and Nate press Ted to confront Roy’s declining performance. Ted initially resists, even though the competitive risk is visible. He eventually has the necessary conversation and gives Roy a dignified path to support the team from the bench.

The contrast matters. DOJ asks whether discipline is applied consistently and whether the company tolerates misconduct by high performers. Compliance credibility collapses when consequences depend on revenue, rank, or personal affection. Ethical leadership is not the absence of hard decisions. It is the willingness to make them fair and explain the standard.

Forgiveness Is Not Remediation

Rebecca’s confession in “All Apologies” presents Ted’s greatest strength and clearest compliance blind spot. She admits that she hired him to fail, manipulated club decisions, and used people as instruments in her campaign against Rupert. Ted forgives her immediately.

At a human level, the scene is powerful. At an organizational level, forgiveness cannot close the matter. Richmond would still need to establish what happened, preserve evidence, identify affected decisions, assess financial and stakeholder harm, determine whether others participated, evaluate disclosure obligations, and strengthen governance.

The US Sentencing Guidelines require organizations to respond appropriately after misconduct and take steps to prevent recurrence. DOJ similarly focuses on root-cause analysis, remediation, and whether control improvements are tested. Ted offers grace, which can support rehabilitation. He does not create a record showing that the organization learned from the failure.

This distinction should matter to every CCO: mercy concerns the person; remediation concerns the institution. A company may do both. It cannot substitute one for the other.

Vulnerability Can Strengthen the Control Environment

Ted’s panic attacks show the cost of a culture in which even a supportive leader believes he must appear invulnerable. His attack during karaoke in “Make Rebecca Great Again” (Season 1, Episode 7) remains largely private. In “Headspace” and “Man City” (Season 2, Episodes 7 and 8), he finally engages with Dr. Sharon Fieldstone and begins addressing the trauma connected to his father’s suicide. After Nate leaks his panic attack to the press, Ted speaks honestly to the team and the public in “Inverting the Pyramid of Success” (Season 2, Episode 12).

Leaders retain legitimate medical privacy. The compliance point is not compelled disclosure. Organizations need trusted support channels, succession and contingency plans, and an environment where asking for help is not treated as weakness. Ted’s eventual candor reduces stigma. His earlier concealment creates an information vacuum that Nate weaponizes.

Within the COSO Internal Control Framework, Ted materially improves the control environment and information and communication. Richmond’s weakness is monitoring. Warning signs involving Nate, including humiliation of subordinates, resentment, and escalating hostility, do not reach a reliable response process before he leaks Ted’s health information and leaves for West Ham.

The Final Test Is Whether Culture Outlasts the Leader

By Season 3, Ted increasingly shifts from hero to system builder. “Sunflowers” and “The Strings That Bind Us” (Season 3, Episodes 6 and 7) show Richmond developing Total Football through shared learning, role flexibility, and trust. In “So Long, Farewell” (Season 3, Episode 12), Ted leaves, but Roy, Beard, Rebecca, Higgins, and the players can carry the culture forward.

That is the institutional test. A compliance program that depends on one charismatic executive is not sustainable. Caremark oversight principles require boards to make a good-faith effort to establish and monitor information and reporting systems, particularly around mission-critical risks, as the Delaware Supreme Court emphasized in Marchand v. Barnhill (the Bluebell Ice Cream case). Ted changes Richmond’s values. Governance must ensure that those values become repeatable processes, reliable information, and accountable decisions.

Practical Takeaways for CCOs 

Ted Lasso offers five questions for a CCO and compliance team:

  1. Do employees trust leaders, and can the organization demonstrate that concerns receive a consistent response?
  2. Are high performers held to the same behavioral standards as everyone else?
  3. When misconduct occurs, does forgiveness follow investigation and remediation rather than replace them?
  4. Are managers trained and monitored as culture carriers, especially after promotion?
  5. Would the speak-up culture and compliance program remain effective if a trusted leader departed tomorrow?

