Tag: DOJ

Blog

Isaac Newton and the Hidden Forces Behind Misconduct

Post author By Admin
Post date May 1, 2026
No Comments on Isaac Newton and the Hidden Forces Behind Misconduct

Today, we conclude our exploration of Enlightenment Thinkers to see their influence on modern compliance programs. This week’s category is broader than philosophers, as many of these men excelled in numerous fields, including science, mathematics, calculus, and medicine. However, each contributed a key component that relates directly to our modern compliance regimes. In this concluding post, we consider Isaac Newton’s theorem that misconduct is rarely random.

If Francis Bacon taught us that a compliance program must be grounded in evidence, René Descartes taught us that evidence must be examined with rigor, John Locke taught us that the system must be legitimate, and Thomas Hobbes taught us that institutions need order, Isaac Newton brings this series to its final and perhaps most powerful insight: misconduct is rarely random. Forces drive it. Pressures. Incentives. Structural weaknesses. Repeated patterns. Hidden relationships. The most mature compliance programs understand that reality and act on it.

Newton is remembered as the great scientist of motion, force, and causation. He gave the world a way to understand that observable events are often the result of underlying principles that can be identified, studied, and predicted. His work was not simply about describing what happened. It was about explaining why it happened and how the same forces might operate again. For the compliance professional, that is a profoundly useful way to think. A hotline complaint, a bribery incident, a books-and-records failure, a retaliation claim, or a control breakdown should never be seen as a one-off event. The real question is Newtonian: what forces produced this result? In a best practices compliance program, that question is the bridge from reaction to prevention.

Why Newton Matters to Compliance

Newton helps compliance professionals move beyond event-based thinking. Too often, organizations respond to misconduct by focusing only on the visible incident. Someone violated policy. Someone approved a bad payment. Someone ignored a red flag. Someone retaliated against a whistleblower. Those facts matter, of course, but they are usually only the surface expression of deeper conditions. Newton would urge us to ask what was acting beneath the surface.

Was the employee under intense sales pressure? Were performance incentives designed in a way that rewarded output but ignored process? Was a business unit growing so quickly that controls were bypassed in the name of speed? Did management tolerate workarounds because the local market was too important to slow down? Was the company relying on outdated monitoring tools in a rapidly changing business model? Were risk signals present but scattered across functions with no one connecting them?

That is Newton’s great gift to compliance. He reminds us that forces shape behavior, and if you want to reduce misconduct, you must understand and address the forces that make misconduct more likely.

The DOJ Expects Companies to Understand Causes, Not Just Outcomes

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) reflects this Newtonian logic with remarkable consistency. The ECCP asks whether a company performs root cause analysis, adapts its program based on lessons learned, uses data to identify patterns, aligns incentives with ethical conduct, and can demonstrate that controls are responsive to emerging risks. These are not narrow enforcement questions. There are questions about causation.

The ECCP is not satisfied when a company says it found the bad actor and imposed discipline. Regulators want to know what the company learned. Why did the misconduct happen? Were there prior warning signs? Was the conduct enabled by poor oversight, flawed incentives, weak middle management, insufficient resources, or ineffective controls? Did the company identify those drivers and change the system? That is exactly the sort of inquiry Newton would have appreciated.

Root Cause Analysis Is Newton in Practice

If there is one place where Newton’s influence should be front and center, it is root cause analysis. In compliance, root cause analysis is the discipline of looking beyond the immediate violation to identify the pressures, structures, incentives, and system weaknesses that created the conditions for failure. This is where many companies still fall short.

A company uncovers improper payments and concludes that an employee acted dishonestly. Perhaps that is true. But Newton would ask what else was in motion. Was there a compensation model that encouraged aggressive behavior without corresponding control discipline? Were finance and compliance understaffed relative to expansion? Did business leadership send signals that revenue mattered more than process? Had similar concerns surfaced in audit findings or prior investigations? Was a third-party oversight process designed for a smaller and less risky operating model? A true root cause analysis keeps asking until the organization understands the forces at work.

Incentives Are Among the Strongest Forces in Any Organization

Newton’s framework is especially valuable when thinking about incentives. Every organization generates motion through what it rewards, measures, and celebrates. If those incentives are poorly designed, they can push employees and managers toward decisions that undermine the compliance program even when the formal policy language is sound. This is one of the most underappreciated truths in compliance.

A company may say all the right things about integrity, but if promotions, bonuses, and recognition go disproportionately to people who hit aggressive numbers regardless of how they achieved them, employees receive a different message. If managers are evaluated on speed and volume but not on control discipline, they will often treat process as friction. If local market leaders are given extraordinary flexibility without matching oversight, the organization may create precisely the pressures and blind spots that breed misconduct.

The ECCP has increasingly focused on compensation structures, clawbacks, and incentive alignment for precisely this reason. Regulators understand that culture is shaped not only by leadership’s words, but also by tangible rewards that guide daily conduct. Newton helps compliance professionals explain why this matters. Incentives are not background conditions. They are active forces inside the corporate system.

Analytics Help the Company See What the Eye Misses

A Newtonian compliance program also leverages analytics more effectively. Newton’s work showed that patterns in motion could be identified through disciplined observation and analysis. Modern compliance can do something similar. Data analytics, trend reviews, and integrated monitoring allow a company to detect patterns that an isolated human review might miss. That does not mean technology replaces judgment. It means technology can help reveal the forces and relationships that judgment must then interpret.

Consider a multinational company reviewing third-party spend, travel, and entertainment data, hotline trends, and investigation outcomes. Each data set alone may show only limited information. But when viewed together, patterns may emerge. A particular region may show above-average use of high-risk intermediaries, greater discounting, delayed documentation, and increased employee complaints about management pressure. No single data point proves misconduct. But together they may reveal a system under strain.

This is where Newton connects back to Bacon. Bacon tells us to gather evidence. Newton tells us to study how patterns and causes operate across the system. Together, they produce a compliance function that is empirical, analytical, and forward-looking.

Misconduct Is Often a Systems Failure, Not Merely an Individual Failure

One of the most valuable lessons Newton offers the compliance profession is that misconduct is frequently systemic. This does not excuse individual wrongdoing. Personal accountability remains essential. But if a company stops with personal accountability, it may miss the broader organizational truth.

An employee may make an improper payment, but the surrounding system may have made that outcome easier, more predictable, or more likely. A senior manager may retaliate against a reporter, but the broader culture may have conditioned leaders to treat bad news as disloyalty. A financial control breakdown may involve one approving official, but the deeper problem may be a long-standing tolerance for informal overrides. In each case, the misconduct event should prompt a systems review.

This is particularly important in fast-changing environments. Growth, acquisitions, digital transformation, remote work, AI deployment, and market stress all alter the forces acting on the organization. Controls designed for one operating model may not be sufficient for the next. A Newtonian compliance officer understands that governance must evolve as the system changes. The question is never just whether the policy still exists. The question is whether the underlying forces have shifted in ways the compliance program has not yet caught up to.

Newton and the Future of Compliance

Newton is particularly relevant today because the modern compliance landscape is increasingly defined by complexity. Third-party ecosystems are larger. Data flows are faster. Business models shift more quickly. AI and automated decision-making create new risks that can change over time through drift, scale, and changing use cases. In that world, static compliance is not enough. A company needs to understand how moving systems work.

This is where frameworks like NIST and ISO/IEC 42001 become useful companions to Newtonian thinking. They emphasize lifecycle governance, ongoing monitoring, documented accountability, testing, and adaptation. In the AI context, especially, the lesson is clear: a control that works on day one may not be enough on day two. Risks evolve—inputs change. Vendors change. User behavior changes. Governance must therefore be dynamic, evidence-based, and attentive to emerging forces.

The same is true across compliance more broadly. Companies cannot assume that yesterday’s control environment will manage tomorrow’s pressures. Newton teaches that motion continues unless acted upon, and in the corporate setting, that means risk patterns will continue to develop unless governance actively intervenes.

The Compliance Officer as Interpreter of Organizational Forces

If Bacon casts the compliance officer as an institutional scientist, Descartes as a guardian of clear thinking, Locke as a steward of legitimacy, and Hobbes as an architect of order, Newton casts the compliance officer as an interpreter of organizational forces. That is a sophisticated and necessary role.

