Tag: Frankenstein

Categories
Popcorn and Compliance

Popcorn and Compliance: Frankenstein Meets the Wolf Man When Monsters Collide: Compliance and Enterprise Risk

This October, Tom Fox returns to one of his all-time favorite subjects: the Universal Pictures classic monsters. Over the years, he has explored the classics, including Dracula, The Mummy, The Wolf Man, and The Invisible Man, with detours into films by Val Lewton and Hammer Films. This year, Tom takes a deep dive into the first five Frankenstein films. The series has already covered the original Frankenstein, Bride of Frankenstein, Son of Frankenstein, and The Ghost of Frankenstein. The fifth and final episode turns to one of Tom’s favorite horror films of all time, Frankenstein Meets the Wolf Man, released in 1943. Tom’s AI co-hosts, Timothy and Fiona, join him for commentary.

Film Synopsis:

Frankenstein Meets the Wolf Man begins primarily as a continuation of Larry Talbot’s story from The Wolf Man. Talbot, played by Lon Chaney Jr., is resurrected and desperately seeks a way to end his werewolf curse. His search eventually leads him to the ruins of Frankenstein’s castle, where he discovers Frankenstein’s Monster frozen beneath the wreckage and revives him. Dr. Mannering becomes involved in an attempt to cure Talbot while also restoring the Monster to full strength. The inevitable result is the movie’s great selling point: the Wolf Man and Frankenstein’s Monster, now played by Bela Lugosi, finally collide. It was the first Universal film to bring two of its major horror characters together in this fashion.

Key Highlights:

  • Risks do not exist in silos.
  • Risk aggregation belongs in enterprise risk management.
  • AI governance demonstrates the problem perfectly.
  • The CCO should be a connector, not the owner of everything.
  • Boards need to see the entire castle.

Popcorn and Compliance takeaway: The greatest enterprise risk may not be Frankenstein’s Monster or the Wolf Man. It may be what happens when two risks nobody considered together finally collide.

Closing the Popcorn and Compliance Frankenstein Series

Across these five films, we get something remarkably close to the lifecycle of a corporate compliance failure.

Henry Frankenstein creates risk without adequate governance.

In Bride of Frankenstein, leadership knows the danger but succumbs to pressure and ethical compromise.

In Son of Frankenstein, a new generation inherits unresolved legacy risk.

In The Ghost of Frankenstein, supposedly resolved problems return because remediation and controls are ineffective.

Finally, in Frankenstein Meets the Wolf Man, an unresolved risk collides with another risk and becomes an enterprise problem.

That is what makes these movies such fertile territory for Popcorn and Compliance. The Monster is never simply the Monster. He is the product of decisions, incentives, weak controls, poor oversight, inadequate remediation, and leaders who repeatedly convince themselves that this time they can manage the consequences.

For the compliance professional, there may be no better question to take from the entire Universal Frankenstein cycle:

What Monster is your organization creating, inheriting, reviving, or failing to see today?

Timothy and Fiona are AI-generated voices, courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 5 – Frankenstein Meets the Wolf Man: When Monsters Collide

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first four Frankenstein films provide a useful progression for corporate compliance. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands risk but lets pressure and rationalization override judgment. Son of Frankenstein moved to inherited risk and the obligations that arise when new leadership discovers legacy problems. The Ghost of Frankenstein asks whether remediation actually works. 

Frankenstein Meets the Wolf Man (1943) changes the risk equation. There are now two monsters. Larry Talbot, played by Lon Chaney Jr., returns from The Wolf Man seeking a way to end the curse that transforms him into a werewolf. His search eventually brings him to the ruins of Frankenstein’s castle, where he discovers the Monster, played in this film by Bela Lugosi. Talbot revives him, Dr. Mannering becomes involved, and the film eventually delivers what its title promises: Frankenstein’s Monster and the Wolf Man collide.