Ted’s enduring lesson is that ethical culture begins with human connection. Effective compliance begins there as well, but it cannot end there. Richmond becomes stronger when curiosity replaces judgment, candor replaces silence, and team standards replace individual entitlement. The next step for any real organization is to convert those behaviors into controls that can be tested, monitored, reported, and sustained.

Join us tomorrow in Part 2, as we turn to Rebecca Welton, whose decision to use AFC Richmond as an instrument of personal revenge reveals the risks created when concentrated authority operates without independent challenge. We will examine executive conflicts, institutional remediation, and Rebecca’s transformation from conflicted owner to accountable steward by requiring governance that can hold power to account.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 62 – Unity on the Final Frontier: Cross-Cultural Compliance Insights from ‘Day of the Dove’

Modern compliance officers grapple with complexities arising from international business relationships, mergers, acquisitions, and partnerships, navigating disparate cultural expectations and norms. Star Trek TOS, especially the episode “Day of the Dove,” provides a surprisingly rich source of compliance insights into these challenges. In a globalized business environment, compliance professionals frequently encounter situations analogous to the manipulated hostilities between the Federation and Klingons. Misunderstandings, mistrust, and cross-cultural miscommunication can escalate tensions, threaten corporate integrity, and hinder operations. Let’s distill five critical compliance lessons from “Day of the Dove,” offering practical guidance to the compliance professional for cross-cultural scenarios.

Lesson 1: Recognize and Neutralize Bias and Stereotyping

Illustrated by: Early in the episode, the Enterprise crew and the Klingons instantly regard each other with suspicion and prejudice.

Compliance Lesson: For compliance officers, understanding and addressing implicit biases is crucial. Like the Enterprise crew, professionals often enter new markets or partnerships with preconceived ideas about cultural expectations, risk tolerance, or ethical behaviors. Such biases may cloud objective judgment and inadvertently fuel tension or compliance failures.

Lesson 2: Question Motives and Uncover Root Causes

Illustrated by: When Kirk realizes the ongoing conflict is unnatural, he questions its cause, eventually uncovering the entity exploiting their anger.

In compliance, cross-cultural misunderstandings often have deeper root causes than the surface-level tension suggests. Misaligned incentives, conflicting internal controls, and divergent perceptions of risk can escalate minor disagreements into full-blown compliance crises.

Lesson 3: Collaboration and Common Goals Overcome Conflict

Illustrated by: Ultimately, Kirk and Commander Kang set aside their rivalry, jointly recognizing their mutual enemy as the manipulative entity.

Compliance Lesson: Cross-cultural compliance similarly requires organizations to align clearly defined common objectives, shared values, and mutual benefit. Whether responding to anti-corruption regulations like the FCPA, managing third-party due diligence, or harmonizing diverse internal standards, clear communication and shared goals serve as the foundation for collaboration.

Lesson 4: Communication and Transparency are Critical

Illustrated by: Misunderstandings abound initially due to poor communication between the Klingons and the Federation.

Compliance Lesson: Compliance challenges arising from cross-cultural scenarios frequently result from misunderstandings or assumptions due to poor transparency or communication. Language barriers, culturally distinct reporting methods, and differing standards of directness or openness can lead to confusion and non-compliance.

Lesson 5: Leadership Sets the Tone and Culture

Illustrated by: Both Kirk and Kang exhibit strong leadership by openly demonstrating the willingness to reconsider their positions and lead their crews in jointly rejecting the entity’s divisive influence.

Compliance Lesson: Compliance leadership must similarly set the tone and demonstrate cultural competence. Leaders who visibly prioritize integrity, open dialogue, and mutual respect set a powerful compliance culture example. Cross-cultural scenarios particularly require compliance leaders to demonstrate humility, openness, and willingness to learn and adjust behaviors.

Final ComplianceLog Reflections

The global nature of today’s business operations makes cross-cultural competency not merely a nice-to-have, but an essential compliance skill set. “Day of the Dove,” through its compelling narrative and insightful conflict resolution, mirrors real-world compliance scenarios faced by international organizations.