The compliance officer must ask what is really driving conduct across the enterprise. Which incentives are shaping decisions? Which processes are creating blind spots? Which managers are transmitting pressure? Which data trends suggest a deeper problem? Which repeated “isolated incidents” are no longer isolated at all? Which changes in the business model have altered the risk environment without corresponding updates to governance?

Those are not merely compliance questions. They are strategic governance questions. That is why Newton is such a fitting conclusion to this series. He pulls together all that came before. Evidence matters. Rigor matters. Legitimacy matters. Order matters. But ultimately, the mature compliance program does something more. It understands how these elements interact inside a living system. It seems that misconduct does not fall from the sky. It emerges from forces that can be studied, anticipated, and changed. Isaac Newton would have understood that a well-governed institution learns to read its own motion.

Five Lessons Learned for the Modern Compliance Professional

First, misconduct is rarely random. It is usually the product of identifiable pressures, incentives, weaknesses, and structural conditions.

Second, root cause analysis must go beyond the visible event. The goal is to understand the forces that made the event more likely.

Third, incentives are among the strongest drivers of conduct. A company must align compensation, promotion, and recognition systems with ethical and compliant behavior.

Fourth, analytics and trend analysis are essential tools for seeing patterns across the system. They help the company detect pressure points before they become crises.

Fifth, the most mature compliance programs are systemic and preventive. They do not simply respond to incidents. They study the organization well enough to reduce the conditions that produce misconduct.

Closing It Out

This five-part journey through Bacon, Descartes, Locke, Hobbes, and Newton shows that the architecture of a modern compliance program is not merely legal or procedural. It is intellectual. Bacon teaches us to demand evidence. Descartes teaches us to examine it with discipline. Locke teaches us that the system must be legitimate. Hobbes teaches us that institutions require order. Newton teaches us to understand the forces that shape outcomes.

Together, they offer a powerful framework for the compliance professional, the board, internal audit, legal, and business leadership. A best practices compliance program is not simply a collection of policies. It is a way to see the organization clearly, govern it credibly, and continuously improve it. That is as true now as it would have been revolutionary in their own time.

Tags compliance, DOJ, ECCP, hotline, incentives, Issac Newton, motion, RCA, root cause analysis

Blog

Thomas Hobbes and Why Every Compliance Program Needs Order

Post author By Admin
Post date April 30, 2026
No Comments on Thomas Hobbes and Why Every Compliance Program Needs Order

We continue our exploration of Enlightenment Thinkers to see their influence on modern compliance programs. This week’s category is broader than philosophers, as many of these men excelled in numerous fields, including science, mathematics, calculus, and medicine. However, each contributed a key component that relates directly to our modern compliance regimes. In this post, we consider how Thomas Hobbes makes clear in his writings that no institution can function without order.

If Francis Bacon teaches that compliance must be grounded in evidence, René Descartes teaches that evidence must be examined rigorously, and John Locke teaches that a compliance system must be legitimate, Thomas Hobbes takes us to a different but equally important truth about structure. That is where Hobbes becomes surprisingly relevant to the modern corporate compliance program.

That point can sound severe to modern ears, but compliance professionals understand it instinctively. Good intentions are not enough. Strong values are not enough. Even a trusted culture is not enough. A company also needs structure, clear rules, defined authority, escalation channels, and credible enforcement. Without them, pressure, ambiguity, and self-interest will fill the vacuum.

Hobbes is often remembered for his stark view of human nature and his argument that, in the absence of a strong governing authority, disorder follows. In his political philosophy, institutions exist in part to prevent chaos, conflict, and the breakdown of shared rules. While corporations are not states and employees are not citizens in the political sense, the organizational lesson is powerful. In any complex enterprise, when roles are unclear, rules are weak, exceptions become routine, and accountability is diffuse, people will default to local incentives, personal judgment, and short-term advantage. That is a dangerous environment for compliance.

Why Hobbes Matters to Compliance

Hobbes helps us understand something that compliance officers see every day: misconduct often flourishes not simply because individuals have bad intent, but because the system around them lacks structure. When approval processes are vague, when no one knows who owns a risk, when policies are written but not operationalized, when escalation lines are uncertain, or when managers believe standards are optional if performance is strong, disorder sets in. It may not look dramatic at first. It may look like improvisation, local flexibility, or entrepreneurial speed. But over time, that disorder becomes fertile ground for misconduct. Hobbes would not have been surprised.

His philosophy begins with the recognition that interests, fears, ambitions, and competing claims drive human beings. In the absence of a framework that organizes conduct, conflict, and opportunism follow. Translate that into corporate life, and the message becomes clear. Sales teams under pressure will rationalize shortcuts. Business sponsors will push third parties through onboarding if they believe control functions are merely advisory. Local managers will create informal workarounds if policies lack clear accountability. A company does not become more ethical by leaving such matters to improvisation. It becomes less governable. That is why compliance needs structure. Structure is what turns values into operations.

The DOJ Looks for Structure, Not Slogans

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) reflects this Hobbesian insight throughout. Prosecutors do not simply ask whether a company talks about ethics. They ask whether the compliance function has authority, stature, autonomy, and resources. They ask who owns specific risks, how decisions are made, whether controls are implemented consistently, whether investigations are escalated properly, and whether disciplinary systems are enforced. Those are all questions about institutional order.

This is important because many organizations still overestimate the power of tone. Tone at the top matters. Culture matters. Legitimacy matters. But none of those can substitute for structure. A CEO can deliver a compelling speech about integrity. However, if the company’s third-party onboarding process is fragmented, if financial approvals can be bypassed informally, or if no one knows when a matter must be escalated to legal or compliance, then the organization has created a system in which disorder is likely.

Hobbes helps compliance professionals make this point without apology. Rules are not a sign of distrust. Controls are not bureaucratic excess. Escalation pathways are not obstacles to business. They are the architecture that prevents pressure and self-interest from overwhelming principle. The COSO Internal Controls Framework makes much the same point in a different vocabulary. The control environment, control activities, information and communication, and monitoring all depend on defined roles, clear expectations, and operational discipline. The Federal Sentencing Guidelines likewise assume that compliance requires standards, oversight, training, auditing, reporting, and consistent response. Hobbes would recognize all of that as institutional design for preventing disorder.

Policies Must Be Operational, Not Aspirational

One of the most common failures in corporate compliance is the belief that policy issuance is itself control. It is not. A policy can express a standard, but unless the company translates that standard into decision rights, workflows, approvals, and accountability, the policy remains aspirational. This is where Hobbes is especially useful. He reminds us that order is created not by declarations, but by mechanisms.

Take a gifts, travel, and entertainment policy. On paper, the policy may clearly prohibit excessive or improperly documented expenses. But the real compliance question is whether the operating system around the policy supports that standard. Who approves the expense? Is there a threshold that triggers additional review? Are government-facing interactions flagged? Is supporting documentation required before reimbursement? Are there analytics to identify unusual patterns? Are exceptions tracked? Can someone ask a friendly manager to sign off without scrutiny? If the answers are weak, the policy is weak, no matter how polished its language.

Internal Controls Are the Language of Order

If one wanted to translate Hobbes into modern corporate practice, one would end up talking about internal controls. Controls are how an organization embeds order into decision-making. They define who can do what, under what conditions, with what approvals, and with what oversight. They reduce discretion where discretion creates unacceptable risk. They separate duties so that no single actor can move money, approve vendors, or override procedures without a second set of eyes. They create documentation so that actions can be reviewed later. They make authority visible.

For compliance professionals, this is a critical point. Compliance is not merely about training people to do the right thing. It is also about designing systems that make the right thing more likely and the wrong thing harder to do. Hobbes would say that the institution failed to create sufficient order to contain foreseeable human behavior.

Escalation Is a Form of Governance

Another Hobbesian lesson for compliance is the importance of escalation. In poorly governed companies, people often know something is wrong but do not know where the issue should go, who owns the decision, or what threshold requires higher review. That uncertainty is one of the most dangerous forms of disorder because it allows time, politics, and convenience to shape the response. A mature compliance program should therefore have clear escalation pathways.

When does a third-party red flag require a compliance sign-off? When must legal be brought into an internal investigation? At what point does a matter involving senior leadership move to the audit committee or board? Who can approve an exception to policy, and what documentation must support it? Who decides whether a substantiated misconduct issue triggers broader control remediation? These are not administrative details. They are the channels through which institutional order is maintained.