For corporate compliance professionals, the movie provides a useful way to think about enterprise risk. Organizations necessarily divide risk into categories and assign responsibilities to different functions. Compliance may oversee anti-corruption, sanctions, third-party, antitrust, and other regulatory risks. Information Security manages cyber risk. Privacy oversees data protection. HR manages employment-related risks. Finance owns financial controls. Internal Audit provides assurance. Enterprise Risk Management looks across the organization. 

That structure is necessary. It can also create silos. The most significant corporate risks do not always remain within the categories management assigns to them. They interact. When they do, the resulting exposure may be greater than the organization sees when each risk is assessed independently. The compliance challenge is not simply identifying each monster. It is understanding what happens when they meet.

Risk Does Not Respect the Organizational Chart

Companies assign risk ownership because someone must be accountable. That is good governance. The problem begins when risk ownership becomes information ownership. Consider a third-party distributor operating in a high-risk market. Compliance may identify concerns about the distributor’s beneficial ownership. Finance may identify unusual payment requests. Information Security may detect suspicious access involving the distributor’s credentials. Internal Audit may identify invoice exceptions. Legal may become aware of litigation or regulatory concerns involving related entities. Each function may respond appropriately to the information it possesses.

Yet the organization may still fail if nobody connects those facts. The compliance issue is therefore not simply whether individual control functions are doing their jobs. It is whether the organization’s governance structure allows information to move across functional boundaries. This distinction matters more as corporate risks become more interconnected.

A cybersecurity event can become a privacy incident. A privacy incident can become a regulatory investigation. A regulatory investigation can create disclosure obligations. A third-party issue can become an anti-corruption problem, which can become a books-and-records problem, which can become a securities issue. Risk categories are useful for management. They are not boundaries that real-world events respect. 

The Wolf Man and Frankenstein’s Monster Are Different Risks

One useful aspect of Frankenstein Meets the Wolf Man is that its two principal characters represent different kinds of risk. Larry Talbot understands his condition. He knows that particular circumstances trigger his transformation and that the consequences can be severe. His risk is recurring and linked to identifiable conditions. Frankenstein’s Monster represents something different. He is a legacy risk repeatedly inherited, revived, and unsuccessfully controlled by others.

Put them together and the problem changes. Companies experience similar combinations. A business may have a known third-party risk that becomes significantly more serious when combined with expansion into a high-risk jurisdiction. A weak control environment may become more consequential when management introduces aggressive sales incentives. A cybersecurity vulnerability may become more significant when the company deploys an AI system with access to sensitive information. The risks do not merely accumulate. They can amplify one another. That is why risk assessment should consider interdependencies. 

Risk Aggregation Should Be Part of the Compliance Conversation

Traditional compliance risk assessments often organize risks by subject matter.

  • Anti-corruption risk.
  • Sanctions risk.
  • Antitrust risk.
  • Third-party risk.
  • Privacy risk.
  • Conflicts of interest.
  • Books and records.

That approach is useful because it creates structure and allows organizations to identify controls and owners. It can also obscure combinations of risk. Consider a company acquiring a business in a high-risk jurisdiction. The acquisition may involve weak financial controls, substantial government interaction, a distributor-based sales model, aggressive growth assumptions, and a local culture unfamiliar with the acquiring company’s compliance expectations. Each issue may appear manageable when assessed separately. Together, they may produce a materially different risk profile. 

The CCO should therefore consider adding risk aggregation to the compliance risk assessment process. Where do significant risks intersect? Which business units face several elevated risks simultaneously? Which third parties create exposure across multiple compliance areas? Which strategic initiatives combine new technology, new markets, new partners, and aggressive financial expectations? A heat map that displays risks individually may not reveal these relationships. Compliance should be able to explain not only where the red boxes are but also what happens when several red boxes occupy the same part of the business.

AI Is an Enterprise Risk Multiplier 

Artificial intelligence provides one of the clearest modern examples of the problem. Companies sometimes discuss “AI risk” as though it were one category. Unfortunately, it is not. An AI deployment can simultaneously raise privacy, cybersecurity, intellectual property, employment, discrimination, consumer protection, regulatory, third-party, recordkeeping, and reputational issues.