By integrating these timeless lessons from “Day of the Dove,” compliance professionals are better equipped to navigate complex cross-cultural challenges, transforming potential conflicts into opportunities for collaboration, understanding, and compliance excellence.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Blog

Compliance Across Cultures: Lessons from Star Trek’s “Day of the Dove”

In the dynamic and continually evolving landscape of corporate compliance, one recurring theme is the necessity of cross-cultural understanding and collaboration. Modern compliance officers grapple with complexities arising from international business relationships, mergers, acquisitions, and partnerships, navigating disparate cultural expectations and norms. Star Trek TOS, especially the episode “Day of the Dove,” provides a surprisingly rich source of compliance insights into these challenges. As we revisit this classic, let’s examine what Captain Kirk and his crew can teach today’s compliance professional about managing cross-cultural compliance risks effectively.

The episode sees the USS Enterprise encountering a mysterious entity that thrives on conflict and hatred. After coming across Klingon survivors led by Commander Kang, Kirk’s crew and the Klingons are manipulated into perpetual conflict aboard the Enterprise. Both sides soon realize that the entity is using their hatred to feed and grow stronger. Ultimately, they unite to reject the divisiveness that feeds the entity, ending the conflict and regaining control of the Enterprise.

In a globalized business environment, compliance professionals frequently encounter situations analogous to the manipulated hostilities between the Federation and Klingons. Misunderstandings, mistrust, and cross-cultural miscommunication can escalate tensions, threaten corporate integrity, and hinder operations. Let’s distill five critical compliance lessons from “Day of the Dove,” offering practical guidance to the compliance professional for cross-cultural scenarios.

Lesson 1: Recognize and Neutralize Bias and Stereotyping

Illustrated by: Early in the episode, the Enterprise crew and the Klingons instantly regard each other with suspicion and prejudice. Their preconceived notions drive initial hostility, fueled by longstanding animosity and stereotypes.

Compliance Lesson: For compliance officers, understanding and addressing implicit biases is crucial. Like the Enterprise crew, professionals often enter new markets or partnerships with preconceived ideas about cultural expectations, risk tolerance, or ethical behaviors. Such biases may cloud objective judgment and inadvertently fuel tension or compliance failures.

To prevent this, organizations must implement targeted compliance training that explicitly addresses biases and promotes empathy and cultural intelligence. Awareness and sensitivity training programs can help staff challenge assumptions, mitigate prejudices, and foster constructive dialogue, much like Kirk’s eventual acknowledgment of shared misunderstandings.

Lesson 2: Question Motives and Uncover Root Causes

Illustrated by: When Kirk realizes the ongoing conflict is unnatural, he questions its cause, eventually uncovering the entity exploiting their anger. This epiphany sets the stage for collaboration and resolution.

In compliance, cross-cultural misunderstandings often have deeper root causes than the surface-level tension suggests. Misaligned incentives, conflicting internal controls, and divergent perceptions of risk can escalate minor disagreements into full-blown compliance crises.

Conducting effective root-cause analyses, guided by robust investigative frameworks as recommended by regulatory bodies like the DOJ and the 2024 ECCP, can uncover the underlying issues fueling compliance challenges. This diagnostic approach not only mitigates immediate issues but also promotes long-term resilience and cultural cohesion.

Lesson 3: Collaboration and Common Goals Overcome Conflict

Illustrated by: Ultimately, Kirk and Commander Kang set aside their rivalry, jointly recognizing their mutual enemy as the manipulative entity. By focusing on a shared goal, they regain their agency and restore harmony aboard the Enterprise.

Compliance Lesson: Cross-cultural compliance similarly requires organizations to align clearly defined common objectives, shared values, and mutual benefit. Whether responding to anti-corruption regulations like the FCPA, managing third-party due diligence, or harmonizing diverse internal standards, clear communication and shared goals serve as the foundation for collaboration.