The ECCP pays close attention to this issue because escalation is one of the clearest indicators of whether compliance has real authority. If important matters can be contained, softened, or rerouted informally by management, then the program is fragile. Hobbes would have recognized the danger immediately. Where the lines of authority are unclear, competing interests will rush in.

Enforcement Gives Standards Their Weight

No discussion of order would be complete without enforcement. Hobbes understood that rules without consequences are invitations to defection. The same is true in corporate compliance. A company may have excellent policies, robust training, and well-designed procedures, but if employees believe violations will be ignored, minimized, or treated selectively, the system loses force. This is where consistent discipline matters so much. John Locke helped us see discipline as a question of legitimacy and fairness. Hobbes adds a different point. Discipline is also what gives the rule structure its operational credibility. It signals that standards are real, that no one is exempt, and that the organization is willing to defend the order it has established.

This does not mean punitive excess. It means predictability and seriousness. A company should be able to explain how disciplinary outcomes are determined, how similar cases are handled, and how managers are held accountable not only for their own conduct but for the environments they create. High performers cannot be given private exemptions. Senior executives cannot be allowed to negotiate around standards. Informal workarounds cannot become tolerated customs. Hobbes would have called that a dangerous condition.

The Compliance Officer as Architect of Order

If Bacon casts the compliance officer as an institutional scientist, Descartes as a guardian of clear thinking, and Locke as a steward of legitimacy, Hobbes casts the compliance officer as an architect of order. The compliance officer helps turn principle into process. The compliance officer asks where authority sits, where decisions are made, where controls can be bypassed, where exceptions accumulate, where roles are unclear, and where escalation can fail. That work is not separate from ethics. It is one of the main ways ethics becomes operational inside a large organization.

This is especially important during periods of growth, restructuring, acquisitions, digital transformation, or market stress. Disorder often enters through change. New business lines are launched before roles are clarified. AI tools are deployed before governance is assigned. Third parties are engaged before diligence and monitoring are fully operational. Incentives are revised without understanding how they affect conduct. Hobbes reminds us that institutional order is not self-sustaining. It must be built, maintained, and defended.

Thomas Hobbes may seem like an austere companion for the modern compliance professional, but his lesson is both practical and urgent. Institutions do not drift into integrity. They require order.

Five Lessons from Thomas Hobbes for the Modern Compliance Professional

First, culture and values are essential, but they cannot substitute for structure. A company needs clear rules, defined roles, and operating discipline.

Second, policies are not controls unless they are translated into workflows, approvals, documentation, and accountability.

Third, internal controls are the mechanisms by which institutional order is embedded in business operations. They make the right behavior more likely and the wrong behavior harder to execute.

Fourth, escalation pathways are critical. Employees and managers must know when and how risk moves upward for review and decision.

Fifth, enforcement gives standards their weight. Rules without consistent consequences will eventually be overtaken by convenience and local incentives.

Coming Next: Isaac Newton and the Hidden Forces Behind Misconduct

If Thomas Hobbes teaches us why every compliance program needs order, Isaac Newton will help us understand something even deeper: misconduct is rarely random. It is produced by forces, incentives, pressures, and patterns that can be studied and addressed. In Part 5, I will explore how Newton’s systems-based way of thinking offers a powerful framework for root cause analysis, incentive review, compliance analytics, and proactive prevention. A mature compliance program does not simply respond to failure. It learns to understand the forces that make failure more likely.

Tags CCO, compliance, compliance program structure, COSO, DOJ, ECCP, Thomas Hobbes

Compliance Into the Weeds

Compliance into the Weeds: Navigating DOJ’s Evolving Self-Disclosure Strategies

Post author By Admin
Post date April 29, 2026
No Comments on Compliance into the Weeds: Navigating DOJ’s Evolving Self-Disclosure Strategies

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore the subject more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss a recent Law360 post by Hui Chen on the evolving calculus for self-disclosure.

Hui Chen’s insights into the Department of Justice’s (DOJ) evolving self-disclosure strategies are crucial for companies navigating the complexities of compliance in today’s uncertain regulatory environment. As a former DOJ compliance counsel and a Microsoft compliance officer, Chen emphasizes the challenges posed by a politicized, understaffed DOJ, urging companies to reassess their compliance programs amid shifting enforcement dynamics. Tom and Matt echo Chen’s concerns regarding the DOJ’s current state. Tom, acknowledging Chen’s expertise, highlights the impact of the department’s politicization and understaffing on the effectiveness of compliance efforts, while Matt underscores the importance of proactive self-disclosure despite uncertainties, stressing the potential risks of inaction under the current administration. Both agree that the fractured nature of the DOJ requires a reevaluation of traditional compliance and self-disclosure strategies.

Key highlights:

Navigating DOJ Self-Disclosure Strategies with Wei Chen
Justice Department’s Impact on Corporate Prosecutions
Mitigating Criminal Violations through Self-Disclosure
Benefits of Self-Disclosure in Corporate Enforcement

Resources:

Hui Chen on Law360 (sub req’d)

Tom

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Tags DOJ, DPA, Hui Chen, NPA, self disclosure

Blog

John Locke and the Legitimacy of Compliance Governance

Post author By Admin
Post date April 29, 2026
No Comments on John Locke and the Legitimacy of Compliance Governance

We continue our exploration of Enlightenment Thinkers to see their influence on modern compliance programs. This week’s category is broader than philosophers, as many of these men excelled in numerous fields such as science, mathematics, calculus, and medicine. However, each contributed a key component that relates directly to our modern compliance regimes. In this post, we consider René Descartes and what he teaches as the next step beyond Bacon: evidence must be examined rigorously.

If Francis Bacon teaches us that compliance must be grounded in evidence, and René Descartes teaches us that evidence must be examined with rigor, John Locke brings us to the next great question: why should anyone trust the system itself? That question sits at the center of every modern compliance program. Employees are asked to report concerns, managers are expected to model ethical behavior, boards are charged with oversight, and companies routinely tell regulators that their compliance program is real, effective, and embedded in the business. But none of that works if the people inside the organization do not believe the system is fair, credible, and worthy of trust. That is why John Locke matters so much to the modern compliance professional.

Locke is often remembered as a philosopher of liberty, consent, rights, and accountable government. He argued that authority is legitimate only when it is exercised responsibly and for the benefit of those subject to it. Power, in Locke’s world, is not self-justifying. It must be bounded, accountable, and tied to obligations. That idea is highly relevant to corporate compliance. A compliance program is not legitimate simply because senior management approved it, or because the board receives quarterly updates, or because policies have been published on an intranet site. It is legitimate when employees experience it as fair, when reports are taken seriously, when retaliation is not tolerated, when discipline is consistent, and when leadership is seen to be accountable to the same standards as everyone else. That is not abstract philosophy. That is compliance governance.

Why Locke Matters to Compliance

Locke’s central insight is that authority derives its legitimacy from responsible exercise and reciprocal obligation. In a political context, that meant government existed to protect rights and serve the governed, not simply to command obedience. In the corporate context, the analogy is not exact, but the lesson is powerful. Employees will not trust a compliance program merely because it exists. They will trust it only if they believe it operates fairly, protects those who raise concerns, applies standards consistently, and treats power as accountable.

This is where Locke helps compliance professionals understand something many organizations still miss. Trust in a compliance system is not automatic. It has to be earned. An employee deciding whether to call a hotline is making a deeply practical judgment. Will anyone listen? Will the matter be reviewed fairly? Will the reporter be protected from retaliation? Will the senior executive who generated the concern be treated differently from everyone else? If the employee believes the answer to those questions is no, the reporting system has already failed, no matter how polished the company’s policy language may be.

The DOJ’s Compliance Expectations Are About Legitimacy

The Department of Justice does not use the language of social contract theory, but its Evaluation of Corporate Compliance Programs (ECCP) is filled with Locke’s concerns. The ECCP asks whether the program is well-designed, applied in good faith, and works in practice. It asks about tone at the top and tone in the middle. It asks whether reporting mechanisms are trusted, whether investigations are handled properly, whether discipline is applied consistently, and whether there is protection against retaliation. Those are all questions of legitimacy. A compliance program that employees do not trust cannot work in practice.

This point is critical because too many organizations still frame culture as something soft and secondary, a matter of messaging rather than system design. Locke would reject that categorically. In his framework, legitimacy is not a decoration added to authority. It is what makes authority durable and acceptable. In a company, that means culture and governance cannot be separated. Speak-up systems, fair treatment, board attention, transparent escalation, and consistent discipline are not peripheral to compliance. They are core structural elements of it.

