Tag: DOJ

Categories
Blog

Modern Philosophers and Compliance: Part 5 – Hans Jonas and Responsibility for the Future of Corporate Compliance

This week we have concluded our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program; Simone de Beauvoir and the conditions for ethical action in a corporation; John Rawls and institutional justice and fairness in a corporate compliance program; and Jürgen Habermas and the governance of speaking up. In Part 5, we conclude by looking at Hans Jonas and the responsibility for the future of corporate compliance programs.

A corporate decision can continue affecting people long after its sponsors have moved on. Technology makes that possibility especially important. A system approved for a limited purpose can expand across business units, influence thousands of decisions, and create consequences that emerge gradually. Hans Jonas asks us to consider the responsibility that power entails.

For the Chief Compliance Officer (CCO), that perspective changes the approval question. What evidence supports proceeding, what harm could follow, and who will remain responsible as circumstances change? These questions connect ethical responsibility with the practical governance of technology, particularly artificial intelligence.

Technological Power Expands Responsibility

In The Imperative of Responsibility (1984), Jonas reconsidered ethics in light of technological power. His concerns included ecological destruction, nuclear threats, and genetic engineering. The scale and reach of human action created duties extending toward posterity and the environment.

His argument reaches beyond responsibility for an immediate transaction. Decisions can affect the conditions under which others will live, including people unable to challenge those decisions today. The ethical horizon must therefore extend beyond the decision-maker’s own interests and present relationships.

The application to corporate compliance is an interpretation of that argument. Jonas did not write an AI approval checklist. His philosophy nevertheless provides a reason to examine the duration, scale, and reversibility of technological choices. A company’s responsibility should reflect the consequences its capabilities make possible.

This perspective complements the earlier Enlightenment chapters. Evidence and clear reasoning remain essential. Jonas asks what responsibilities follow when the organization can act on that knowledge at a scale whose full consequences remain uncertain. For compliance, the answer begins with disciplined anticipation and continues throughout the activity’s life.

The Approval Whose Consequences Keep Growing

What do you think about the following situation? A multinational company purchases an AI tool to prioritize third-party due diligence. The tool ranks potential intermediaries using corporate records, transaction information, and public data. During a pilot, it reduces the time required to identify files for additional review.

Management approves a broader deployment. Over the following year, procurement teams begin treating low-risk scores as permission to abbreviate diligence. The vendor changes the model. The company expands into countries poorly represented in the original testing. Responsibility for reviewing performance splits among procurement, technology, and compliance.

Later, an investigation finds that several intermediaries with incomplete ownership records received low-risk scores. The model treated missing information as weak evidence of risk, while reviewers interpreted the scores as evidence that meaningful checks had been completed. No one had tested that assumption in the new markets.

The scenario does not establish that AI inevitably weakens diligence. It shows how a limited approval can take on a different operational meaning. A prioritization tool became a basis for reducing scrutiny. Changes in use, data, and responsibility accumulated after the initial decision.

Jonas helps the CCO frame the governance issue. The approval must account for how the system could develop and what its outputs could enable. Responsibility includes the conditions for expansion, the information needed to detect failure, and the authority to intervene before harm spreads.

The DOJ Connection Through Emerging Risk

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) explicitly addresses emerging technology. It asks how companies assess AI’s impact on criminal-law compliance, integrate technology risk into enterprise risk management, and address unintended consequences and misuse. It also examines controls supporting trustworthy, reliable use.

These inquiries make technology governance part of the compliance effectiveness assessment. A company using AI within its own compliance function should apply the same discipline it expects from business operations. The stated purpose of improving compliance does not establish that the tool works appropriately.

In our question above, the CCO should define the approved use precisely, as mission creep is always to be avoided. Prioritizing review is different from authorizing a third party. The decision record should explain what the score means, what it cannot establish, and which diligence requirements remain mandatory. Users need instructions that preserve those distinctions under commercial pressure.

Changes should trigger review according to their significance. A new market, a material vendor update, or a proposal to automate approvals may require additional testing and authorization. The company should assign an accountable owner who can obtain the necessary evidence across functions. Shared participation works best when responsibility for the final decision remains clear.

Uncertainty Calls for Proportionate Safeguards

Companies rarely possess complete information before introducing a technology. See generally Andrew McBride in Recommended Practice for Buying & Selling Compliance Technology, which is based on surveys of compliance technology buyers and vendors. Governance must make uncertainty visible and connect it to a defensible decision. The relevant questions include the severity of possible harm, the number of people affected, the ability to detect errors, and the possibility of reversing the consequences.

A tool that suggests training topics raises different concerns than one that determines which allegations to investigate. The latter can affect whether misconduct is detected at all. Its potential benefit should be assessed alongside the consequences of overlooking a credible concern.

For the third-party tool, a practical safeguard would be to sample low-risk classifications for independent review. Testing only the files the model flags leaves false reassurance largely unexamined. The company should also assess how missing records, unfamiliar languages, and changes in business conditions affect performance.

Deployment can be limited while those questions are tested. Appropriate measures might include restricted uses, defined populations, additional review, or a delay where critical evidence is missing. These are proposed governance responses to the hypothetical. Their suitability depends on the use case and the harm at stake.

The business case should include the cost of maintaining those safeguards. A project whose expected savings depend on eliminating the review needed for reliable operation has an unresolved design problem. Compliance should make that tradeoff explicit before approval and when the project’s economics change.

Turning Responsibility into Continuing Governance

The NIST AI Risk Management Framework provides a voluntary approach to managing AI risks. Its core functions are Govern, Map, Measure, and Manage. Together, they offer an organizational structure for understanding uses and impacts, evaluating risks, and determining responses throughout the AI lifecycle.

Applied to our hypothetical, governance assigns ownership and approval authority. Mapping identifies where the model operates, who relies on its scores, and who could be harmed by error. Measurement tests performance under relevant conditions. Management determines whether to proceed, add safeguards, restrict use, or suspend the tool. These activities should inform one another as evidence changes.

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. Its relevance here is the organizational discipline of sustained responsibility. The company needs repeatable processes that survive personnel changes and remain connected to actual use.

These frameworks serve different purposes from DOJ’s prosecutorial guidance. Adopting a framework or obtaining certification does not establish compliance with every applicable law or prove that a particular deployment is effective. The company still needs evidence that its controls address the risks of its own activities.

The practical objective is to maintain a record that connects the approved purpose, responsible people, test results, changes, incidents, and remedial decisions. That record enables the next owner to understand why the system was approved and what conditions remain essential to its continued use.

Intervention Must Remain Possible

Responsibility becomes difficult to exercise when the organization cannot change course. Before deployment, determine who can suspend the system, what circumstances require escalation, and how business will continue during an interruption. A fallback process must be sufficiently resourced to operate when needed.

In the hypothetical, repeated unexplained low-risk scores involving missing ownership records could trigger restricted use and a review of affected files. The response should examine past decisions and current performance. Correcting the model does not resolve every consequence of earlier reliance on it.

Vendor arrangements also matter. (See McBride, above.) The company should seek information and contractual provisions appropriate to its risks, including notice of material changes, access to relevant performance evidence, and cooperation with investigations. When adequate visibility is unavailable, decision-makers should account for that limitation in deciding whether and how to use the tool.

Human review requires similar scrutiny. A named reviewer adds little protection if that person lacks time, training, supporting information, or authority to question an output. Test whether reviewers can identify errors and whether their interventions produce corrective action. Human responsibility needs operational support.

Board Oversight Must Extend Beyond Launch

Boards need a view of material technology risks over time. Approval-stage reporting often emphasizes expected benefits. Subsequent oversight should examine whether those assumptions remain valid, whether the use has expanded, and whether the organization retains the resources and authority needed to manage it.

The ECCP examines the information used in board oversight and compliance access to governing authorities. For significant AI deployments, the CCO can use those channels to report unresolved limitations, incidents, changes in use, and overdue corrective actions. Technical detail should explain a decision the board needs to understand.

Directors should ask whose interests the business case omits. Future customers, workers, communities, or business partners may bear costs not reflected in the current project budget. The analysis should consider foreseeable consequences and explain material uncertainties without pretending to predict every outcome.

Accountability should also survive the original sponsor’s departure. Assign continuing ownership, require documented handovers, and maintain review obligations through reorganizations and vendor changes. A system’s effects may persist for years. Its governance should not depend on one individual remembering the conditions attached to launch.

Five Key Jonas Takeaways for the Compliance Professional

  1. Assess consequences across time and scale. Consider who could be affected, how harm might accumulate, and whether decisions can be reversed. Include foreseeable effects beyond the immediate business case.
  2. Define the approved use and review material changes. Specify what a system may do, what its outputs establish, and which decisions require human authorization. Reassess expansion, vendor updates, and changes in operating conditions.
  3. Match safeguards to uncertainty and potential harm. Test the errors that routine monitoring could miss. Use staged deployment, independent review, or restrictions where the evidence does not support broader reliance.
  4. Preserve the ability to intervene and remediate. Establish suspension authority, workable alternatives, and a process for reviewing past decisions. Verify that human reviewers have the resources and authority to act.
  5. Make responsibility endure beyond the project team. Maintain ownership, evidence, and review obligations through organizational change. Give the board a clear account of unresolved risk and the decisions required.