Compliance leaders must foster environments where culturally diverse teams understand and internalize collective compliance objectives. Creating alignment workshops, compliance vision statements, and shared metrics are effective strategies to build unity and proactive cooperation among global stakeholders.

Lesson 4: Communication and Transparency are Critical

Illustrated by: Misunderstandings abound initially due to poor communication between the Klingons and the Federation. Once both parties openly discuss their suspicions, their improved communication proves essential in ending the conflict.

Compliance Lesson: Compliance challenges arising from cross-cultural scenarios frequently result from misunderstandings or assumptions due to poor transparency or communication. Language barriers, culturally distinct reporting methods, and differing standards of directness or openness can lead to confusion and non-compliance.

Organizations must proactively address these communication gaps by implementing multilingual training programs, culturally sensitive reporting hotlines, and comprehensive policies written clearly and accessible across cultures. Additionally, transparency must be embedded in compliance systems, ensuring stakeholders across different geographies have clear, consistent, and accessible information.

Lesson 5: Leadership Sets the Tone and Culture

Illustrated by: Both Kirk and Kang exhibit strong leadership by openly demonstrating the willingness to reconsider their positions and lead their crews in jointly rejecting the entity’s divisive influence.

Compliance Lesson: Compliance leadership must similarly set the tone and demonstrate cultural competence. Leaders who visibly prioritize integrity, open dialogue, and mutual respect set a powerful compliance culture example. Cross-cultural scenarios particularly require compliance leaders to demonstrate humility, openness, and willingness to learn and adjust behaviors.

The DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP), reinforced recently by Nicole Argentieri’s commentary, specifically highlights culture as critical to compliance effectiveness. Leaders who exemplify integrity and communicate clear, respectful expectations foster a compliance-positive environment. Such leadership inspires global employees, encouraging them to embrace company values and compliance standards.

Final ComplianceLog Reflections

The global nature of today’s business operations makes cross-cultural competency not merely a nice-to-have, but an essential compliance skill set. “Day of the Dove,” through its compelling narrative and insightful conflict resolution, mirrors real-world compliance scenarios faced by international organizations.

Just as Kirk’s crew and the Klingons successfully rejected divisiveness. They overcame manipulated hostilities. Compliance professionals must recognize and neutralize biases, uncover root causes of tension, prioritize common goals, enhance transparent communication, and demonstrate culturally sensitive leadership.

As we forge ahead in a global compliance landscape, these insights from classic Star Trek remain relevant. The universe Kirk explored may be fictional, but the lessons learned aboard the Enterprise are profoundly real and applicable for every compliance professional operating in the interconnected global business environment.

By integrating these timeless lessons from “Day of the Dove,” compliance professionals are better equipped to navigate complex cross-cultural challenges, transforming potential conflicts into opportunities for collaboration, understanding, and compliance excellence.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Great Women in Compliance

Great Women in Compliance: Culture is What Happens When No One is Watching

Culture is one of those topics in ethics and compliance that everyone talks about—but it’s also one of the hardest things to define and even harder to build. At Compliance Week, Lisa Fine discussed this with Amy Schuh, partner at Morgan Lewis; Kilby McFadden, Managing Director and Head of Investigations at KPMG; and Michael Ortwein, Chief Compliance Officer and Assistant General Counsel at GM. Today, Amy and Kilby continue the discussion with Lisa Fine and Sarah Hadden.

They start by discussing what they see as a strong compliance culture. As Kilby says, it’s what happens when no one is watching. The conversation focuses on how organizations move beyond policies and training to build trust, encourage employees to speak up, and empower leaders to make ethical decisions—even when those decisions are difficult.

Amy and Kilby share practical insights from years of experience leading investigations and advising organizations, discussing who really owns culture, how companies can create trust in the reporting process, and why relationships with the business matter just as much as policies and procedures. They also explore the challenges of building a consistent culture across global organizations and offer ideas for strengthening culture even when resources are limited.