Speak-Up Culture Is a Test of Governance

Few areas of compliance reveal Locke’s relevance more clearly than a speak-up culture. Every company says it wants employees to raise concerns. Every company says it prohibits retaliation. But the real issue is whether employees believe those statements are true in lived experience. That belief is shaped more by organizational behavior than by slogans.

If employees see complaints buried, if they watch high performers protected despite repeated concerns, if they hear that reporting a problem is career-limiting, or if they conclude that management is more interested in identifying the reporter than addressing the underlying issue, the company has lost legitimacy. In Lockean terms, authority has ceased to be trustworthy because it is no longer being exercised for the benefit of those subject to it.

This is why non-retaliation is so important. It is not simply an employment-law consideration or a human-resources aspiration. It is a governance imperative. Retaliation tells employees that the system serves power rather than principle. Once that lesson is absorbed, reporting declines, silent resignation grows, and risk moves underground. A company may still claim to have a hotline, but it no longer has a functioning speak-up culture.

Fairness Is Not Soft. It Is a Control.

Locke also helps us understand the role of fairness in a compliance program. In many organizations, fairness is discussed as a value. It should be discussed as a control. Why? Because fairness shapes behavior. When employees believe standards will be applied consistently, they are more likely to follow them, more likely to report deviations, and more likely to trust the company’s response when issues arise. When employees believe discipline is arbitrary, selective, or influenced by rank and revenue generation, the opposite occurs. Cynicism spreads quickly. Policies become performative. Reporting drops. Informal norms replace formal standards.

That is why the ECCP pays so much attention to disciplinary consistency. Regulators understand that a compliance program loses credibility when senior leaders are treated differently from line employees. Locke would have recognized the point immediately. In any system of authority, legitimacy is undermined when rules are used to bind the weak but not the powerful.

Board Oversight and Accountable Authority

Locke’s philosophy is equally useful when thinking about board oversight. He believed that those entrusted with authority must remain accountable for how they exercise it. That is a principle every board member should understand in the context of compliance.

Board oversight is not merely about receiving information. It is about ensuring that authority inside the company is properly bounded, monitored, and answerable. The board does not run day-to-day compliance, but it is responsible for ensuring that management has created a system worthy of trust. That means asking whether reporting channels work, whether investigations are independent, whether non-retaliation protections are real, whether major risks are escalated, and whether compliance has stature and access.

This is particularly important because boards sometimes fall into the trap of treating compliance as a downstream operational matter. Locke would have viewed that as a category mistake. Governance is not something separate from legitimacy. Governance is how legitimacy is maintained.

For the modern board, that means compliance oversight must be substantive. Directors should ask not only for dashboards, but for explanations. How does management know employees trust reporting channels? What evidence supports claims of a strong culture? How is middle management assessed? What happens when senior leaders are implicated? What trends in reporting, substantiation, retaliation, and discipline should concern the board? Those questions move oversight from ceremonial to real.

In that sense, Locke also speaks directly to Caremark-era expectations. Directors have obligations not simply to exist, but to oversee. A board that does not ensure the company has credible systems of information and response is not exercising accountable authority. It is abdicating it.

Culture and the Middle Management Problem

No discussion of compliance legitimacy would be complete without examining middle management. The DOJ, in both the ECCP and the FCPA Resource Guide, 2nd edition, has long emphasized that “tone at the top” is not enough. Tone in the middle matters enormously, because employees experience the company most directly through their immediate supervisors.

This is another place where Locke offers real insight. In any system of authority, legitimacy rises or falls through those who exercise power closest to the governed. If middle managers pressure employees to ignore controls, discourage escalation, roll their eyes at compliance training, or quietly punish bad news, the company’s formal commitments will collapse in practice.

This is why companies must treat middle management behavior as a governance issue. Are managers trained not just on rules, but on their duty to support reporting and ethical decision-making? Are they evaluated on how they build culture? Do promotion and bonus structures reinforce ethical leadership, or only financial performance? Are there consequences when managers create pressure that undermines compliance expectations?

These are not marginal considerations. They are central to whether the compliance program is experienced as legitimate in daily operations. Locke reminds us that people judge institutions less by official declarations than by how authority is exercised.

The Compliance Officer as Steward of Institutional Legitimacy

Locke casts the compliance officer as a steward of institutional legitimacy. That is an important and underappreciated role. The compliance officer helps the company earn trust, not through public relations, but through structure, fairness, and accountability. The compliance officer helps ensure that when people speak up, they are heard; when misconduct occurs, it is handled consistently; when leaders exercise authority, they do so under standards that bind them as well. In this sense, compliance is not just about preventing legal violations. It is about making the institution worthy of confidence.

That is why legitimacy matters so much. A company with high trust in its compliance system detects issues earlier, responds more effectively, learns more quickly, and sustains a stronger ethical culture over time. A company without that trust becomes opaque to itself. Risk goes silent. Problems surface late. Governance becomes reactive. The institution loses one of its most important defenses: its own people’s willingness to tell it the truth.

Five Lessons Learned for the Modern Compliance Professional

First, a compliance program must be legitimate to be effective. Employees must believe the system is fair, credible, and trustworthy.

Second, speak-up culture is a governance test. Reporting mechanisms only work when employees believe concerns will be taken seriously and retaliation will not follow.

Third, fairness is a control. Consistent discipline, equal treatment across levels of seniority, and transparent standards strengthen compliance credibility.

Fourth, boards must exercise accountable oversight. They should test management’s claims about culture, reporting, and non-retaliation with real evidence.

Fifth, middle management is where legitimacy lives or dies. A company must align manager incentives, expectations, and accountability with its compliance values.

Coming Next: Thomas Hobbes and Why Every Compliance Program Needs Order

If John Locke teaches us that compliance governance must be legitimate, Thomas Hobbes will remind us that legitimacy alone is not enough. A company also needs structure, clear rules, assigned authority, escalation pathways, and credible enforcement. In Part 4, I will explore how Hobbes helps explain the roles of policies, procedures, internal controls, and operational discipline in a best-practices compliance program. Trust matters, but so does order.

Tags CCO authority, culture, DOJ, ECCP, FCPA Resource Guide, Institutional Justice and Institutional Fairness, John Locke, Speak Up

Blog

René Descartes and the Discipline of Internal Investigation

Post author By Admin
Post date April 28, 2026
No Comments on René Descartes and the Discipline of Internal Investigation

This week, we are moving to Enlightenment Thinkers to see their influence on modern compliance programs. This week’s category is broader than philosophers, as many of these men excelled in numerous fields such as science, mathematics, calculus, and medicine. However, each contributed a key component that relates directly to our modern compliance regimes. In this post, we consider René Descartes and what he teaches as the next step beyond Bacon: that evidence must be rigorously examined.

If Francis Bacon taught us that a compliance program must be grounded in evidence, René Descartes teaches the next step: evidence must be examined with rigor. That is why Descartes is the natural second installment in this series on what Enlightenment thinkers can teach us about modern corporate compliance. Bacon gave us empiricism. Descartes gives us a method. Bacon tells us to look. Descartes tells us how to think about what we find.

For the compliance professional, that is no small matter. Modern compliance programs do not fail only because they lack information. They often fail because organizations do not ask the right questions, challenge convenient assumptions, or investigate troubling facts with sufficient discipline. A hotline report comes in, and management prematurely dismisses it. A financial anomaly is explained away because the business result looks attractive. A third-party red flag is rationalized because the market opportunity seems too important to slow down. In each case, the problem is not simply a lack of data. The problem is a lack of disciplined inquiry.

That is where Descartes has something important to say to the modern Chief Compliance Officer.

Why Descartes Matters to Compliance

René Descartes is best known for methodical doubt. He believed that if one wanted to arrive at reliable knowledge, one had to strip away weak assumptions and test what could be known. He did not advocate doubt for its own sake. He advocated doubt as a disciplined tool, a way to avoid error and reach sound conclusions. His method required breaking problems into parts, analyzing them carefully, proceeding in an orderly manner, and ensuring nothing important was overlooked. That is remarkably close to what an effective compliance investigation function should do.