Jonas brings our series to a fitting conclusion. Arendt asks who exercises judgment. Beauvoir asks whether people can act on it. Rawls tests the fairness of the rules, and Habermas examines whether concerns influence decisions. Jonas extends responsibility to the consequences that outlast those discussions and to people who cannot participate in them.

Together, these perspectives give compliance professionals a practical agenda for governing corporate power. Build processes that let people question, decide, explain, and correct their actions. Then ask the final board question: what obligations will this decision leave to others, and what have we put in place today to meet them?

Categories
Blog

Modern Philosophers and Compliance: Part 4 – Jürgen Habermas and the Governance of Speaking Up

This week we will continue our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have looked at, or will look at, Hannah Arendt and her concepts around personal responsibility; Simone de Beauvoir and the conditions for ethical action in a corporation; and John Rawls and the twin concepts of institutional justice and fairness in a corporate compliance program. We will review Hans Jonas and the responsibility for the future of corporate compliance. Today we continue with Jürgen Habermas and the governance of speaking up.

A compliance concern has value when it receives a fair hearing and an accountable response. Employees may submit reports, attend risk meetings, and complete surveys while important decisions remain insulated from what they say. Jürgen Habermas gives compliance professionals a way to examine whether internal communication lets evidence and reasons influence the exercise of authority.

For the Chief Compliance Officer, the practical question is what happens next. Who considers the concern? What evidence is examined? Who explains the response? A speak-up culture needs answers to those questions throughout ordinary business operations and within the formal reporting system.

Reasoned Dialogue as an Ethical Discipline

Habermas was a German philosopher and social theorist whose major twentieth-century works include The Theory of Communicative Action and Moral Consciousness and Communicative Action. He distinguished action oriented toward mutual understanding from strategic action aimed at achieving an actor’s purposes. His discourse ethics examines how moral norms are justified through reasoned discussion among those affected.

The conditions of that discussion matter. Participants must be able to question assertions, offer reasons, and express their concerns without coercion preventing participation. Agreement matters differently when it results from examining arguments than when it reflects pressure or exclusion.

Corporate decision-making operates within authority structures, commercial obligations, and legal requirements. Applying Habermas does not turn every management decision into a vote. His ideas offer a demanding test of the process: have relevant claims been open to challenge, and have decision-makers responded to the reasons presented?

That test gives compliance a practical responsibility. The function should help create conditions in which a concern can reach the right decision-maker without losing its substance. Participation must include a meaningful opportunity to affect the analysis. Otherwise, consultation can become a procedure for endorsing a conclusion already reached.

The Meeting Where Agreement Came Too Quickly

Consider the following. A company plans to enter a new market through a local distributor. During a launch meeting, the regional president announces that the agreement must be signed before quarter-end. She then asks whether anyone has compliance concerns.

A diligence analyst explains that the distributor’s ownership information remains incomplete and that a proposed subcontractor has not been reviewed. The sales leader responds that the distributor comes highly recommended. The president asks whether there is evidence of wrongdoing. The analyst says there is not but explains that important questions remain unanswered.

The discussion moves on. The meeting summary records that compliance raised no substantiated misconduct concern and that the team supported proceeding. The analyst’s request for additional review disappears from the decision record.

The facts do not establish that the distributor is improper. They establish a failure to address the question raised. The analyst identified an information gap relevant to approval. Management answered a different question about proven misconduct. The resulting agreement rested on an incomplete description of the discussion.

Habermas helps the CCO identify that failure. The analyst spoke, but the process did not meaningfully engage the claim. A useful response would clarify the missing information, define the approval criteria, and assign responsibility for resolving the issue before an authorized decision.

The DOJ Connection Through Reporting and Response

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) examines whether employees are comfortable using reporting mechanisms, whether company practices discourage reporting, and whether compliance has access to reporting and investigative information.

Those inquiries connect employee voice to program effectiveness. A concern cannot inform the company’s response if employees are discouraged from raising it, it is mischaracterized, or it is withheld from the people responsible for assessing it. Habermas supplies a philosophical lens for examining the quality of that communication.

The CCO should extend this inquiry beyond hotline intake. Concerns arise in procurement discussions, contract reviews, operational meetings, and informal requests for guidance. The company needs a proportionate way to capture material unresolved issues from those settings. Employees should know when a conversation must be documented as an escalation.

In our hypothetical, the meeting summary should preserve the substance of the analyst’s concern. It should identify the missing information, the required review, the decision owner, and any conditions on proceeding. If the summary is inaccurate, the analyst should have a practical means to correct it. That mechanism protects the reliability of the decision record.

Management Must Answer the Concern Raised

Reasoned dialogue requires attention to what a person is actually saying. In compliance speak, a speak-up culture must be paired with a listen-up culture. A concern about missing diligence should receive an answer about diligence. A concern about an incentive should receive an examination of how that incentive affects behavior. General assurances about leadership commitment do not resolve either issue.

The CCO can help managers distinguish disagreement about facts, disagreement about applicable standards, and disagreement about available options. Each calls for a different response. Missing facts may require investigation. An unclear standard may require legal or policy interpretation. Competing options may require an authorized decision about a risk that can lawfully be accepted.

Return to the distributor. If the policy requires ownership verification before approval, management should obtain it or follow an authorized exception process where one exists and is permissible. A commercial deadline does not, by itself, satisfy the requirement. If the concern rests on a misunderstanding, the decision-maker should explain the evidence that resolves it.

This approach makes discussion more useful to the business. It identifies what must be resolved and who can resolve it. It also prevents repeated requests for assurance from replacing a decision. An effective compliance professional should state the issue clearly enough that management can respond to its substance.

Hierarchy Can Distort the Conversation

Managers influence discussion through timing, framing, and reaction. Announcing the desired outcome before inviting concerns can make disagreement appear obstructive. Requiring employees to prove misconduct before raising uncertainty can exclude the very questions that preventive controls are intended to address.

The ECCP examines whether senior and middle managers encourage or discourage compliance and whether their commitment persists when commercial interests compete with it. Compliance professionals can translate that inquiry into observation of actual decision processes.

For material risk reviews, circulate relevant information early enough for participants to assess. Invite questions before seeking approval. Ask responsible functions to identify unresolved matters in their own words. Where hierarchy discourages discussion, provide an independent route for concerns and follow up on how employees who challenge decisions are treated.

These measures do not guarantee agreement, nor should agreement be the sole objective. Decision-makers may reasonably reject an objection after reviewing the evidence. The record should explain why. A team can disagree about the preferred option while understanding the basis for the authorized decision and the obligations that follow.

The quality of the discussion also depends on access. An employee working overnight or speaking another language may need a different way to participate. A written question or private conversation can carry the same substantive concern as a confident presentation in a committee meeting. The company should assess the argument without making presentation style a proxy for credibility.

Closing the Loop Requires Evidence

Receiving a concern creates an obligation to route it appropriately and determine what response is warranted. The ECCP addresses timely investigation, follow-up, and accountability for findings and recommendations. The practical challenge is connecting those steps so an issue doesn’t disappear when one function transfers it to another.

For significant concerns, assign an owner, a response date, and a defined basis for closure. Record whether the company obtained additional evidence, changed the decision, introduced a safeguard, or concluded that further action was unnecessary. The explanation should be specific enough for an independent reviewer to follow.

Where appropriate, tell the person who raised the concern that it was considered and describe the process or outcome to the extent permitted. Protect personal information, legitimate confidentiality, and the integrity of the investigation. A useful response acknowledges the issue and explains the next step without disclosing restricted details.

The analyst should learn whether the ownership question was resolved and whether the subcontractor review remains a condition of approval. If the transaction proceeds under an exception, the record should identify the authority, rationale, and monitoring obligations. A concern that changes a control or approval condition provides tangible evidence that speaking up influences business operations.

The Board Must Hear Unresolved Disagreement

Board reporting can lose valuable information when management summarizes a complicated risk discussion as organizational alignment. Directors need visibility into material unresolved concerns within their oversight remit, particularly when compliance and business leadership differ about the adequacy of controls.

The ECCP examines private sessions with compliance and control functions, the information used in board oversight, and compliance autonomy and access to the board. These arrangements can help directors examine concerns that ordinary reporting channels have failed to resolve.

The CCO should present the issue, competing explanations, the evidence, and the required decision. Identify what is known, what remains uncertain, and who has authority to act. Directors should ask whether those closest to the issue find the summary accurate.

Reporting should also show whether the process improves decisions. Useful evidence includes material concerns that led to further diligence, changed approval conditions, or remediation. Volume alone provides an incomplete picture. The board needs to understand whether significant questions receive reasoned responses and whether corrective actions are completed.