What about an AI tool used to assist hiring decisions? HR may view it as a talent-management system. Information Security may assess the technology vendor. Privacy may examine candidate data. Legal may consider employment requirements. Compliance may evaluate governance and ethical concerns. Procurement may negotiate the contract. Every function may perform its assigned task. The organization still needs someone to evaluate the complete risk picture.

The same issue arises when AI is used for internal investigations, compliance monitoring, customer interactions, sales recommendations, financial decisions, or employee evaluation. This is why AI governance requires cross-functional management.

Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 are useful because they encourage organizations to think about governance, accountability, risk identification, measurement, monitoring, and continual improvement rather than treating AI exclusively as an IT issue. The central business question is not which department owns AI. It is whether the governance structure addresses the risks created by the particular use case.

The CCO Should Be a Connector, Not the Owner of Everything

The increasing interconnectedness of risk raises an important question about the CCO’s role. The answer should not be that Compliance owns every risk involving law, ethics, or reputation. That approach creates its own governance problem.

Business management owns business risk. Information Security should remain accountable for cybersecurity. HR should remain accountable for employment processes. Finance should own financial controls. Legal should provide legal advice. Internal Audit should preserve its independent assurance role. The CCO can nevertheless play an important role as a connector.

Compliance often receives information from multiple parts of the organization. Hotline reports, investigations, third-party due diligence, monitoring results, policy exceptions, training data, regulatory developments, culture assessments, and risk assessments all provide different views of organizational behavior. That perspective can allow Compliance to identify patterns that may not be visible within a single business function. The CCO should therefore ask where information needs to be shared, where cross-functional escalation is necessary, and where significant risks require joint governance. The goal is coordination without diluting accountability.

Mission-Critical Risk and Board Oversight

This also connects to the broader Marchand discussion about board oversight of significant and mission-critical risks. Directors do not need to become operational risk managers. They do need reasonable assurance that management has systems to identify significant risks and escalate material information.

For interconnected risks, that means understanding how management aggregates information. 

  • Which risks are sufficiently significant to require cross-functional oversight?
  • How does management identify emerging combinations of risk?
  • Who resolves disagreements between control functions?
  • What information reaches the board?
  • How are significant risks assigned when they do not fit within one organizational function?

These questions matter most when a risk is central to the company’s business model. The board does not need to manage the monsters. It needs to understand whether management can see when they are moving toward one another. 

Practical Actions for the CCO 

Frankenstein Meets the Wolf Man suggests several practical actions for compliance leadership. The compliance risk assessment should identify not only individual risks but also significant risk intersections. CCOs should look for business units, markets, third parties, products, and strategic initiatives where multiple elevated risks converge. Compliance should establish relationships and information-sharing mechanisms with Internal Audit, Legal, Finance, HR, Information Security, Privacy, Procurement, and Enterprise Risk Management. Significant cross-functional risks should have clear owners, escalation criteria, and decision rights.

CCOs should also consider whether existing compliance dashboards show relationships among risks or simply report individual metrics. Data from investigations, hotline reports, third-party monitoring, policy exceptions, audit findings, and other sources can become substantially more valuable when analyzed together. For emerging technologies such as AI, Compliance should participate in cross-functional governance while avoiding the temptation to own every associated risk. The objective is not centralized ownership. It is connected governance.

The Compliance Lesson

Frankenstein Meets the Wolf Man completes the compliance progression of the Universal Frankenstein films. Organizations create risks. Leadership can compromise in responding to them. New management can inherit them. Remediation can fail to eliminate them. Then those unresolved risks can interact with other risks.

That final stage matters because modern corporate risk is increasingly interconnected. AI touches privacy, cyber, employment, intellectual property, and regulatory compliance. Third-party risk can implicate corruption, sanctions, human rights, cybersecurity, and financial controls. Compensation can affect culture, sales practices, fraud risk, and books and records. No single function can manage these issues effectively on its own.

The solution is not to eliminate functional ownership. Clear accountability remains essential. The solution is to build governance mechanisms that allow information to move, risks to be considered together, and significant issues to be escalated across organizational boundaries. For the CCO, that means becoming an effective connector while preserving the accountability of the business and other control functions.