The compliance professional cannot assume an allegation is false because it is inconvenient. Nor can one assume it is true because it is emotionally compelling. The task is to examine. What happened? Who knew what, and when? What documents exist? What controls should have operated? Where are the inconsistencies? What explanation fits the evidence, and what explanation merely sounds comforting? Descartes would have recognized this immediately. A sound conclusion requires method, not instinct.

In a corporate environment, that is especially important because organizations are full of narratives. Managers tell stories about performance. Employees tell stories about why something was necessary. Third parties tell stories about local customs or business necessities. The compliance function should listen, but it cannot stop there. It must test those stories against facts.

The DOJ Expects More Than a Quick Answer

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) does not use philosophical language, but its expectations align closely with Cartesian thinking. The ECCP asks whether investigations are properly scoped, whether the company has adequate resources to conduct them, whether the company preserves and analyzes relevant data, whether reporting structures support independence, and whether lessons learned are used to improve the compliance program. That is not a request for superficial closure. It is a demand for disciplined inquiry.

The ECCP is not interested in whether a company can produce a memo that says the matter has been reviewed. It wants to know whether the review was credible. Did the company ask hard questions? Did it follow the evidence even when the evidence was uncomfortable? Did it look at underlying causes or accept a narrow explanation that minimized institutional responsibility? These are Descartes’ questions as much as the DOJ’s.

Method Beats Reaction

One of the most important lessons Descartes offers is that method matters more than reaction. Too many organizations still respond to reports of misconduct in an ad hoc fashion. The identity of the reporter, the subject’s seniority, or the business sensitivity of the issue can distort the process from the outset. Some matters are overreacted to because they are visible. Others are under-investigated because they are politically awkward. That is not a system. That is improvisation. A mature compliance program requires a clear, repeatable investigative method.

That begins with triage. Allegations should be assessed based on risk, scope, subject matter, and potential impact. Matters involving senior leadership, financial controls, corruption risk, retaliation, or systemic process failures may require immediate escalation and greater independence. Low-risk issues may still require attention, but not every matter needs the same level of response. Cartesian thinking does not mean treating every problem identically. It means applying a coherent method to determine what level of inquiry is warranted.

From there, the matter should be broken down into manageable components. What is the allegation? What business process is implicated? What documents are likely relevant? Who are the key custodians? What data sources exist? What is the working timeline? What controls should have operated? What policy provisions may have been implicated? This is classic Descartes: divide complex problems into smaller parts so they can be understood.

Disciplined Skepticism Is a Compliance Strength

Compliance professionals sometimes worry that skepticism will be perceived as mistrust. But disciplined skepticism is not cynicism. It is not hostility. It is professional rigor. It is the recognition that people often explain events in self-protective ways, that organizations prefer neat stories to messy truths, and that important facts are often buried inside routine processes. Descartes would have understood that skepticism is a necessary safeguard against error.

Consider a common internal reporting scenario. A manager says that a questionable payment was simply an administrative oversight. Perhaps that is true. But a compliance professional guided by Descartes would ask several follow-up questions. Was it really isolated? Have similar payments occurred before? Were approval thresholds bypassed? Was the vendor properly vetted? Were invoice descriptions vague or coded? Did someone raise concerns earlier? Was the explanation consistent across all available records? None of those questions accuse. They clarify.

Documentation Turns Inquiry Into Credibility

Another Cartesian lesson for compliance is the importance of orderly reasoning. An investigation cannot simply be sound in substance. It must also be documented in a way that shows how the conclusion was reached. This is essential for institutional memory, for regulatory defensibility, and for credibility with boards and senior management.

A well-documented investigation answers basic but vital questions. What was alleged? Who handled the matter? What evidence was reviewed? Which witnesses were interviewed? What facts were established? What policy or control failures were identified? What conclusion was reached, and why? What remediation followed? This kind of documentation is not bureaucratic excess. It is proof of intellectual discipline.

Without it, the company cannot show that it acted reasonably. It cannot identify patterns across matters. It cannot demonstrate consistency. It cannot revisit earlier decisions when new facts emerge. Most importantly, it cannot turn an individual case into organizational learning. Descartes’ method was about structured thinking. In corporate compliance, documentation is how structured thinking becomes durable.

Independence Matters When the Facts Get Uncomfortable

No discussion of investigations would be complete without addressing independence. The most elegant methodology in the world will not help if investigators are pressured to protect favored executives, minimize business disruption, or avoid awkward findings. Cartesian rigor requires a willingness to follow the facts wherever they lead. That, in turn, requires real autonomy.

The ECCP addresses this directly through its focus on stature, authority, resources, and access. Can the compliance function investigate senior personnel? Can it escalate concerns to the board or audit committee when necessary? Is it empowered to challenge management narratives? These are not secondary governance questions. They are central to whether the investigation process can produce reliable conclusions.

There is a reason so many compliance failures involve not merely misconduct, but management interference with the review of misconduct. When power shapes the investigation, facts become negotiable. Descartes would have seen that as a fundamental corruption of method.

Investigations Must Lead to Remediation

A Cartesian compliance program does not end with a finding. It asks what the finding means for the system. That is why investigations must connect to remediation and root cause analysis. If an allegation is substantiated, the question is not simply who violated what rule. The question is what enabled the failure.

Was the training insufficient? Were incentives pushing employees toward bad decisions? Was a manager creating pressure that undermined ethical judgment? Did the approval process invite shortcuts? Was the policy too vague to guide real-world conduct? These questions push the company from conclusion to improvement.

This is where Descartes connects back to Bacon. Bacon teaches that we need evidence. Descartes teaches that we must reason carefully from the evidence. Together, they create a powerful model for compliance effectiveness. The company observes, investigates, documents, learns, and improves.

The Compliance Officer as a Guardian of Clear Thinking

If Bacon cast the compliance officer as an institutional scientist, Descartes casts the compliance officer as a guardian of clear thinking. In a corporation full of pressure, narrative, hierarchy, and urgency, that role is vital. Someone must insist that facts be tested, that assumptions be challenged, that conclusions be explained, and that the process remain disciplined when the easier path is to settle for a quick answer.

That is not merely an investigative skill. It is a governance function. It protects employee fairness, the board’s credibility, and the company’s defensibility. It also builds trust over time, because people learn that reports are taken seriously, that outcomes are reasoned rather than political, and that the system values truth over convenience.

René Descartes may seem an unlikely guide for corporate compliance. Yet his method of doubt, order, and careful reasoning belongs squarely within the modern best-practices compliance program. In an era where companies are judged not simply on whether they responded, but on how they responded, Descartes offers an enduring lesson: clear thinking is a control.

Five Lessons Learned for the Modern Compliance Professional

First, allegations should trigger a method, not a reaction. A repeatable investigative framework reduces bias and improves consistency.

Second, disciplined skepticism is a professional obligation. Compliance must test explanations against facts rather than accept convenient narratives.

Third, complex matters should be broken into parts. Scoping, evidence review, interviews, control mapping, and timeline construction all improve rigor.

Fourth, documentation is essential. It is how the company proves that its inquiry was credible and how it preserves institutional learning.

Fifth, an investigation is not complete until it informs remediation. Findings should lead to enhancements in control, policy changes, training updates, or broader governance improvements.

Coming Next: John Locke and the Legitimacy of Compliance Governance

If Francis Bacon teaches us to gather evidence and René Descartes teaches us to examine it rigorously, John Locke asks an equally important question: why should anyone trust the system in the first place? In Part 3, I will explore how Locke’s ideas about legitimacy, rights, and accountable authority provide a powerful framework for speak-up culture, non-retaliation, fairness, and board oversight. In the world of compliance, authority alone is never enough. It must also be credible.

Tags CCO, compliance, DOJ, ECCP, investigations, René Descartes, triage

2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 75 – The End of White Collar Edition

Post author By Admin
Post date April 24, 2026
No Comments on 2 Gurus Talk Compliance – Episode 75 – The End of White Collar Edition

What happens when two top compliance commentators get together? They talk compliance, of course. Join Tom Fox and Kristy Grant-Hart in 2 Gurus Talk Compliance as they discuss the latest compliance issues in this week’s episode!