Five Key Habermas Takeaways for the Compliance Professional

  1. Preserve the substance of employee concerns. Record the actual question, relevant evidence, and unresolved issue. Give employees a practical way to correct summaries that materially misstate what they raised.
  2. Require a response to the reasons presented. Distinguish factual gaps from policy questions and choices among permissible options. Assign each issue to someone with the competence and authority to address it.
  3. Design discussions that permit meaningful challenge. Share information in time for review, invite concerns before decisions, and provide independent escalation routes. Examine whether hierarchy or managerial reactions discourage participation.
  4. Connect reporting with accountable closure. Assign owners and response dates, document the basis for decisions, and communicate appropriate feedback. Verify that promised safeguards and remediation occur.
  5. Bring material disagreement into board oversight. Explain unresolved concerns accurately, including competing views and missing information. Show directors how employee challenge has changed decisions or exposed work still required.

Habermas offers the CCO a practical measure of speak-up culture: can the company show how it considered and answered a significant concern? The corresponding board question is whether a difficult issue can reach directors without being softened into apparent agreement. The answers reveal how seriously the organization treats reasoned challenge.

In our final installment, Part 5, we close out this series with Hans Jonas and responsibility for future consequences. Having examined how people exercise judgment, act under constraints, receive fair treatment, and challenge decisions, we will consider the people who cannot participate in today’s discussion. Jonas takes us into technology governance, AI, and the long-term effects of corporate power.

Categories
Compliance Into the Weeds

Compliance into the Weeds: New Fraud Section Guidelines

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into compliance-related topics, literally going into the weeds to explore them more fully. Looking for hard-hitting compliance insights? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the DOJ’s new Fraud Division enforcement priorities.

The DOJ’s Fraud Division enforcement priorities matter because they can quickly reshape a company’s compliance risk, especially when prosecutors are told to focus on patterns like widespread victimization, large losses, senior management involvement, and obstruction of investigations. Tom argues updates are a practical cue for compliance leaders to reopen discussions with senior management, the audit committee, and the board, while also treating whistleblower incentives and even political risk as real factors on the company risk register. Matt similarly argues that the DOJ’s new posture has changed enforcement risk and that companies should respond by refreshing risk assessments, sharpening internal controls, and briefing leadership before problems become more costly. Both perspectives are shaped by their long experience covering corporate compliance and enforcement, with Fox emphasizing proactive governance and Kelly stressing the need to translate DOJ signals into concrete, business-specific risk management.

Key highlights:

  • 10-Factor Fraud Prosecution Memo for Corporations
  • Multiple Small Fraud Indicators, Material Weakness Risk
  • DOJ Shift Raises Compliance Costs and Stakes
  • Declinations for Companies That Voluntarily Self-Disclose
  • Corporate Enforcement Section and 2024 ECCP

 Resources:

Matt in Radical Compliance

 Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has received Davey, Communicator, and W3 Awards, all for podcast excellence.

Categories
Blog

Modern Philosophers and Compliance: Part 3 – John Rawls and Fairness in the Corporate Compliance Program

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program, and Simone de Beauvoir and the conditions for ethical action in a corporation. We will review Jürgen Habermas and the governance of speaking up and Hans Jonas and responsibility for the future of corporate compliance. Today we continue with John Rawls and the twin concepts of Institutional Justice and Institutional Fairness in a corporate compliance program.

A compliance program promises how the company will exercise power. Employees are asked to follow rules, disclose concerns, cooperate with investigations, and accept consequences when misconduct is established. In return, they should be able to expect a process whose protections and standards do not depend on their commercial value or proximity to leadership. John Rawls gives compliance professionals a practical way to examine that promise.

In the first two posts, we considered personal responsibility through Hannah Arendt and the conditions for ethical action through Simone de Beauvoir. Today, in Part 3, Rawls brings us to the design of the institution itself. Would employees accept its rules if they did not know which position they would occupy when those rules were applied?

Justice as Fairness and the Corporate Institution

Rawls was an American political philosopher whose A Theory of Justice, published in 1971, developed an account of justice as fairness. His theory addresses society’s basic structure, including the institutions that distribute rights, opportunities, and advantages. It prioritizes equal basic liberties and addresses fair opportunity and the conditions under which economic inequalities can be justified.

A corporation is a different kind of institution. Rawls’s principles cannot simply be converted into an employee handbook. The useful connection is an approach to justification: examine institutional arrangements from a standpoint that limits the influence of personal advantage.

Rawls developed this approach through the original position, a hypothetical situation in which people select principles behind a veil of ignorance. They lack knowledge of their own social position and particular advantages, while retaining general knowledge relevant to institutional design. The restriction prevents them from tailoring principles to their individual circumstances.

In compliance, we can adapt that thought experiment. Imagine designing a disciplinary process without knowing whether you will be a junior employee, a regional executive, a witness, or the person accused. What protections would you require? Which differences in treatment could you defend? The exercise asks policy owners to step outside the interests associated with their current roles.

Designing the Process Before Knowing the Employee

Consider this hypothetical. A multinational company discovers that a regional sales director submitted personal expenses as business entertainment. The investigation establishes that he knowingly mischaracterized the expenses and had received clear training. He has no prior disciplinary record. His business unit produces a significant share of company revenue.

Six months earlier, the company dismissed a junior account manager for knowingly submitting comparable personal expenses. Assume the amounts, evidence of intent, training, and disciplinary history are materially similar, and no relevant legal difference exists. The sales director’s sponsor now recommends a warning because losing him could disrupt customer relationships.

The CCO faces a concrete governance question. Is the proposed distinction consistent with a defensible standard, or has commercial importance become a private exemption? The hypothetical deliberately holds relevant factors constant so that management must address the remaining reason for different treatment.

Apply the veil of ignorance. Would employees endorse a policy under which the consequences for deliberate expense falsification depend on how difficult the offender is to replace? Would leaders accept that principle if they expected to occupy the junior role? Asking those questions before deciding the case makes the underlying rule visible.

The company must still manage business continuity. It can plan customer coverage and succession while determining an appropriate response. Those operational responsibilities should be distinguished from the criteria used to assess misconduct. Otherwise, the need to retain an individual can quietly become the standard for deciding accountability.

The DOJ Connection Through Consistent Discipline

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) explicitly examines whether discipline and incentives are applied fairly and consistently. In Rawlsian terms, these map to what we call Institutional Fairness and Institutional Justice. The ECCP asks whether comparable misconduct received different treatment, why differences occurred, and how consistency is assessed across organizational levels and locations.

That inquiry aligns with the practical question raised by our hypothetical: can the company explain the distinction using relevant facts and established criteria? Rawls supplies a philosophical lens for examining the justification. The ECCP supplies an enforcement framework for scrutinizing actual practice.

Consistency requires judgment. An inadvertent mistake and deliberate concealment can warrant different responses. Supervisory responsibility, repeated misconduct, cooperation, harm, and applicable legal requirements may also matter. The organization should identify the factors it considers and document how they affect the outcome.

Return to the sales director. The decision-makers should examine the earlier case and any genuinely relevant distinctions. They should also consider whether the earlier response was itself appropriate. Fairness does not require repeating an unjustified sanction merely to preserve a record of identical outcomes. If the standard needs correction, the company should explain the correction and, with counsel and human resources, consider its implications for prior cases.

Fair Investigations Protect the Credibility of Findings

Institutional Fairness depends on a credible investigation. An organization cannot justify a consequence through careful reasoning if favoritism, prejudgment, or a refusal to examine contradictory evidence shaped the underlying inquiry.

The ECCP examines whether investigations are independent, objective, appropriately scoped, and documented. Applying Rawls’s thought experiment adds a practical design question: what process would we accept without knowing whether we would make the allegation or have to answer it?

Both positions deserve consideration. A reporter should have a reliable route for raising concerns and protection against retaliation. An accused person should have an appropriate opportunity to respond to material allegations before final findings, subject to legitimate investigative and legal constraints. Witnesses should be treated respectfully, and credibility assessments should rest on evidence.

These are proposed governance safeguards, rather than a claim that Rawls or the ECCP establishes a uniform corporate procedure. Companies must adapt their protocols to the circumstances and applicable law. They should nonetheless be able to explain why any significant departure was necessary and who authorized it.

In our hypothetical, an investigator whose promotion depends on the sales director may face a conflict. An independent assignment can protect the inquiry. The executive sponsor should supply relevant information without controlling findings. Clear roles reduce the opportunity for commercial pressure to influence the factual record before a disciplinary decision is even considered.

Exceptions Need Reasons That Survive Scrutiny

Policies inevitably encounter circumstances their authors did not anticipate. A mature compliance program needs a disciplined method for handling exceptions. The question is whether the justification would apply to another similarly situated person.

Consider a policy requiring advance approval for certain travel. An emergency evacuation and a preferred executive’s scheduling convenience present different reasons for an exception. The decision record should identify the relevant circumstances, the authority approving the departure, and any compensating safeguards. A personal relationship with the approver is not a defensible criterion.