For management, it means looking beyond individual risk categories. For the board, it means ensuring that committee structures and reporting processes provide an enterprise view rather than a collection of disconnected risk reports. The ultimate lesson from Frankenstein Meets the Wolf Man is therefore not really about either monster individually. It is about interaction. 

A company may understand its corruption risk. It may understand its third-party risk. It may understand its cybersecurity risk. It may understand its AI risk. It may have capable people managing each one. The question is whether anyone understands what happens when those risks meet. That is where compliance moves beyond individual rules and controls and becomes part of enterprise governance. 

After five films, the Frankenstein story leaves us with a useful framework for the modern compliance program: govern what you create, learn from what goes wrong, take responsibility for what you inherit, test whether remediation works, and understand where risks intersect. Because in business, as in the movies, managing one monster is difficult enough. The real governance challenge begins when monsters collide.

Check out the podcast version and analysis of this episode of Popcorn and Compliance with Timothy and Fiona.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 4 – The Ghost of Frankenstein Declaring the Monster Dead Is Not a Control

This October, Tom Fox returns to one of his all-time favorites: Universal Pictures’ Classic monsters. Over the years, Tom has explored classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, as well as films by Val Lewton and Hammer Studios. This year, he wanted to return for a deep dive into the first five Frankenstein movies. He has considered, and will consider, the original Frankenstein, Bride of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. In this third episode, he considers what many viewers regard as the series’ best: Son of Frankenstein, released in 1939. This is the final film to feature Boris Karloff as Frankenstein’s Monster. In this exploration, Tom Fox uses his AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis:

In The Ghost of Frankenstein, Boris Karloff leaves the role, and Lon Chaney Jr. takes over as the Monster, while Bela Lugosi returns as Ygor. After escaping another attempt by villagers to destroy them, Ygor brings the Monster to Ludwig Frankenstein, Henry Frankenstein’s other son. Ludwig initially wants nothing to do with his family’s disastrous legacy but inevitably becomes involved and develops a plan to cure the Monster through brain transplantation. Ygor and Ludwig’s disgraced colleague Bohmer secretly substitute Ygor’s brain for the intended healthy brain. Predictably, remediation becomes another catastrophe.

Key highlights:

  • Repeat failures indicate ineffective remediation.
  • Closing a finding does not mean fixing a finding.
  • Bohmer demonstrates management override and circumvention of controls.
  • COSO asks us to look at the whole control environment.
  • Root cause is more important than symptoms.

Popcorn and Compliance Takeaway: Declaring the Monster dead is not a control. You have to test whether he can get back up.

Timothy and Fiona are AI-generated voices courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 4 – The Ghost of Frankenstein: Declaring the Monster Dead Is Not a Control

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first three Frankenstein films trace a recognizable progression in compliance. Frankenstein examined innovation without adequate governance. Bride of Frankenstein explored what happens when leadership recognizes a risk but lets pressure and rationalization override judgment. Son of Frankenstein shifts to inherited risk and the responsibility of new leadership to address problems its predecessors created. The Ghost of Frankenstein (1942) raises the next question. What happens when the organization believes the problem has already been addressed?

By the fourth film, no credible argument suggests that Frankenstein’s Monster represents an unknown risk. Communities have confronted him. Members of the Frankenstein family have attempted to control him. The consequences are well established. Yet the Monster remains. This time, Ygor, again played by Bela Lugosi, brings the Monster, now played by Lon Chaney Jr., to Ludwig Frankenstein, Henry Frankenstein’s other son. Ludwig initially wants nothing to do with his family’s legacy. He eventually concludes that he can solve the problem through a brain transplant. The proposed solution appears technically sophisticated. It is also compromised when Ygor and Ludwig’s colleague Bohmer secretly substitute Ygor’s brain for the intended brain.

For corporate compliance professionals, The Ghost of Frankenstein is a case study in remediation and control effectiveness. Companies routinely investigate misconduct, revise policies, conduct training, implement corrective actions, and close audit findings. Those activities matter, but they don’t prove the underlying risk has been reduced. The relevant compliance question is not whether management completed the remediation plan. It is whether the remediation worked.