Stories this week include:

The Trump Administration retreats on white-collar crime. (The Dispatch)
Live Nation found guilty of monopolization. (WSJ)
White-collar defense lawyers are not busy under the Trump Administration. (FT)
Former LaFarge CEO guilty in corruption case. (Bloomberg)
How much does the Annoyance Economy cost you? (NYT)
Justice Department Nears Filing Antitrust Case Against Egg Producers (WSJ)
$253M Settlement Raises the Bar on Re-Exports, ‘Dual‑Build’ Models & Entity List Risk (Corporate Compliance Insights)
The foundational importance of export jurisdiction – Corporate Compliance Insights
‘Made in America’ Compliance! (Radical Compliance)
The Compliance Blind Spots Hiding Inside Financial Data (Corporate Compliance Insights)
Key West man accused of shining laser gloves into police cars faces 3 felonies

Resources:

Kristy Grant-Hart on LinkedIn

Order Kristy’s updated, 10-year new edition of How to Be a Wildly Effective Compliance Officer by clicking here.

Tom

Tags Annoyance Economy, CCI, DOJ, Export Controls, Florida Man, Key West, Lafarge, Live Nation, Trump Adminstration, white-collar crime

Blog

Preventing Strategy Outrunning Governance in AI

Post author By Admin
Post date April 13, 2026
No Comments on Preventing Strategy Outrunning Governance in AI

One of the clearest AI governance challenges facing companies today is not a failure of ambition. It is a failure of pacing. Put simply, strategy is moving faster than governance. Business teams want results. Senior executives hear daily about efficiency gains, lower costs, faster decision-making, enhanced customer engagement, and competitive advantage. Vendors are more than happy to promise it all. Employees are already experimenting with AI tools on their own. In that environment, the pressure to move quickly is relentless.

That is where the compliance function must step forward. Not to say no. Not to slow innovation for the sake of slowing it. But to ensure that innovation moves with structure, discipline, and accountability. Governance is not the enemy of AI strategy. Governance is what allows an AI strategy to scale without becoming an enterprise risk event.

The Central Question for Boards and CCOs

For boards, Chief Compliance Officers, and business leaders, the central question is straightforward: has the company defined the rules of the road before putting AI into production? If the answer is no, the company is already behind.

This is not a theoretical problem. It is happening every day. A business unit buys an AI-enabled tool before legal, compliance, IT, privacy, and security have reviewed it. A vendor pitches a product as low-risk automation, even though it actually makes consequential recommendations. An employee uploads sensitive data into a generative AI platform for convenience. A use case that began as internal support quietly migrates into customer-facing decision-making. A pilot project becomes business as usual without anyone documenting who approved it, what risks were considered, or what human oversight is supposed to look like.

That is what it means when strategy outruns governance. The business has a faster process for adopting AI than it has for understanding, controlling, and monitoring AI risk.

What the DOJ Expects

The Department of Justice has been telling compliance professionals for years that an effective compliance program must be dynamic, risk-based, and integrated into the business. That lesson applies directly here. Under the ECCP, prosecutors ask whether a company has identified and assessed its risk profile, whether policies and procedures are practical and accessible, whether responsibilities are clearly assigned, whether decisions are documented, and whether the program evolves as risks change. AI governance sits squarely in that framework.

What “Rules of the Road” Means in Practice

What do the “rules of the road” look like in practice?

First, the company must define which AI use cases are permissible. These are lower-risk applications that can be used within established controls. Think internal drafting support, workflow automation for non-sensitive administrative tasks, or summarization tools used on approved data sets. Even here, there should be basic conditions: approved tools only, no confidential data unless authorized, user training, logging, and manager accountability.

Second, the company must identify restricted or high-risk use cases. These are situations where AI may be allowed, but only after enhanced review. This can include uses involving personal data, HR decisions, customer communications, pricing, fraud detection, credit or eligibility decisions, compliance surveillance, or any function where bias, opacity, or error could create legal, regulatory, or reputational harm. These use cases should trigger a more formal process that includes a documented risk assessment, legal and compliance review, data governance checks, testing, defined human oversight, and ongoing monitoring.

Third, the company must be clear about prohibited use cases. If an AI application cannot be used consistently with the company’s values, control environment, legal obligations, or risk appetite, it should be off-limits. That might include tools that process sensitive data in unapproved environments, systems that make fully automated consequential decisions without human review, or applications that cannot be explained, tested, validated, or monitored sufficiently for their intended use.

Fourth, the company must establish escalation thresholds. Not every AI decision belongs at the board level, but some certainly do. Use cases involving strategic transformation, material legal exposure, major customer impact, significant third-party dependency, or high-consequence decision-making may need escalation to senior management, a designated AI or risk committee, or the board itself. If management cannot explain when a matter gets elevated, governance is too vague to be trusted.

Why the NIST AI RMF Matters

This is where the NIST Framework is so useful. NIST does not treat AI governance as a one-time signoff exercise. It organizes governance as an ongoing discipline through four connected functions: Govern, Map, Measure, and Manage. For compliance professionals, that is a practical operating model.

Governance means setting accountability, policies, oversight structures, and risk tolerances. It answers who is responsible, who decides, and what standards apply. A map means understanding the use case, context, stakeholders, data, and risks. It answers what the system is actually doing and where exposure lies. Measure means testing, validating, and assessing performance and controls. It answers whether the system works as intended and whether the company can prove it. Managing means acting on what is learned through oversight, remediation, change management, and continual improvement. It answers whether the company is prepared to respond when reality diverges from the plan.

How ISO 42001 Reinforces Governance Discipline

ISO 42001 reinforces the same message from a management systems perspective. It brings structure, accountability, controls, and continual improvement to AI governance. That matters because many organizations do not fail because of a lack of policy language. They fail because they do not operationalize accountability. ISO 42001 pushes companies to embed AI governance into defined processes, assign responsibilities, document controls, conduct internal reviews, and take corrective action. In other words, it turns aspiration into a management discipline.

What Happens When Strategy Outruns Governance

What happens when none of this is done well?

Shadow AI is usually the first warning sign. Employees use public or lightly reviewed tools because they are easy to use, fast, and readily available. Sensitive data may be entered without approval. Outputs may be used in business decisions without validation. The organization tells itself it is still in the experimentation phase, while the risk has already gone live.

Vendor-driven deployment is another danger. The company relies too heavily on what the vendor says the product can do and not enough on its own evaluation of what the product should do, how it works, what data it uses, and what controls are required. When something goes wrong, accountability becomes murky. Procurement says the business wanted speed. The business says IT approved the integration. IT says legal reviewed the contract. Legal says compliance owns the policy. Compliance says no one submitted the use case for formal review. That is not governance. That is institutional finger-pointing.

Undocumented approvals are equally dangerous. An AI tool is launched because everyone generally agrees it seems useful. But there is no record of the intended purpose, risk rating, required controls, human review standard, or approval rationale. Six months later, the company cannot explain why the system was deployed, what guardrails were put in place, or whether its use has drifted beyond its original scope.

The Compliance Mechanisms Companies Need Now

That is why companies need concrete compliance mechanisms now. They need an intake process for AI use cases to enter a formal review channel before deployment. They need risk tiering so not every use case gets the same treatment, but higher-risk applications receive enhanced scrutiny. They need approval workflows with defined roles for the business, legal, compliance, privacy, security, IT, and, where appropriate, model risk or internal audit. They need board reporting triggers to inform leadership when AI adoption crosses materiality or risk thresholds. They need a current model and use-case inventory so the company knows what is in operation. They need change management, so updates, retraining, vendor changes, and scope shifts are reviewed rather than assumed. And they need periodic review because AI risk does not stand still after launch.

The Special Role of Compliance

The compliance professional has a special role here. Compliance is often the function best positioned to connect governance, process, accountability, documentation, and escalation. That is precisely what the DOJ expects in an effective program. If the company can buy AI faster than it can classify risk, document controls, assign accountability, and test outcomes, the program is not keeping pace with the business. That gap will not stay theoretical for long. It will harden into enterprise risk.

Conclusion: Governance Must Keep Pace With Strategy

The lesson is direct. Strategy and governance must move together. AI governance is not a brake pedal. It is the steering system. A company that wants the benefits of AI must be disciplined enough to define where AI can go, where it cannot go, who decides, what gets documented, and when the business must stop and reassess. If the company can move faster on AI strategy than on AI governance, it is creating risk faster than it can manage. That is not innovation. That is exposure.