Rawls also used reflective equilibrium, a method of working toward coherence among considered judgments and principles through revision. Applied by analogy, it encourages the CCO to examine difficult cases alongside the stated policy. A recurring, well-founded exception may reveal a defective rule. A convenient exception may reveal unwillingness to enforce a sound one.

The response should follow the evidence. Revise an impractical requirement where warranted, communicate the change, and preserve the underlying control objective. Where the rule is appropriate, address unauthorized departures. Employees should be able to understand how the company reaches these conclusions without needing personal access to influential decision-makers.

Testing Fairness and Reporting It to the Board

Fairness should be examined through case review and data. The ECCP addresses disciplinary transparency and monitors consistency in investigations and discipline. This is Institutional Justice in practice. For the same misconduct, does an employee in Brazil face the same consequences as your top salesperson in the United States? A practical review can compare similar matters while preserving the factual differences needed to interpret outcomes.

Start with a defined category, such as deliberate expense falsification. Compare findings, disciplinary history, role responsibilities, sanctions, and the reasons recorded for departures from the usual approach. Also review investigation duration and decision ownership. An unexplained delay involving an influential leader can warrant scrutiny even before determining a sanction.

Differences in outcomes signal the need for inquiry. Small samples, different legal requirements, and materially different conduct can make aggregate comparisons misleading. A dashboard should help reviewers identify questions that require examination of the underlying cases. It should not assign a fairness score that disguises unresolved factual distinctions.

The board needs visibility into material exceptions and management’s response to unexplained disparities. Directors should ask whether a disciplinary recommendation involving a senior leader was changed, who changed it, and why. The answer should include the relevant evidence and the standard applied, with appropriate protection for confidential information.

Communication with employees also deserves deliberate attention. The company can explain its decision criteria and use carefully anonymized examples without exposing private case details. When confidentiality limits disclosure, explain the process that supports accountability. Leaving employees to infer the rules from departures and rumors weakens the company’s ability to demonstrate fairness.

Five Key Rawls Takeaways for the Compliance Professional

  1. Test policies without assuming your own position. Ask whether you would accept a process as a junior employee, reporter, witness, or accused executive. Use the answers to identify protections that should not depend on influence.
  2. Define the reasons that justify different outcomes. Document relevant distinctions such as intent, responsibility, prior conduct, and legal requirements. Examine claims of commercial indispensability with particular care.
  3. Protect the integrity of the investigation. Identify conflicts, assign appropriate independence, examine contradictory evidence, and provide a fair opportunity to respond. Record the reasons for significant procedural departures.
  4. Review exceptions as evidence about the program. Determine whether they expose a policy defect or selective enforcement. Correct flawed rules transparently and address departures that lack a defensible basis.
  5. Give the board a clear account of consistency. Present material disparities, executive exceptions, and corrective actions with sufficient context to assess them. Use case evidence to explain what aggregate measures cannot resolve.

Rawls gives the compliance professional a demanding question: could we justify this rule before knowing whom it would benefit? For boards, the corresponding test is whether the company applies standards it would defend to employees at every level. The program’s credibility depends on the answers demonstrated in actual decisions.

In Part 4, we will turn to Jürgen Habermas and the role of reasoned dialogue in corporate compliance. Having examined fair institutional rules with Rawls, we will consider how employees can question those rules, challenge decisions, and have their concerns meaningfully considered. That discussion takes us into speak-up culture and the governance of disagreement.

Categories
Blog

Modern Philosophers and Compliance: Part 2 – Simone de Beauvoir and the Conditions for Ethical Action

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to modern compliance programs. We will look at John Rawls and institutional justice and fairness in a corporate compliance program; Jürgen Habermas and the governance of speaking up; and Hans Jonas and the responsibility for the future of corporate compliance. Today we continue with Simone de Beauvoir and the conditions for ethical action in a corporation.

A company that asks employees to act ethically must examine the conditions under which they make decisions. An employee may understand the code of conduct, recognize a problem, and know how to report it, yet reasonably fear that speaking up will jeopardize a livelihood. That fear is a governance issue. Simone de Beauvoir helps compliance professionals understand why.

In Part 1, Hannah Arendt brought personal responsibility into the corporate approval process. We examined whether individuals exercise judgment when organizational routines encourage deference. Beauvoir takes the discussion further by asking how circumstances affect the ability to act on that judgment. Responsibility matters, and so does the distribution of power around the person expected to exercise it.

For the chief compliance officer, this means examining the distance between what a policy permits and what employees believe they can safely do. A reporting mechanism becomes credible when the company understands that distance and takes concrete steps to reduce it.

Freedom Exists Within Real Circumstances

Beauvoir was a French philosopher whose work explored freedom, responsibility, and oppression. In The Ethics of Ambiguity, published in 1947, she examined human beings as both capable of choosing and constrained by circumstances they did not choose. We pursue our own projects while depending on a world shared with other people. Ethical responsibility includes concern for their freedom as well as our own.

Ambiguity, in this sense, does not make every choice equally acceptable. It describes a condition of human life: we act with limited knowledge and within circumstances we cannot fully control, yet our decisions affect others. We must take responsibility without assuming that a simple formula will resolve every conflict.

In The Second Sex, published in 1949, Beauvoir examined how women were defined in relation to men and constrained by social expectations, institutions, and material dependence. Her analysis of women as the Other challenged the treatment of one group’s experience as the norm against which everyone else was measured.

The compliance application interprets these ideas. Beauvoir did not prescribe hotline procedures or investigation protocols. Her work asks us to attend to people’s actual circumstances. Inside a corporation, that means considering who controls pay, work assignments, advancement, and access to decision-makers. Those relationships can shape whether an employee sees an ethical option as practically available.

The Employee Who Knows How to Report

Consider this hypothetical. A junior procurement analyst discovers that a supplier submitted invoices for services without supporting documentation. Her manager directs her to process them before the reporting period closes. He says the supplier is important and that asking further questions will make the department look uncooperative.

The analyst has completed compliance training. She knows the hotline number. She also knows that the manager controls desirable assignments and will soon recommend whether her temporary position becomes permanent. A colleague who challenged him previously lost important responsibilities. She does not know whether that change was retaliatory, but she understands its warning value.

From headquarters, the reporting system appears accessible. From her position, the choice carries immediate economic consequences. The uncertainty about those consequences affects her decision even before anyone makes an explicit threat.

Beauvoir helps us examine that difference. The analyst retains responsibility for her conduct, while management remains responsible for the conditions it creates. Telling her to demonstrate courage leaves the governance problem unresolved. The company must examine how managerial discretion, employment insecurity, and prior experience shape how controls are used.

For the CCO, this requires asking whose perspective informed the policy. A senior employee with financial security and direct access to legal matters may experience the same reporting procedure very differently from someone whose continued employment depends on the person named in the concern.

The DOJ Connection Through Trusted Reporting

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) examines whether reporting mechanisms are trusted and whether employees feel comfortable using them. It also asks whether organizational practices discourage reporting and whether the company assesses employees’ willingness to raise concerns.

These inquiries create a substantive connection to Beauvoir’s emphasis on circumstances. Publishing a telephone number establishes an available channel. To understand whether employees can use it, you need evidence of their experience. The ECCP’s attention to proactive retaliation prevention reinforces that distinction.

In our hypothetical, the CCO should examine whether the analyst can reach someone outside the manager’s reporting line, whether temporary employees understand the available protections, and how concerns involving powerful managers are routed. The company should also explain the limits of confidentiality. In a small team, the facts themselves may reveal who reported.

An effective response could include an independent contact, a documented protection plan proportionate to the circumstances, and follow-up with the analyst. Those are practical design choices flowing from the identified risk. The organization should explain what it can do and who will act, rather than offer assurances that nobody can reliably deliver.

Whose Experience Shapes the Compliance Program

Beauvoir’s analysis of the Other offers another lesson for policy design. Organizations can mistake the experience of their most influential employees for the experience of the workforce. A policy written around headquarters staff may overlook workers who lack private computer access, work overnight, or depend on a supervisor to interpret company communications.

The ECCP asks about language and other barriers to accessing policies, as well as how the company confirms that employees know where to find them. Compliance professionals can use those questions to investigate whether the program works across different employment conditions.

Review a reporting process with employees who actually use it. Can a warehouse worker obtain guidance without leaving a visible record on a shared terminal? Can an employee working through a staffing agency identify the correct reporting route? Does the policy clearly explain where a concern about a supervisor should go? Answers should inform the process design.

This work requires listening without assuming that a category determines someone’s experience. Employees facing similar constraints may make different choices. The objective is to identify specific barriers and address them. Participation in policy testing gives the company evidence that a headquarters review cannot supply.

Protection Must Extend Beyond the Initial Report

A report begins a period of heightened responsibility for the organization. Once the analyst raises her concern, management decisions about her assignments, evaluation, and employment status may require additional scrutiny. The practical risk extends beyond formal dismissal.