They also include key takeaways for compliance professionals, such as the importance of listening, staying curious about the business, and building relationships before issues arise, and each shares one “myth” about Ethics & Compliance they think should be debunked.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 39 – Federation Fundamentals: What “Journey to Babel” Teaches Us About Global Compliance

In the ever-expanding universe of corporate compliance, the question of how to bridge cultural divides is as critical as it is complex. Navigating global operations, integrating diverse teams, and balancing conflicting interests. These challenges would be familiar to Captain Kirk and the crew of the Enterprise, particularly in the classic Star Trek: The Original Series episode “Journey to Babel.”

Today, we explore five essential cross-cultural compliance lessons, each grounded in a scene from “Journey to Babel.” These insights are not simply for the Starship Enterprise. Instead, they are vital for every compliance professional in today’s globalized business world.

Lesson 1: Cultural Awareness is the Foundation of Trust

Illustrated by: At a diplomatic reception. Ambassadors Sarek (Vulcan) and Gav (Andorian) nearly come to blows over the proposed admission of Coridan to the Federation.

Compliance Lesson: Cultural awareness is the bedrock of ethical business practice. As compliance professionals, we must recognize that every culture brings its perspectives, values, and sensitivities to the table.

Lesson 2: Personal Bias Must Never Trump Professional Duty

Illustrated by: Kirk discovers that Spock’s parents, Sarek and Amanda, are aboard.

Compliance Lesson: Compliance professionals must create policies and foster cultures that prioritize professional integrity above personal interest, even (or especially) when emotions run high.

Lesson 3: Open Communication is Critical in Preventing Escalation

Illustrated by: Tensions flare after Ambassador Gav’s murder.

Compliance Lesson: Silence or closed-door decisions breed mistrust and can quickly escalate a manageable issue into a full-blown crisis.

Lesson 4: Ethical Leadership Means Making the Hard Call

Illustrated by: Kirk, gravely wounded during an assassination attempt, insists on returning to the bridge rather than receiving treatment so that Spock can perform surgery on Sarek.

Compliance Lesson: Effective compliance leaders are those who lead by example, making tough decisions that may be unpopular or personally costly but which uphold the organization’s mission and values.

Lesson 5: Unity Through Diversity Drives Mission Success

Illustrated by: Despite assassination attempts, sabotage, and political intrigue, the Enterprise ultimately succeeds in its mission.

Compliance Lesson: When managed ethically, cross-cultural teams produce better solutions, more robust risk assessments, and more effective compliance outcomes.

Final ComplianceLog Reflections

“Journey to Babel” reminds us that successful missions, whether in interstellar diplomacy or global business, depend on more than technical expertise or strategic positioning. They require cultural competence, ethical leadership, and a willingness to prioritize the mission over personal interests.

For the compliance professional, the lessons are clear: invest in cultural awareness, build transparency, foster ethical leadership, and leverage diversity as a driver of success. In today’s interconnected world, the road to Babel is one we all travel. It is your job as a compliance professional to ensure we do so ethically, collaboratively, and boldly.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Timothy and Fiona are AI-generated voices

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 25 – Cross-Cultural Lessons from Devil in the Dark

Show Summary

The classic episode “Devil in the Dark” is a compelling exploration of misunderstandings, communication breakdowns, and reconciliation between vastly different cultures—lessons that resonate strongly with corporate compliance officers navigating today’s global marketplace.

In “Devil in the Dark,” the USS Enterprise is dispatched to investigate mysterious deaths in a mining colony. What initially seems like straightforward monster attacks turns out to be a profound misunderstanding between humans and an alien creature called the Horta. Today, we will examine five key compliance lessons that corporate professionals can learn from the iconic Star Trek episode.

Lesson 1: Recognize and Challenge Your Own Biases

Illustrated By: When the Enterprise crew arrives, the miners describe a monstrous creature attacking and killing miners, labeling it simply as a dangerous beast to be eliminated. Their preconceived notions blinded them to the possibility of understanding the creature.