Closure Is an Administrative Status

Compliance, Internal Audit, Legal, Finance, and business management are familiar with corrective-action plans. An issue is identified. Management develops remediation. Actions are assigned. Deadlines are established. Policies may be revised, systems changed, training delivered, or controls added. Eventually, the required actions are completed, and the finding is marked closed. That process is not inherently wrong. Organizations need a disciplined method for tracking remediation. The risk comes when administrative closure becomes confused with risk reduction.

Suppose an investigation finds that employees circumvented a third-party approval requirement. Management revises the policy and retrains the business. Both actions may be appropriate. They also may have little effect if the original problem arose because sales targets encouraged employees to bypass the process and local managers routinely approved exceptions. The policy was not necessarily the root cause. Training was not necessarily the solution. A closed action item therefore tells management that a required activity occurred. It does not automatically establish that the control environment changed. That distinction is central to compliance program effectiveness.

Start With Root Cause

Ludwig Frankenstein approaches the Monster as a technical problem. Replace the brain, and the problem is solved. Compliance can fall into the same trap with remediation. Organizations sometimes start corrective action before they have adequately identified why the failure occurred. Effective remediation should begin with root-cause analysis.

Suppose a salesperson makes an improper payment through a third-party distributor. The immediate facts may be straightforward. The employee violated policy, the payment was inappropriate, and the third party was involved. A root-cause analysis goes further.

Why was the third party selected? Was due diligence adequate? Were red flags identified? Did anyone override the process? Was the compensation structure unusually aggressive? Did management communicate unrealistic sales expectations? Were invoices sufficiently detailed? Did Finance question the payments? Had similar issues occurred previously? Did employees believe management would support them if they delayed the transaction? These questions shift the analysis from the individual event to the system that allowed it to happen.

Individual accountability remains important. A company should not use systemic explanations to excuse deliberate misconduct. But disciplining an employee does not repair a control environment. A strong remediation plan addresses both.

Repeat Findings Are Information

Recurring compliance issues should receive particular attention.

  • If Internal Audit repeatedly identifies the same control weakness, that is information.
  • If multiple investigations identify similar conduct in the same business unit, that is information.
  • If hotline reports repeatedly raise concerns about the same management behavior, that is information.
  • If third-party monitoring continually identifies the same documentation gaps, that is information.

Repeat issues may indicate that previous remediation addressed symptoms rather than causes. They may also indicate weak implementation, insufficient resources, inadequate supervision, or management resistance. The CCO should therefore have a mechanism to identify recurrence across data sources.

An audit finding may appear unrelated to a hotline complaint. A hotline complaint may appear unrelated to a third-party exception. A third-party exception may appear unrelated to an investigation. Viewed together, they may demonstrate a common control problem. This is where compliance data becomes more valuable than compliance statistics. The objective is not simply to count investigations, audit findings, policy exceptions, or hotline reports. The goal is to identify patterns that tell management how the organization operates.

Bohmer and Management Override

The brain-transplant sequence provides the film’s strongest internal-control lesson. Ludwig develops a plan to replace the Monster’s brain. Whatever one thinks of the underlying objective, the process is defined, and the outcome is intended. Then Bohmer and Ygor subvert it.

Control isn’t defeated because nobody designed a process. It fails because individuals with access and opportunity manipulate the process. That is management override. Corporate controls often assume authorized individuals will use their authority as intended. That assumption requires testing.

  • A manager can approve an expense.
  • A finance executive can authorize a journal entry.
  • A procurement leader can approve a vendor.
  • A senior executive can authorize a policy exception.
  • An administrator can change system permissions.
  • A business leader can influence a third-party decision.

Those authorities are necessary for business operations. They can also create risk when one individual possesses excessive discretion or when oversight is weak. Segregation of duties, approval thresholds, access controls, audit trails, independent review, exception reporting, and transaction monitoring exist partly to address this problem. For the CCO, the question is not simply whether a control exists. It is whether someone can circumvent it and whether the organization would know.