Retaliation can take forms that appear routine when viewed separately: exclusion from meetings, reduced access to training, undesirable shifts, or a sudden change in performance assessments. Such actions require fact-specific investigation. Their occurrence after a report does not automatically establish retaliation, but it can justify closer review.

The ECCP examines retaliation policies, training, complaint handling, and follow-up. It also asks whether investigations are independent, objective, appropriately conducted, and documented [3]. A company should translate those expectations into assigned responsibilities for protecting reporters and assessing concerns about adverse treatment.

In our hypothetical, compliance and human resources could arrange an independent review of material employment decisions concerning the analyst during an appropriate monitoring period. The review should consider existing performance evidence and legitimate business reasons. Protection should preserve fair management processes while reducing the risk that discretionary decisions become instruments of punishment.

The analyst should also have a named contact and a realistic explanation of what follow-up to expect. A company can communicate that it has addressed a concern without disclosing confidential personnel information. Silence after intake can leave a reporter uncertain about both the investigation and personal safety within the organization.

Power Must Be Part of the Investigation

Beauvoir’s perspective also changes the questions investigators ask. If the analyst processed unsupported invoices before reporting, the investigation should establish the instructions she received, how she understood them, the authority she had, and the options she believed were available. Pressure is relevant evidence. It does not predetermine the outcome.

Investigators should examine the manager’s conduct with the same care. Did he discourage inquiry? Had employees raised similar concerns? Did commercial targets reward removing inconvenient checks? Were previous complaints dismissed because his department delivered strong results?

The ECCP examines whether managers encouraged unethical conduct or tolerated greater compliance risk to pursue business objectives. It also addresses consistent discipline and accountability for supervisory failures. These expectations support an investigation that follows power and responsibility through the organization.

A Board should receive enough information to assess whether influential managers are obstructing the program. Relevant reporting might identify repeated concerns within a business unit, unresolved retaliation allegations, or exceptions involving senior personnel. Aggregate results should be interpreted carefully. Few reports can reflect confidence in local management, fear of reporting, or other conditions requiring inquiry.

A useful governance discussion therefore asks what the company knows about the employees least able to challenge authority. The answer should connect employee experience with management action, including who owns unresolved issues and when the board will receive an update.

Five Key Beauvoir Takeaways for the Compliance Professional

  1. Assess the conditions surrounding ethical choices. Examine who controls an employee’s income, assignments, evaluation, and future opportunities. Use that understanding to identify situations where dependence may discourage questions or reporting.
  2. Test policies with employees in different circumstances. Include workers with limited access to technology, language barriers, insecure employment, or little access to senior leaders. Ask them to demonstrate how they would obtain guidance or report a concern.
  3. Treat reporter protection as an assigned responsibility. Establish independent contacts, appropriate follow-up, and proportionate review of potentially adverse treatment. Explain confidentiality limits and avoid promises the organization cannot keep.
  4. Investigate power alongside individual conduct. Determine what instructions, pressures, and authority shaped decisions. Preserve fair accountability for employees while examining managers’ actions and supervisory responsibilities.
  5. Give the board evidence about barriers to ethical action. Report material retaliation risks, repeated concerns involving influential leaders, and progress on corrective action. Explain what remains uncertain and how the company will investigate it.

Beauvoir’s contribution to compliance is practical: ethical expectations must be considered alongside the conditions in which people are asked to fulfill them. The CCO should ask which employees face the greatest personal cost when they follow the code. The board should ask what management has done to reduce that cost.

In Part 3, we turn to John Rawls and the twin concepts of institutional justice and institutional fairness. After considering responsibility with Arendt and the conditions for ethical action with Beauvoir, Rawls shows a compliance professional how a company can design policies, investigations, and discipline that employees can regard as fair, regardless of their position or influence.

Categories
Blog

Modern Philosophers and Compliance: Part 1 – Hannah Arendt and Personal Responsibility in Corporate Compliance

This week we will conclude our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We will examine Simone de Beauvoir and the conditions for ethical action in a corporation; John Rawls and institutional justice and fairness in a corporate compliance program; Jürgen Habermas and the governance of speaking up; and Hans Jonas and responsibility for the future of corporate compliance. Today we begin with Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program.

Every approval in a compliance process represents a decision. Someone accepts an explanation, authorizes a payment, resolves a concern, or allows business to proceed. The central question is whether that person understands and takes responsibility for the decision. Hannah Arendt gives compliance professionals a powerful way to examine what happens when organizational routines weaken that connection.

Our examination of ancient and Enlightenment thinkers established the importance of inquiry, ethical habits, institutional order, and evidence. We now turn to twentieth-century philosophy, beginning with responsibility inside complex organizations. Arendt asks us to consider the individual who operates within the system. What happens when that person stops examining the meaning and consequences of the work?

For a Chief Compliance Officer, this question reaches directly into third-party approvals, internal investigations, management conduct, and board oversight. A company can assign responsibilities in a policy while its employees learn to defer judgment to someone else. An effective compliance program must address that gap.

Thinking and Judgment as Compliance Responsibilities

Arendt was a German-born Jewish political thinker who fled Nazi Germany and eventually settled in the United States. Her experiences of persecution and displacement informed her examination of totalitarianism, political life, and personal responsibility. In essays including “Personal Responsibility Under Dictatorship” and “Thinking and Moral Considerations,” she explored the relationship between independent thought, moral judgment, and conduct.

Her account of Adolf Eichmann and the phrase “banality of evil” remain controversial, if not one of the most well-known phrases to describe Nazi Germany. The phrase did not mean that the crimes were ordinary or insignificant. Her interpretation emphasized his failure to think critically about what he was doing, although scholars have challenged her assessment of his motivations. The historical crimes she examined must retain their specificity and gravity.

The compliance application is narrower: institutional roles do not eliminate the need for personal judgment. Arendt was not writing a corporate governance manual. Her work nevertheless provides a basis for asking whether employees examine what their actions enable, particularly when organizational language makes questionable conduct appear routine.

That question builds on Socrates. Socratic inquiry tests assumptions through questioning. Arendt directs our attention to the person who must decide whether to accept the answer and participate in the conduct. For compliance professionals, that is where inquiry becomes responsibility.

When Approvals Divide Responsibility

Consider this hypothetical. A multinational manufacturer proposes hiring an intermediary to help secure business with a state-owned customer. The commission is unusually high. The service description is vague, and the intermediary requests payment to an account outside its home jurisdiction.

Sales confirms the commercial opportunity. Procurement verifies that the vendor record is complete. Legal reviews contractual provisions. Finance checks that the required approvals appear in the payment system. Compliance previously reviewed the intermediary, but the proposed payment arrangement has changed since that review. Each function assumes another has addressed the remaining concern—the payment proceeds.

No single feature establishes bribery. Together, these facts warrant further inquiry. The governance failure is that nobody takes responsibility for obtaining a satisfactory explanation before payment. Each participant can describe a completed task. The organization cannot explain who assessed the unresolved risk.

This is where Arendt becomes useful to the CCO. Division of labor is necessary in a large company. It must be accompanied by clear obligations to recognize concerns, communicate them, and seek an appropriate decision. Otherwise, specialization can allow important facts to disappear between functions.

The practical response is to specify what each approval means. Does the approver confirm budget availability, verify services, resolve due diligence findings, or authorize an exception? What changes require renewed review? Who owns the decision when concerns remain? These questions turn personal responsibility into an operating requirement.

The DOJ Connection Through Gatekeepers and Escalation

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) addresses this issue directly. Under policies and procedures, the ECCP asks about guidance and training for gatekeepers with approval or certification responsibilities. It examines whether they recognize misconduct and understand when and how to escalate concerns.

This is a substantive connection to Arendt’s work, rather than a claim of philosophical influence on DOJ. The compliance question concerns whether an employee’s assigned role includes meaningful judgment. An approval control weakens when its operator understands the mechanics but cannot identify the circumstances that require further review.

Return to our hypothetical. The finance employee should understand whether the changed bank account requires renewed diligence. The business sponsor should explain the services and commercial rationale. Compliance should receive material changes to the information on which its earlier review depended. The final decision should record how identified concerns were resolved.

The CCO can test this through a sample of actual transactions. Interview the approvers. Ask what they believed their approval represented, what information they reviewed, and what would have caused them to stop. Compare those answers with the procedure. The gap between intended and understood responsibility is a control issue that requires attention.

Training Employees to Recognize the Decision

Arendt’s emphasis on thinking also offers a practical lesson for training. Employees need opportunities to examine a situation before organizational habit supplies the answer. A course can explain a prohibition accurately while leaving participants uncertain about how to respond when a manager presents a questionable request as urgent and routine.

The ECCP examines whether training is tailored to relevant employees and risks, whether employees can ask questions, and how the company evaluates learning and training’s effect on behavior or operations.[4] Those inquiries support training that develops judgment within defined responsibilities.

Use the hypothetical intermediary payment as an exercise. Give participants the initial facts, then introduce the changed bank account after approval. Ask them to identify what requires renewed attention, which function should act, and what must happen before payment. Require an explanation for the proposed response.