Compliance Lesson: Compliance professionals must actively recognize and challenge their assumptions and biases.

Lesson 2: Effective Communication Requires Genuine Effort and Empathy

Illustrated By: The turning point of the episode comes when Spock mind-melds with the Horta. Through genuine empathy and effort, he discovers that the Horta is not malevolent but is protecting its offspring, the silicon nodules that the miners had inadvertently been destroying.

Compliance Lesson: Corporate compliance teams operating in multinational contexts must make a genuine effort to communicate effectively with global partners, subsidiaries, and stakeholders.

Lesson 3: Cultural Awareness as a Risk Mitigation Strategy

Illustrated By: The miners’ failure to recognize the silicon nodules as living offspring stems from ignorance about the Hortas’ culture and biology. This ignorance creates hostility and unnecessary conflict.

Compliance Lesson: Understanding local cultural norms, regulatory landscapes, and business ethics is vital for operating ethically and legally across jurisdictions.

Lesson 4: Embrace Diversity to Foster Innovation and Solutions

Illustrated By: The Enterprise crew’s diverse backgrounds and experiences enable them to devise innovative solutions. Spock’s unique Vulcan abilities allow communication with the Horta, transforming a volatile situation into a collaborative one.

Compliance Lesson: Diverse compliance teams bring varied experiences, perspectives, and problem-solving approaches essential for effectively managing complex compliance challenges.

Lesson 5: Seek Win-Win Solutions through Collaboration

Illustrated By: Ultimately, Captain Kirk brokers a cooperative agreement between the miners and the Horta, allowing peaceful coexistence and mutual benefit. The miners extracting resources and the Horta species continue unharmed.

Compliance Lesson: Compliance professionals should adopt a win-win mindset, working collaboratively with regulatory authorities, local communities, employees, and third-party partners to align compliance objectives with mutual benefits.

Final ComplianceLog Reflections

Star Trek’s “Devil in the Dark” vividly illustrates the consequences of cross-cultural misunderstandings and the immense benefits of cultural empathy, clear communication, diversity, and collaborative problem-solving. For corporate compliance professionals, this episode serves as a powerful reminder that effective compliance programs necessitate intentional cross-cultural engagement, ongoing education, and empathy-driven interactions.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Innovation in Compliance

Innovation in Compliance: Rethinking SpeakUp: UX, Trust, and AI in Whistleblowing and Investigations with Tim Morss

Innovation comes in many areas, and compliance professionals need to not only be ready for it but also embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode,  host Tom visits with Tim Morss, CEO at SpeakUp, about the evolution of speak-up systems from the employee perspective.

Morss describes his background in compliance technology and SpeakUp’s global footprint, emphasizing that employee expectations favor frictionless, mobile-first, intuitive reporting with transparency and feedback over 800-number hotlines and complex forms. He notes common program gaps: hard-to-find reporting channels, poor mobile experiences, overreliance on telephony (especially problematic for non-English speakers), insufficient guidance on what to report, and weak trust due to lack of follow-up and perceived inaction. They consider generational preferences, privacy-aware deployment, such as QR code placement, and AI use cases such as multilingual voice intake for illiterate supply-chain workers, while cautioning against unsafe AI practices and autonomous decision-making. Morss highlights investigative management as a major opportunity beyond basic case repositories and forecasts greater AI-driven integration with in-house systems amid geopolitical and regulatory divergence.

Key highlights:

  • Employee Expectations Shift
  • Common SpeakUp Mistakes
  • Trust and Anti-Retaliation
  • Gen Z Reporting Channels
  • AI Voice for Workers
  • One Practical CCO Tip

Resources:

Connect with Tim Morss on LinkedIn

SpeakUp

Innovation in Compliance was recently honored as the Number 4 podcast in Risk Management by 1,000,000 Podcasts