COSO and the Broader Control Environment

The Ghost of Frankenstein also provides an opportunity to consider the COSO Internal Control Integrated Framework. Controls do not operate in isolation. The control environment establishes expectations, authority, accountability, and standards of conduct. Risk assessment identifies threats to organizational objectives. Control activities translate those risks into specific preventive or detective measures. Information and communication ensure the right people receive relevant information. Monitoring determines whether the system continues to operate effectively.

Compliance failures often occur when organizations focus too narrowly on a single control activity. A company identifies misconduct involving gifts and entertainment, so it lowers approval thresholds. That may be useful.

  • But what if managers continue encouraging employees to find ways around the limits?
  • What if expense descriptions are vague?
  • What if Finance does not review unusual patterns?
  • What if senior executives routinely receive exceptions?
  • What if employees believe questioning an expense submitted by a powerful executive will damage their careers?

The approval threshold may be well designed. The broader control environment remains weak. This is why compliance should work closely with Internal Audit, Finance, HR, Legal, and business management. Compliance risk rarely fits neatly within one control owner.

Design Effectiveness and Operating Effectiveness

One of the most useful distinctions in controls work is between design effectiveness and operating effectiveness. A control may be well designed. That does not mean it operates effectively. Consider third-party due diligence. The company may have a strong written process requiring risk classification, beneficial ownership review, screening, business justification, approval, contractual protections, and periodic monitoring. On paper, the control appears robust. Then testing reveals that business sponsors routinely submit incomplete information, reviewers approve files without resolving red flags, contracts are signed before diligence is complete, and periodic reviews are months overdue. The control design is not necessarily the problem. It is execution.

Conversely, employees may execute a poorly designed control exactly as instructed, even as it fails to address the relevant risk. Compliance needs to understand both. This matters especially when validating remediation. Management should not simply confirm that a new control was implemented. Someone should determine whether the control is appropriately designed and whether it operates consistently in practice. That is how an organization moves from remediation activity to evidence of effectiveness.

Investigations Should Improve the Program

Investigations represent one of the richest sources of compliance intelligence available to a company. They show where actual conduct differs from expected conduct. Yet organizations sometimes treat investigations primarily as case-management exercises. An allegation arrives, the company investigates, decides whether to substantiate it, takes disciplinary action where appropriate, and closes the matter. That process resolves the case. It does not necessarily improve the compliance program.

For significant matters, a compliance professional should ask what the investigation teaches the organization.

  • Did a control fail?
  • Was a policy unclear?
  • Was supervision inadequate?
  • Were incentives relevant?
  • Did the reporting system work?
  • Was retaliation alleged?
  • Were similar concerns raised previously?
  • Did management respond appropriately when warning signs appeared?
  • Should monitoring change?
  • Should the risk assessment change?

The investigation should feed the compliance program. Otherwise, the organization may become very efficient at investigating the same problem repeatedly.

Test the Remediation

Perhaps the most important lesson from The Ghost of Frankenstein is that remediation requires validation. Management implements a corrective action. Someone should return later and determine whether it worked. The timing and depth of testing should depend on risk. A significant control failure may require independent validation by Internal Audit, Compliance testing, or another qualified function. Lower-risk matters may be validated through management review or monitoring. The important point is that the organization should define what success looks like before declaring the remediation effective.

The Compliance Lessons

The Ghost of Frankenstein demonstrates a basic principle of compliance program effectiveness. Activity is not the same as effectiveness. A company can revise a policy, deliver training, add an approval, complete a corrective-action plan, and close an audit finding. Each action may be appropriate. The compliance question is whether those actions changed the risk.

That requires root-cause analysis, well-designed controls, disciplined implementation, monitoring, testing, and accountability. It also requires management to recognize that some failures are not caused by employees misunderstanding the rules. They may result from incentives, authority structures, management override, weak supervision, or a control environment that rewards the wrong behavior.