Include the manager who says the transaction has already been approved. That intervention tests whether employees understand the limits of an earlier decision. The training should leave them with a usable escalation route and a clear account of their authority. Asking people to exercise judgment carries a corresponding obligation to equip them to act.

Leadership Determines Whether Judgment Is Welcome

Employees learn what management expects by watching what happens when someone raises a concern. A company may encourage questions in training while a business leader treats delay as disloyalty. Over time, employees may conclude that completing the transaction is safer than examining it.

The ECCP assesses how senior and middle management demonstrate commitment to compliance. It also examines whether employees feel comfortable reporting concerns and whether the company maintains an effective approach to preventing retaliation.[5] These are relevant tests of the environment in which personal judgment operates.

For the CCO, the practical inquiry should include decisions under pressure. When did a manager support an employee who paused a transaction? What happened to an unresolved concern near quarter-end? Did a policy exception receive appropriate scrutiny when the business sponsor was influential? Such examples help explain whether the stated expectations survive commercial pressure.

Boards also have a role here. The ECCP examines compliance access to governing authorities and opportunities for private discussions. It also cites the Sentencing Guidelines’ expectations concerning governing authority knowledge and oversight.[5] Directors should use that access to ask where management pressure is weakening escalation and whether the compliance function can obtain timely decisions on unresolved concerns.

Investigations Must Examine the Approval Chain

When misconduct emerges, Arendt’s focus on personal responsibility should sharpen the investigation without prejudging anyone’s culpability. The inquiry must establish what individuals knew, what their roles required, what authority they possessed, and how they responded. Participation in a process alone does not establish intentional wrongdoing.

In our hypothetical, investigators should trace the changed payment instructions through the approval chain. Who received them? Did the system alert compliance? Did anyone ask for an explanation? Was a concern overridden, misunderstood, or never transmitted? Those facts distinguish deliberate avoidance from inadequate training, poor system design, or reasonable reliance on incomplete information.

The ECCP asks whether investigations identify system vulnerabilities and accountability failures, including those involving supervisory managers and senior executives. Its remediation questions address failed controls, missed opportunities, and accountability for supervisory failures.[6] An investigation that stops at the person who released the payment may leave the conditions that enabled the problem intact.

Fair accountability therefore requires attention to both conduct and context. Discipline should reflect facts and relevant responsibilities. Remediation should repair the information flows, authority gaps, and incentives that shaped the decision. The organization must be able to explain what it learned and how that learning changes future approvals.

Five Key Arendt Takeaways for the Compliance Professional

  1. Define the responsibility within each approval. Identify what the approver must assess, the evidence required, and the conditions that trigger escalation. Test whether employees understand these obligations in actual transactions.
  2. Train for judgment under realistic pressure. Use scenarios involving changed facts, urgent requests, and influential sponsors. Assess whether employees can explain a concern and identify the appropriate response.
  3. Make challenge operationally possible. Give employees clear escalation routes and appropriate authority to pause decisions. Examine how managers respond when employees use those mechanisms, including whether adverse consequences follow.
  4. Follow accountability through the management chain. Investigate who knew what, who exercised authority, and where supervision failed. Apply fair standards to senior leaders and high performers as well as frontline employees.
  5. Give the board evidence of independent judgment. Report material overrides, unresolved concerns, and lessons from investigations. Explain where employee challenge changed a decision and where management action is still required.

Arendt helps us see that personal responsibility must remain visible inside institutional processes. The CCO’s task includes designing controls that preserve that responsibility and creating conditions in which employees can exercise it. A useful board question follows: Where could our processes allow every participant to believe that someone else was responsible for examining the risk?

Join us tomorrow in Part 2, as we turn to Simone de Beauvoir and discuss the conditions that make ethical action possible. If Arendt asks individuals to exercise judgment, Beauvoir helps us examine how unequal power, dependence, and vulnerability affect their ability to act on it. That inquiry leads directly to reporting culture, retaliation prevention, and the lived experience of corporate compliance.

Categories
Blog

Southern Glazer’s Compliance Roadmap: How the ECCP Helped Turn Serious Misconduct into an NPA

For years, compliance professionals have turned to the Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) to answer a fundamental question: What does an effective compliance program actually look like? Unfortunately, given statements from the early Trump Administration, many compliance professionals feared the Administration would withdraw or otherwise eviscerate the ECCP.

Southern Glazer’s resolution gives us one of the clearest answers in recent memory. The answer is a resounding no: the ECCP is alive and well, even under this DOJ.

Southern Glazer’s entered into a two-year Non-Prosecution Agreement (NPA) with the U.S. Attorney’s Office for the Northern District of California and agreed to pay $12.5 million to resolve a federal criminal investigation involving improper payments, gifts, travel, gift cards, and other benefits. Some of those benefits were facilitated through third-party vendors and concealed through false invoices.

The underlying conduct was serious. Five former Southern Glazer’s employees were indicted in March 2026 for an alleged conspiracy involving commercial bribery and obstruction. Prosecutors alleged that approved vendors and suppliers were used to disguise payments for prepaid gift cards, luxury items, and other benefits through false invoices. Yet Southern Glazer’s itself received an NPA.

For compliance professionals, the most important part of this resolution may be why. The government expressly credited Southern Glazer’s with making significant enhancements to its compliance program beginning in 2023 and, remarkably, specifically noted that the company had aligned those improvements with the factors contained in the ECCP. That makes Southern Glazer’s much more than another bribery enforcement action. It provides a roadmap for remediation.

The ECCP Is Not Sitting on the Shelf

There has been plenty of discussion about what role the ECCP would play in the current enforcement environment. Southern Glazer’s provides a concrete answer. DOJ didn’t merely mention that the company improved compliance. The NPA expressly credited Southern Glazer’s for its “significant efforts to enhance its Compliance Program” and to align that program with DOJ’s evaluation guidance.

That is important. The ECCP should not be treated as an academic document or something pulled from the shelf only after the government arrives. It is a blueprint for building, assessing, and improving a compliance program. Southern Glazer’s demonstrates the potential value of using that blueprint during remediation.

The company did not start from zero. DOJ acknowledged that during the relevant period Southern Glazer’s had compliance policies, a Code of Conduct and employee handbook, trade-practice training, and mechanisms for reporting, investigating, and remediating misconduct. In 2019, the company also notified certain third-party marketing companies that it would no longer process incentives through them and terminated their ability to handle incentives and gift cards. Yet the Statement of Facts makes clear that problems persisted. Employees continued using outside mechanisms for gift cards, travel funds, and other benefits after the 2019 intervention.

This case offers an important compliance lesson. Remediation cannot stop at closing the door through which misconduct previously traveled. Compliance must determine whether employees simply found another door.

Put Resources Behind Compliance

Southern Glazer’s response beginning in 2023 was substantial. Between 2022 and 2024, the company increased compliance headcount by 85 percent and compliance funding by more than 65 percent. It also retained outside compliance experts to advise on program enhancements and best practices. Those numbers matter.

DOJ has repeatedly focused through the ECCP on whether compliance has sufficient resources and authority. Southern Glazer’s provides a practical example of what investment can look like when an organization concludes that its existing compliance infrastructure does not adequately address its risks. This was not simply hiring more investigators after misconduct occurred. Southern Glazer strengthened its compliance architecture.

The General Counsel was promoted to Executive Vice President, Chief Legal and Compliance Officer, reporting directly to the CEO. The company created and filled a Senior Vice President of Compliance & Ethics position. It hired a Vice President and Associate General Counsel for the West region and remapped compliance around five business regions. That is a significant point for boards. If management says compliance is important, look at the organization chart and the budget. Resources are evidence of priorities.

Accountability Had to Follow Misconduct

Southern Glazer’s also addressed individual accountability. The NPA credits the company with removing certain vice presidents and managers for violations of company policy, disciplining additional employees, and replacing senior leadership for California and the West Region. That matters because compliance programs lose credibility quickly when discipline stops at organizational rank.

The Corporate Compliance Agreement takes this concept further. It requires applying disciplinary procedures consistently and fairly, regardless of an employee’s position or perceived importance. When misconduct is discovered, the company must also remediate the resulting harm and assess whether the compliance program itself requires modification. That is precisely the right question after misconduct:

Not simply, Who violated the policy?

But also, What allowed them to do it?

An effective investigation should therefore generate two workstreams. One addresses individual accountability. The other addresses program failure.

Follow the Money

The Southern Glazer’s case is also a powerful internal-controls case. The alleged misconduct involved gift cards, travel, luxury goods, entertainment, marketing expenditures, supplier funds, bill-backs, expense reimbursements, and third-party vendors. According to the Statement of Facts, employees sometimes used altered invoices purporting to reflect legitimate business purposes to circumvent company accounting controls.

Southern Glazer’s responded by moving compliance closer to those transactions. The company imposed a Trade Practice Compliance Audit Program and implemented its “iShop” platform for marketing and promotional spending. It also added mandatory ethics and compliance training and additional compliance resources. That is another important lesson from the ECCP.