Tags 2024 ECCP, AI Governance, compliance, DOJ, ECCP, ISO 42001, NIST AI Framework

Blog

Balt and the New DOJ CEP: Why Individual Facts Now Drive Corporate Leniency

Post author By Admin
Post date April 1, 2026
No Comments on Balt and the New DOJ CEP: Why Individual Facts Now Drive Corporate Leniency

Under the Department of Justice’s (DOJ) updated Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), the practical bargain is now unmistakable. A company can earn extraordinary leniency, including a Declination, but only if it surfaces the facts about individual misconduct early, completely, and credibly. Balt is not simply an FCPA declination story. It is a case study in how modern DOJ enforcement expects compliance, legal, internal audit, and investigations teams to work when misconduct is uncovered.

For years, the DOJ has said that corporate cooperation must be meaningful. Under the new CEP, DOJ has made that concept more concrete and more demanding. The CEP says it is designed not only to drive early voluntary self-disclosure, but also to promote timely enforcement, “including holding culpable individuals accountable.” It also makes clear that a company earns a declination only if it voluntarily self-discloses, fully cooperates, timely and appropriately remediates, and has no disqualifying aggravating circumstances. That is the legal architecture. Balt shows the operating reality.

The Balt matter has become important because it is the first FCPA declination under the Department’s updated CEP. DOJ declined to prosecute Balt SAS after the company self-disclosed, cooperated, remediated, and disgorged $1.2 million. At the same time, the DOJ indicted two individuals, David Ferrera and Marc Tilman, for conspiracy to violate the FCPA, substantive FCPA violations, conspiracy to commit money laundering, and international promotional money laundering. Assistant Attorney General Tysen Duva made the message plain: the resolution demonstrated the value of voluntary self-reporting, and the related indictment demonstrated DOJ’s “unwavering pursuit of culpable individuals.”

That is the bargain in plain English. The company may get mercy. The individuals do not. This is not accidental. The updated CEP expressly says a company fully cooperates when it timely, truthfully, and accurately discloses all relevant facts and non-privileged evidence, including facts gathered in the internal investigation, facts about all individuals involved in or responsible for the misconduct, regardless of status or seniority, attribution of facts to specific sources rather than a generalized narrative, and rolling updates during the investigation. It also requires proactive cooperation, the preservation and production of documents, and the availability of knowledgeable personnel for interviews.

In other words, DOJ is not looking for a company to arrive with a polished memo that says, “We found misconduct, we are sorry, and we fixed it.” DOJ wants the names, the messages, the invoices, the custodians, the timeline, the payment path, and the evidence that ties specific people to specific acts. That is the heart of the new bargain.

Balt is such a useful case study because the individual indictment shows exactly the kind of facts DOJ expects a company to surface. According to the indictment, Ferrera was a senior executive of the U.S. subsidiary, and Tilman owned and operated the Belgian consulting company used in the scheme. Both allegedly stood to gain millions in milestone payments tied to future sales. The indictment further alleges that they conspired from 2017 into September 2023 to bribe a physician employed by CHU Reims, a French state-owned public hospital treated as an instrumentality of a foreign government under the FCPA.

The indictment then lays out the mechanics. Medical Company #2 allegedly used sham consulting agreements, fake invoices, and purported bonus payments to move money to Tilman’s Belgian consulting company, which in turn paid the foreign official through accounts in France. Prosecutors also allege concealment through personal email accounts, encrypted messaging applications, and coded language such as “training,” “bonuses,” and “our friend.” Those are not abstract compliance failures. Those are granular individual facts.

The overt acts alleged in the indictment show why DOJ cares so much about speed and specificity. One 2017 message allegedly said, “Regarding the €€ for our friend, I have a plan.” Another used a private email account for the foreign official and proposed a fake invoice for a two-day sales and marketing session. Ferrera allegedly replied, “That’s acceptable. Please send this to me.” Later communications referenced “No more fake training courses” and described a new bonus as “a CAMOUFLAGE.” The indictment also ties the scheme to specific wire transfers from the United States to Belgium and onward payments into France.

This is the modern FCPA file. It is built from chats, invoices, routing, motive, and attribution. That is why the updated CEP stresses not a general narrative of facts, but facts attributed to specific sources and individuals. The practical implications for compliance and investigations teams are significant.

First, self-disclosure now must be viewed as an investigative decision, not solely a legal one. The updated CEP expressly encourages disclosure at the earliest possible time, even when a company has not completed its internal investigation. It defines voluntary self-disclosure to include reasonably prompt reporting before an imminent threat of government discovery. Balt appears to have done exactly that. The French resolution disclosed that Balt self-disclosed while the internal investigation was still ongoing. That is a critical point because it shows that DOJ is willing to reward a company that comes in before it has all the answers, provided the company follows through with real facts and real cooperation.

Second, cooperation credit is no longer a soft concept. The CEP says a company starts at zero cooperation credit and earns it through specific actions. A company that fails to demonstrate full cooperation at the earliest opportunity may reduce its ability to earn that credit. That should change how legal, audit, and investigations teams think about triage. The early questions are no longer: Did something happen? How much did it cost? The questions are: Who did it? Who approved it? Who benefited? What records exist? What devices hold the communications? Can we preserve them now?

Third, internal investigations must be built for prosecutorial usefulness. Under the CEP, DOJ expects disclosure of overseas documents, provenance, custodians, authors, translations where needed, and even identification of opportunities for the Department to obtain evidence that the company does not possess. If your investigation cannot map the facts to sources, or if your team cannot move quickly across borders, you are not simply conducting a weak internal review. You may be forfeiting declination-level credit.

Fourth, remediation still matters, but it is not enough without individual accountability. The CEP defines timely and appropriate remediation to include root cause analysis, an effective compliance and ethics program, appropriate discipline of responsible employees and supervisors, and proper controls on personal communications and messaging applications. Balt reportedly received credit for separation from Ferrera and Tilman, tailored compliance training for senior management, and remediation of internal control shortcomings. Once again, the lesson is direct. DOJ is not handing out credit for beautiful PowerPoint slides. It is rewarding companies that can show they identified the bad actors, removed them, and strengthened the system in the wake of the failure.

Fifth, the new CEP creates a sharper internal challenge for multidisciplinary teams. Compliance may identify the risk. Legal may control privilege and disclosure strategy. Internal audit may reconstruct the payments. Investigations may chase the communications. But under the new bargain, those functions cannot operate in silos. DOJ expects a company to come forward with a coherent body of attributed facts about individuals. If those teams are not integrated, the company will struggle to earn maximum credit.

This is why Balt should be read as more than a favorable corporate outcome. It is a warning shot and a roadmap. The warning is that DOJ’s focus on individual accountability is real, operational, and evidence-driven. The roadmap is that companies can still earn remarkable leniency if they move quickly, fully cooperate, and help prosecutors build the case against the responsible individuals.

For compliance professionals, that means the old debate is over. There is no longer much room for vague institutional cooperation. Under the updated CEP, the company’s path to leniency runs through facts about people. That is the trade. That is the CEP. Balt is what it looks like in practice.

5 Key Takeaways

The new DOJ bargain is now unmistakable. Companies earn leniency by surfacing facts about individuals early, completely, and credibly.
Balt is the proof point. The company received the first FCPA declination under the updated CEP while DOJ simultaneously indicted Ferrera and Tilman.
Cooperation now means attributed facts, not general narratives. DOJ expects facts tied to specific individuals, sources, documents, and custodians, as well as rolling updates on the investigation.
Speed is strategic. The CEP encourages self-disclosure even before an internal investigation is complete, and Balt appears to have benefited from doing just that.
This is a team sport. Compliance, legal, internal audit, and investigations must work as a single, integrated fact-gathering function if a company hopes to earn the maximum CEP credit.

Tags Balt, CEP, declination, DOJ, FCPA

Blog

The Balt Individuals Indictment: How Corruption Actually Works

Post author By Admin
Post date March 31, 2026
No Comments on The Balt Individuals Indictment: How Corruption Actually Works

The corporate resolution in Balt received the headlines. The individual Indictment tells the deeper compliance story. In the charges against David Ferrera and Marc Tilman, prosecutors laid out a familiar but highly instructive playbook: business pressure, personal financial incentives, sham consulting arrangements, coded language, off-channel communications, false invoices, and cross-border wire transfers. For compliance professionals, this is the anatomy of misconduct in real time.

One of the most important lessons in any FCPA matter is that companies do not commit crimes. People do. Systems may be weak, controls may be poorly designed, and incentives may be misaligned. But in the end, individuals make decisions. That is why the indictment of David Ferrera and Marc Tilman in the Balt matter deserves careful study.