The goal of remediation is not to demonstrate that the organization did something. It is to demonstrate that the organization learned something and changed accordingly. That is why declaring the Monster dead is not a control. The evidence comes from whether he stays dead.

Our final installment of my Universal Classic Monster Movie Month for 2026 takes the Frankenstein compliance story in a different direction. After four films dealing largely with one persistent risk, Universal brings another major risk into the picture. In Frankenstein Meets the Wolf Man, the issue is no longer simply whether an organization can identify, govern, inherit, or remediate a single compliance problem. It is what happens when independently managed risks begin to interact. For modern companies confronting AI, cybersecurity, privacy, third-party, sanctions, anti-corruption, financial, and operational risks, that may be the most important governance question of all: What happens when the risks we manage separately collide?

For a review of the movie and audio analysis, check out Timothy and Fiona’s take on it in Popcorn and Compliance.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 3: Son of Frankenstein – Inheriting the Castle Means Inheriting the Risk

This October, Tom Fox returns to one of his all-time favorites: Universal Pictures’ Classic monsters. Over the years, Tom has explored classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, as well as films by Val Lewton and Hammer Studios. This year, he wanted to return for a deep dive into the first five Frankenstein movies. He has considered, or will consider, the original Frankenstein, Bride of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolfman. In this third episode, he considers what many viewers regard as the series’ best: Son of Frankenstein, released in 1939. This is the final film to feature Boris Karloff as Frankenstein’s Monster. In this exploration, Tom Fox uses his AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis:

Son of Frankenstein brings Basil Rathbone into the saga as Wolf von Frankenstein, who returns with his family to his father’s estate hoping to restore the Frankenstein name. Instead, he encounters Bela Lugosi’s extraordinary Ygor and discovers that his father’s Monster, played for the final time by Boris Karloff, is still alive but comatose. Wolf revives him, hoping to vindicate his father’s work, but Ygor has his own plans and uses the Monster to settle old scores. The result is another catastrophe created by a Frankenstein convinced that this time things will be different.

Key highlights:

  • You can inherit risk without creating it.
  • This is the M&A compliance movie.
  • Ygor represents institutional knowledge used for the wrong purpose.
  • Inspector Krogh represents institutional memory.
  • Red flags transform governance responsibility.

Popcorn and Compliance takeaway: You may not have created the Monster, but once you know he is in the basement, he becomes your governance problem.

Timothy and Fiona are AI-generated voices courtesy of NotebookLM.

Categories
Blog

Frankenstein and Compliance: Part 3 – Son of Frankenstein: You Inherited the Castle, You Inherited the Risk

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first two Frankenstein films present two distinct compliance failures. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands the risk but lets pressure, ambition, and rationalization override judgment. Son of Frankenstein (1939) presents the next stage: inherited risk, or in the business world, risks through acquisition.

Wolf von Frankenstein, played by Basil Rathbone, returns with his family to his ancestral estate hoping to restore the Frankenstein name. Instead, he encounters Ygor, played by Bela Lugosi, and discovers that his father’s Monster is still alive. Wolf had no role in creating the original problem, but his discovery forces him to decide how to address the legacy he has inherited.

That situation should be familiar to companies following acquisitions, leadership transitions, compliance investigations, or changes in the control environment. New management may have no connection to historical misconduct. An acquiring company may not have created the target’s problematic third-party relationships. A new CCO may inherit investigations and remediation projects that were initiated years earlier. Historical responsibility and current responsibility are different questions. The business issue is how management responds once a legacy risk becomes known.

The Castle Is an Acquisition

Think of Wolf’s return to the Frankenstein estate as an acquisition. He receives the property, assets, name, and opportunity to benefit from his father’s scientific legacy. He also assumes the consequences associated with that legacy. Corporate acquisitions work much the same way. Companies acquire revenue, customers, employees, technology, intellectual property, distribution networks, and market access. They may also inherit high-risk third parties, weak internal controls, questionable historical practices, unresolved investigations, government relationships, and cultural problems.