Training and policies matter, but compliance effectiveness ultimately has to reach the business process. If bribery risk resides in marketing spend, test marketing spend. If risk resides in bill-backs, audit bill-backs. If employees can manipulate expense descriptions, analyze expense data. If misconduct travels through Accounts Payable, build controls into Accounts Payable. The goal is not simply to tell employees not to engage in misconduct. It is to make misconduct harder to execute and easier to detect.

Rebuild Third-Party Risk Around Payment Controls

The third-party remediation may be the most instructive aspect of the Southern Glazer’s resolution. Third parties were not peripheral to the alleged misconduct. They were part of the mechanism through which value could be transferred and transactions disguised.

Southern Glazer’s responded with a Third-Party Management Program requiring vendors to agree to the company’s compliance and audit standards. Vendors became subject to enhanced due diligence and documentation requirements. The company obtained audit rights. Most importantly, vendors had to be approved before the company could issue payment. Southern Glazer’s also offboarded vendors because of the new requirements. That last point deserves attention.

Third-party compliance frequently becomes an onboarding exercise. Conduct diligence. Assign a risk rating. Obtain contractual language. Approve the vendor. Done. Southern Glazer’s demonstrates why that was insufficient. The control environment must connect onboarding to payment. Accounts Payable should not merely assume that a vendor appearing in the system has passed appropriate compliance controls. The process should prevent payment when required approvals have not occurred. That is compliance embedded into operations.

Compliance Has to Reach the Field

Southern Glazer’s also created a network of state-level “Compliance Champions” responsible for promoting awareness locally and providing additional compliance support. That is particularly relevant for geographically dispersed organizations. Corporate compliance can design excellent policies from headquarters. Risk occurs where employees interact with customers, suppliers, distributors, government officials, and other third parties.

Compliance therefore needs mechanisms to reach those employees and understand what is actually happening locally. The ECCP’s focus on whether a compliance program works in practice is important here. A policy residing on an intranet is not embedded compliance. Employees must know whom to call, understand the rules, and believe compliance understands their business.

Tone at the Top Still Matters

Southern Glazer’s also strengthened senior leadership messaging. The NPA specifically cites communications from the President and CEO reinforcing the importance of ethics and compliance. The company also updated its corporate values around “HEART”: Honesty, Excellence, Agility, Respect, and Teamwork.

Tone at the top is sometimes dismissed as soft compliance. It should not be. But tone only matters when behavior follows the message. Here, leadership messaging was backed by increased resources, management changes, discipline, audit mechanisms, training, third-party controls, and structural changes. That combination is important.

A CEO email saying compliance matters is communication. A CEO message backed by budget, personnel, discipline and controls is governance.

Test Whether the Remediation Actually Works

The final lesson is perhaps the most important. Southern Glazer’s did not simply promise that its enhanced program would work. The Corporate Compliance Agreement requires periodic risk assessments, annual review of policies and procedures, appropriate compliance independence and resources, training, confidential reporting mechanisms, adequately resourced investigations, discipline, M&A procedures, and periodic testing designed to evaluate and improve program effectiveness.

The company must also report annually to the USAO and TTB regarding remediation and implementation of its compliance measures during the NPA. At the end of the term, the CEO, Executive Vice President, and Chief Legal and Compliance Officer must certify that the company has implemented a compliance program that meets the agreement’s requirements and is reasonably designed to detect and prevent trade-practice violations throughout its operations.

That puts real accountability behind remediation.

The Southern Glazer’s Roadmap

Every CCO facing a significant compliance failure should study Southern Glazer’s. The lesson is not that remediation guarantees an NPA. The agreement expressly states that the government reached its decision based on the individual facts and circumstances of this case.

The lesson is that remediation matters, and DOJ has given compliance professionals an unusually detailed picture of what meaningful remediation can look like. Southern Glazer’s strengthened leadership. It increased resources. It brought in outside expertise. It disciplined employees and changed management. It strengthened tone at the top. It pushed compliance into the field. It created new audit mechanisms. It improved training. It rebuilt third-party controls. It connected vendor approval to payment. And it committed to continued risk assessment, monitoring, and testing.

Most significantly, it did these things by expressly aligning its compliance program with the ECCP. For CCOs, that may be the most important takeaway from this entire resolution. Do not wait for prosecutors to use the ECCP to evaluate your compliance program. Use it yourself.

Ask whether your program is well designed. Ask whether it is adequately resourced and empowered to function effectively. Ask whether it works in practice. Then test the answers against your actual risks, transactions, third parties, investigations, and control environment.

Southern Glazer’s demonstrates that the ECCP is more than DOJ guidance. Used properly, it can be a roadmap for remediation, a framework for explaining compliance investment to senior management and the board, and, when misconduct occurs, evidence that the company understood the failure and built a stronger program in response.

That is the compliance lesson from Southern Glazer’s. The best time to align your program with the ECCP is before misconduct occurs. The second-best time is when you discover your existing controls weren’t enough.

Other Resources

Tom and Matt Kelly took a deep dive into the Southern Glazer NPA on this episode of Compliance into the Weeds.

Matt Kelly looked at it on Radical Compliance.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Southern Glazer’s NPA: How Remediation and ECCP Alignment Drove a Favorable Settlement

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into compliance-related topics, literally going into the weeds to explore a subject in greater depth. Looking for hard-hitting compliance insights? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the Southern Glazer NPA.

The Southern Glazer Wine and Spirits’ non-prosecution agreement is a rare example where prosecutors credited compliance program remediation, rather than self-disclosure or extensive cooperation, as central to a favorable outcome. Southern Glazer, the largest US liquor distributor, faced a major California kickback and bribery scheme involving five former employees, fabricated records, sham agreements, and luxury benefits to retailers and others, along with alleged tax impacts. The company resolved the matter with a $12.5 million payment and a two-year NPA requiring the CEO and CCO to certify program effectiveness. Tom and Matt review how the NPA affirms DOJ’s Evaluation of Corporate Compliance Programs as still relevant and detail remediation steps: major headcount and budget increases, upgraded compliance leadership, audits of marketing spend, enhanced training, strengthened third-party controls and AP payment blocks, outside reviews, and tone-at-the-top messaging.

Key highlights:

  • Southern Glazer Case Setup
  • Industry Risks and Scheme
  • ECCP Guidance Still Matters
  • Program Overhaul Timeline
  • Concrete Remediation Metrics
  • DOJ Signals Under Trump Era

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has received Davey, Communicator, and W3 Awards, all for podcast excellence.

Categories
FCPA Compliance Report

FCPA Compliance Report: From Prosecutor to White Collar Lawyer to CCO and Back: Mike Koenig

In this episode, Tom Fox welcomes Mike Koenig to talk about his career and his recent move back to private practice after a 5-year stint at JBS. Mike is one of the few folks to move from private practice to an in-house CCO role, then back to private practice.

Mike began by reviewing his career, from 25 years in private practice and a 2003 DOJ Fraud Section stint prosecuting corporate fraud to becoming chief compliance officer at JBS in August 2021 amid DOJ and SEC settlement agreements requiring an effective compliance program. He describes learning to operate within business-driven priorities by building relationships, learning the business and culture, “educating not dictating,” and securing C-suite, board, and audit committee buy-in, including CEO-driven training completion. He explains that he uses trusted outside experts and focuses on the specific problem to solve rather than “boiling the ocean.” After JBS completed the settlements and listed on the NYSE in June 2025, he returned to private practice at Friedman Kaplan to advise on investigations and compliance, emphasizing concise, solution-oriented counsel. He warns against de-prioritizing compliance despite reduced enforcement, urges risk assessments (tariffs, export controls, and human rights), and recommends using DOJ compliance guidance to review programs.

Key highlights:

  • Career Journey Recap
  • Joining JBS In-House
  • Building Compliance Fast
  • Relationships Not Dictates
  • Leadership Buy-In
  • FCPA Pause or a Wake-Up Call
  • Compliance Through 2030

Resources:

Mike Koenig on LinkedIn

Mike Koenig at Friedman Kaplan

Friedman Kaplan

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

My first work of general non-fiction is now out: Deluge Before Dawn, the story of the 2025 flood in Kerr County, Texas, which killed 119 people and devastated a county. It is a story of tragedy, heartbreak, survival, and resilience.

It is available on the following sites:

Amazon.com

Stoney Creek Publishing

Barnes and Noble

Texas A&M University Press

Bookshop.org

Google.Books

Walmart

This week only, the Kindle e-book version is available for $0.99 on Amazon.

Categories
Blog

Da Vinci Week: Part 3 – Leonardo’s Flying Machines and “Can We?” or “Should We?”

In the first two posts in the Leonardo Compliance Framework, the Mona Lisa gave us Refine, the principle that an effective compliance program improves as the organization learns from experience. Leonardo’s anatomical studies gave us Investigate, the discipline of looking beneath misconduct to understand root causes, control failures, incentives, management decisions, and the organizational systems that produced the outcome. The third principle is Innovate.