The indictment alleges that Ferrera, a United States citizen, was a senior executive of Balt’s U.S. subsidiary and an owner of the predecessor company. In contrast, Tilman, a Belgian citizen, owned and operated the consulting company used in the scheme and was also an owner of the predecessor company. Prosecutors further alleged that both men stood to gain millions in milestone payments tied to future sales of the company’s products. Their alleged conduct was directed toward a physician employed by CHU Reims, a French state-owned and state-controlled public university hospital, which the indictment treats as an instrumentality of a foreign government, making the physician a foreign official for FCPA purposes.

That framing matters because it puts this case squarely in the mainstream of modern FCPA enforcement. This is not a suitcase full of cash, slipped across a hotel room table. It is a sales-driven bribery scheme allegedly dressed up as legitimate business activity.

The Charges Brought Against Ferrera and Tilman

The indictment charges both Ferrera and Tilman with six criminal counts and forfeiture allegations.

Count One charges conspiracy to violate the FCPA under 18 U.S.C. § 371. Prosecutors allege that from 2017 through September 2023, the two men conspired to offer, promise, authorize, and route money and things of value to a foreign official to influence decisions, secure an improper advantage, and obtain or retain business.

Counts Two and Three are substantive FCPA charges under 15 U.S.C. § 78dd-2 and aiding and abetting under 18 U.S.C. § 2. These counts are tied to two specific wire transfers: approximately €20,000 on July 30, 2019, and approximately €25,000 on October 28, 2019, each sent from Balt USA’s bank account in the United States to the consulting company’s bank account in Belgium. Prosecutors allege that these payments were made corruptly and in furtherance of bribes to the foreign official.

Count Four charges conspiracy to commit money laundering under 18 U.S.C. § 1956(h). The indictment alleges that Ferrera and Tilman agreed to move funds from the United States to Belgium to promote specified unlawful activity, namely FCPA violations and bribery-related offenses under French law.

Counts Five and Six are substantive international promotional money laundering charges under 18 U.S.C. § 1956(a)(2)(A), again tied to specific wire transfers: approximately €25,000 on January 31, 2020, and approximately €38,500 on April 21, 2020, sent from Balt USA in the United States to the consulting company in Belgium. Prosecutors allege that these transfers were intended to promote the ongoing bribery scheme.

Finally, the indictment includes forfeiture allegations. Upon conviction, prosecutors seek forfeiture of property traceable to FCPA offenses and to money laundering offenses, including a forfeiture money judgment representing the proceeds obtained from the alleged misconduct. That is the charge sheet. But the compliance lessons come from how the scheme allegedly worked.

How the Conduct Was Allegedly Carried Out

The indictment alleges that Ferrera and Tilman used a classic intermediary structure. Balt USA allegedly paid Tilman’s Belgian consulting company through sham consulting agreements, fake invoices, and purported bonus payments, and Tilman then routed the funds onward to the foreign official’s accounts in France. The French order adds that the consultant’s company was used to conceal the relationship with the physician, that the physician’s invoices lacked meaningful detail, and that two false invoices were issued in 2017 and 2018, the second of which was blocked by finance due to irregularities.

The overt acts alleged in the indictment are especially revealing. Prosecutors quote messages about “€€ for our friend,” private email use, and a proposed fake invoice for a “2-day sales and marketing session.” They also quote Tilman, suggesting, “No more fake ‘training courses’” and referring to a new “bonus” as “a CAMOUFLAGE.” The indictment also alleges that Ferrerra approved the arrangement, replying to one email, “That’s acceptable. Please send this to me.”

This is why I always tell compliance professionals that misconduct rarely hides in one dramatic act. It hides in language, process, and paperwork. It hides in euphemisms. It hides in rushed approvals. It hides in consultants whose compensation structure makes no business sense. It hides in payments that look close enough to ordinary commerce to escape attention unless someone asks one more question.

The indictment also alleges direct business leverage. One message attributed to Tilman said that if a Balt finance employee did not wire €25,000 that day, he would tell the foreign official “to stop everything.” If that allegation is true, it is a flashing red light from a compliance perspective. It suggests the payment stream was not peripheral to the sales effort. It was the mechanism by which the business was being maintained.

What Ferrera and Tilman Allegedly Did Wrong

From a compliance standpoint, their alleged actions fall into five familiar categories.

First, they allegedly used an intermediary as a conduit. The consulting company was not merely a vendor risk issue. It was allegedly the vehicle used to transfer funds from the company to the foreign official.

Second, they allegedly papered over bribery with false business justifications. Sham consulting agreements, fake invoices, and disguised bonuses are not accounting defects. They are corruption mechanics.

Third, they allegedly moved communications off-channel. Personal email accounts and encrypted messaging applications appear in the indictment for a reason. Prosecutors routinely treat off-channel communications as evidence of concealment when the surrounding facts support that inference.

Fourth, they allegedly used coded language. “Our friend,” “training,” “bonus,” and “camouflage” are the kinds of words that should prompt any investigator to ask whether business language is being used as cover.

Fifth, they allegedly exploited pressure points in the business model. Because both men allegedly had financial upside tied to future sales, the case also highlights the risk of incentives. The indictment expressly alleges that Ferrerra and Tillman stood to gain millions in milestone payments based on future product sales. That does not prove guilt, but it does tell every CCO where to look when incentives, sales growth, and third-party payments start to overlap.

Five Lessons for Chief Compliance Officers

1. Third-party management must go beyond onboarding.

A consultant with vague deliverables, success-linked compensation, and unusual ties to public hospital physicians is not a low-risk intermediary. CCOs need lifecycle monitoring, not just entry-point due diligence.

2. Controls must test the substance, not the paperwork.

A signed contract and an invoice are not evidence that legitimate services occurred. Finance and compliance need procedures to test whether the service actually occurred, whether the deliverable exists, and whether the compensation aligns with market reality.

3. Off-channel communications are a corruption risk indicator.

If business with public officials or healthcare professionals is being discussed on private email or encrypted apps, that should trigger escalation. The issue is not simply records retention. The issue is concealment risk.

4. Incentive compensation needs a compliance review.

When executives or consultants stand to earn substantial milestone payments tied to sales growth, compliance should assess whether that pressure could distort behavior. Sales incentives and corruption risk are often joined at the hip.

5. Finance needs the authority to stop the line.

The French order notes that one false invoice was blocked due to irregularities identified by finance. That is a reminder that finance can be one of the strongest anti-corruption controls in the company if it is trained, empowered, and protected.

Conclusion

The Balt Declination showed what a company can earn through disclosure, cooperation, and remediation. The Ferrera and Tilman Indictment shows the other side of the equation: how the alleged misconduct was actually executed. Prosecutors describe a bribery scheme hidden behind consultants, invoices, coded language, and wire transfers. For compliance professionals, that is the real value of this case. It reminds us that corruption often looks less like a dramatic criminal enterprise and more like ordinary business processes quietly bent out of shape.

Tags AFA, Balt, Balt SAS, Balt US, bribery, corruption, David Ferrerra, DOJ, FCPA, France, Incentive compensation, Internal Controls, Marc Tilman, Off-channel communications

Compliance Into the Weeds

Compliance into the Weeds: Balt and TradeStation: Lessons for the Compliance Professional

Post author By Admin
Post date March 25, 2026
No Comments on Compliance into the Weeds: Balt and TradeStation: Lessons for the Compliance Professional

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly look at the Declination awarded to Balt SAS and the OFAC enforcement action involving TradeStation.

First, they review a Corporate Enforcement Policy declination for French medical-equipment company BAL SAS and the company’s U.S. subsidiary after self-disclosing, cooperating and remediating misconduct involving a U.S. subsidiary executive and a Belgian consultant allegedly funneling about $600,000 in bribes to a French public hospital official using sham consulting agreements, invoices, and poor documentation; BAL disgorged about $1.21 million in profit on roughly $1.68 million in revenue and disclosed while its internal investigation was still ongoing, raising timing and high-margin red-flag issues.

Second, they cover OFAC’s $1.1 million settlement with TradeStation for accidentally disabling sanctions-screening controls for nearly a year, enabling hundreds of transactions from Iran, Syria, and Crimea; despite having layered tools on paper, IT changes and lapsed subscriptions undermined those controls, underscoring the need for ongoing monitoring, testing, and auditing.