For that lesson, we turn to Leonardo’s studies of flight and his designs for flying machines. Leonardo examined birds, air movement, wings, and mechanical systems as he considered whether technology could allow human beings to fly. Many of his concepts were far beyond the practical capabilities of his time, but they demonstrate an important characteristic of Leonardo’s work: he imagined capabilities that did not yet exist and then studied the systems necessary to make them possible.

For corporate compliance professionals in 2026, the analogy to artificial intelligence is particularly useful. AI is expanding what companies can automate, analyze, predict, generate, and increasingly act upon. Organizations are moving beyond using generative AI to draft documents and summarize information. AI systems are becoming embedded in business processes, interacting with corporate data, supporting consequential decisions, communicating with customers, evaluating third parties, and, through increasingly agentic capabilities, taking actions that previously required human intervention.

The compliance challenge is not whether companies should innovate. They will. The challenge is establishing governance that lets innovation create business value without creating unmanaged legal, ethical, operational, or compliance risk.

AI Governance Is Enterprise Governance

Compliance professionals have sometimes approached emerging technology as primarily the responsibility of IT, Cybersecurity, Data Privacy, or Legal. That division becomes increasingly difficult with AI because these systems can influence many of the activities a corporate compliance team already oversees. Indeed, the Evaluation of Corporate Compliance Programs (ECCP) anticipates these very concepts in its 2024 edition.

AI may assist with third-party due diligence, contract review, procurement, transaction analysis, hiring, customer communications, investigations, fraud detection, marketing, or pricing. Each application creates a different risk profile. A due diligence system may generate inaccurate information about a business partner. An investigation tool may expose privileged or confidential information. A sales application may generate communications inconsistent with company policies. An agent connected to corporate systems may take actions that historically required human approval.

The ECCP asks the following:

  • How does the company assess the potential impact of new technologies, such as artificial intelligence (AI), on its ability to comply with criminal laws?
  • Is management of risks related to the use of AI and other new technologies integrated into broader enterprise risk management (ERM) strategies?
  • What is the company’s approach to governance regarding the use of new technologies such as AI in its commercial business and in its compliance program?
  • How is the company curbing any potential negative or unintended consequences resulting from the use of technologies, both in its commercial business and in its compliance program? 

Visibility and Risk Should Drive the Control Environment

By 2026, asking whether a company uses AI provides little useful information. Management needs to understand how AI is being used and what authority particular systems possess. A tool that summarizes a public document presents a very different risk profile from a system that influences hiring, approves a third party, communicates with customers, accesses confidential information, initiates a transaction, changes corporate records, or takes actions across interconnected systems.

An AI inventory should therefore identify meaningful use cases, including the business owner, intended purpose, relevant data, third parties involved, decisions influenced by the technology, degree of autonomy, and applicable controls. The objective is not simply to count tools. It is to give management sufficient visibility to identify where material risk exists.

That visibility should support risk classification. Not every AI application requires the same level of governance. Classification should consider the system’s purpose, data sensitivity, potential consequences of error, degree of autonomy, affected populations, ability to review or reverse decisions, and applicable legal or regulatory requirements.

This is familiar territory for compliance professionals. Risk-based programs have long applied different levels of scrutiny to third parties, transactions, investigations, and markets. AI should follow the same principle. Higher-risk systems should receive greater review, stronger controls, and more rigorous monitoring.

Human Oversight Must Preserve Accountability

“Human in the loop” has become common language in AI governance, but a human’s presence alone does not create an effective control. Meaningful oversight requires defined responsibilities, appropriate expertise, sufficient capacity to review relevant outputs, and authority to challenge or override the system.

If one employee is nominally responsible for reviewing thousands of AI-generated recommendations each day, human oversight may exist on paper but not function in practice. The same problem arises when employees routinely accept recommendations because they assume the technology is more reliable than their own judgment.

The control should therefore define the reviewer’s responsibilities, the circumstances requiring additional scrutiny, the authority to reject recommendations, and how to handle material overrides or recurring disagreements between the system and human decision-makers. Most importantly, technology should not create an accountability vacuum. If an AI system contributes to a compliance failure, the organization should still be able to identify the business process owner, who approved the use case, who monitored it, and who had authority to intervene.

This becomes increasingly important with agentic systems. Traditional corporate controls generally assume identifiable human actors approve payments, create vendors, review contracts, or authorize higher-risk third parties. When technology performs some of those activities, the organization has effectively delegated authority to a system. The control environment must reflect that delegation while retaining human and organizational accountability for the outcome.

Third-Party AI and Data Risk

Many companies will obtain significant AI capabilities from external vendors rather than develop them internally. Using a vendor does not transfer accountability for the resulting compliance risk. Traditional third-party risk management principles remain relevant. The company should understand the service provided, the information the vendor receives, how data are used and retained, which subcontractors are involved, how incidents are managed, and what contractual rights the company has to obtain information, require remediation, audit, or terminate the relationship.

AI adds a dynamic element because models, features, and business uses can change after initial approval. Monitoring should therefore identify material changes in functionality, data use, vendor practices, or business application that could alter the original risk assessment.

Data governance is equally important. Companies need clear rules regarding which AI systems may access confidential business information, personal data, investigation materials, privileged communications, customer information, trade secrets, source code, and other sensitive information. As enterprise AI systems increasingly operate on internal data, blanket prohibitions will often give way to more precise governance defining approved systems, permissible data, access controls, retention, deletion, and accountability.

These issues require coordination across Compliance, Legal, Privacy, Cybersecurity, IT, Records Management, and the business. Effective governance depends upon clear responsibilities rather than overlapping or fragmented ownership.

Test Before Deployment and Monitor Afterward

Leonardo’s flying machines provide another useful innovation lesson. Test a design before you trust it with a critical task. AI testing should match the risk. Before deployment, the company should understand whether the system performs as intended, where its limitations lie, how it responds to unusual circumstances, whether users can manipulate it, and whether inaccurate or inconsistent outputs could create material consequences. Testing at implementation is not enough. Business conditions change, vendors update models, employees develop new uses, and system capabilities expand. An application that operated within acceptable parameters when approved may later present a different risk profile.

Higher-risk systems therefore require post-deployment monitoring that can identify performance issues, material changes, incidents, and circumstances requiring reassessment. Management should also establish when a system should be modified, restricted, or suspended.

This lifecycle approach connects Innovate to the next Leonardo principle, Monitor. Responsible innovation is not a one-time approval. Governance should continue throughout the period the organization relies on the technology.

Using NIST and ISO as Governance Architecture

Compliance professionals do not need to invent an AI governance structure from scratch. The NIST AI Risk Management Framework provides a useful approach to governance, mapping, measuring, and managing AI risk, while ISO/IEC 42001 offers a management-system perspective built around responsibilities, processes, documentation, monitoring, and continuous improvement.

For the CCO, the value lies in providing governance architecture, not another checklist. The relevant measure is not whether a company can say it follows NIST or ISO. It is whether its governance system addresses the actual risks created by its AI applications and whether the resulting controls work in practice. Frameworks provide structure. Management remains responsible for operating the system.

Compliance Should Enable Responsible Innovation

The CCO should avoid two extremes: allowing enthusiasm for AI to outrun governance or creating an approval structure so burdensome that employees circumvent it. A better model is responsible innovation. Compliance can help create clear pathways for lower-risk experimentation while ensuring that higher-risk applications receive appropriate scrutiny. Employees should understand what uses are permitted, which require approval, what categories of information may be used, and when escalation is necessary.

This approach also creates opportunities for a corporate compliance program. AI may improve due diligence, transaction monitoring, investigations, risk assessment, training, and data analysis. The compliance function should be willing to explore those capabilities under the same risk-based governance it expects the business to follow.

A CCO’s contribution should not be measured by how much innovation Compliance prevents. It should be measured in part by whether Compliance helps the enterprise capture value while maintaining appropriate accountability and control.

Before Leaving the Ground

Leonardo’s flying-machine studies represent the willingness to imagine possibilities beyond current practice. The modern compliance lesson is to combine that willingness with disciplined governance. For the CCO, Innovate means helping the enterprise pursue new capabilities through a risk-based system that provides visibility, assigns ownership, preserves meaningful human accountability, tests higher-risk applications, and monitors them as technology and business use evolve. The objective is neither unrestricted adoption nor blanket prohibition. It is responsible innovation that can produce sustainable business value.

From Innovation to Monitoring

Responsible innovation does not end when technology is approved and deployed. The organization must determine whether systems continue to operate as intended as data, users, vendors, business conditions, and risks change. That brings us to the fourth Leonardo principle: Monitor.

In Blog Post Four, The Last Supper and the Danger of Deterioration, we will use Leonardo’s experimental masterpiece to examine the difference between implementing a control and demonstrating that it remains effective. The discussion will focus on control testing, continuous monitoring, compliance analytics, ownership, remediation, AI monitoring, and the board’s role in evaluating evidence of continuing program effectiveness.