This is why compliance due diligence should focus on how the target actually conducts business rather than simply whether it has the expected compliance infrastructure. A target may have a Code of Conduct, an anti-corruption policy, annual training, and a hotline. Those are relevant data points, but they do not establish program effectiveness.

Compliance needs to understand the target’s business model and risk profile. Consider such questions as: Where does the business operate? Who are its customers? Does it interact with government agencies or state-owned entities? Which third parties generate or facilitate business? How does the company select and compensate those parties? What does the investigation history reveal? Are there recurring audit or control deficiencies? What does speak-up data indicate? Are significant policy exceptions concentrated in particular markets or business units? The objective is to understand the risk embedded in the business being acquired.

Due Diligence Is the Beginning, Not the End

Even well-designed pre-acquisition due diligence has limitations. Transactions operate under deadlines and time pressures. Access to employees and records may be restricted. (See: Opinion Release 08-02) Data may be incomplete. Privacy requirements may constrain review. Some risks simply do not become visible until the buyer gains access to systems, records, personnel, and financial information after closing. Those limitations make the connection between due diligence and post-acquisition integration critical.

If the buyer cannot complete diligence on a high-risk distributor before closing, that relationship should become a post-closing priority. If investigation records are incomplete, they should be reviewed during integration. If significant controls cannot be tested before the transaction, testing should be incorporated into the integration plan. Compliance should therefore document unresolved diligence issues and carry them forward with assigned owners and deadlines.

This discipline matters because closing creates competing priorities. Management quickly shifts to customers, systems, personnel, financial reporting, cost savings, and expected synergies. Compliance integration can become one workstream among many. An unanswered compliance question doesn’t become less significant once the transaction closes.

Post-Acquisition Integration Is the Operational Test

An acquiring company can conduct excellent due diligence and still create exposure if it fails to integrate the acquired business effectively. Post-acquisition integration is where the buyer’s compliance expectations become operational. Employees need to understand the acquiring company’s Code of Conduct, policies, reporting mechanisms, investigation procedures, third-party requirements, approval processes, and internal controls. High-risk third parties may require additional diligence. Contracts may need updated compliance provisions. Financial controls may need harmonization. Employees need risk-appropriate training.

Integration should also reflect the acquired company’s actual risk profile. A business operating primarily in lower-risk markets with direct sales may require a different approach than a company that depends on agents and distributors in jurisdictions with substantial government interaction. Do not apply the same integration checklist mechanically to every acquisition.

The CCO should know which issues require immediate attention, which can be addressed over a reasonable integration period, and who is accountable for each significant action. Without ownership and monitoring, temporary integration gaps can become lasting control weaknesses.

Ygor and the Informal Organization

Ygor provides one of the movie’s most useful compliance lessons. He understands the Frankenstein estate better than Wolf does. He knows its history, its secrets, and how things actually work. Every organization has a formal structure and an informal operating system. The organizational chart describes reporting relationships. Policies describe required processes. Procedures identify approvals. Employees know how business actually gets done.

They know which approvals receive meaningful scrutiny and which are largely administrative. They know which managers routinely approve exceptions. They know which third parties have special relationships with executives. They know which controls become flexible near quarter-end. They know whether raising a concern is welcomed or career-limiting. This is why compliance risk assessment cannot rely exclusively on documents.

Policies lay out how an organization is supposed to operate. Interviews, focus groups, hotline information, investigations, transaction testing, third-party monitoring, audit findings, and employee surveys can show how it operates in practice. That distinction becomes particularly important following an acquisition. The buyer needs to understand not only the target’s compliance architecture but also its operating culture.

Institutional Memory Is a Compliance Control

Inspector Krogh represents the other side of organizational knowledge. He remembers the consequences of the original Frankenstein experiment because he experienced them personally. His perspective is shaped by history, not by Wolf’s confidence that the past can be managed differently. Companies need mechanisms for preserving similar institutional knowledge.

Investigations produce knowledge. Internal audits produce knowledge. Regulatory inquiries produce knowledge. Compliance monitoring and remediation projects produce knowledge. That knowledge can disappear surprisingly quickly. Employees retire. CCOs leave. Executives change roles. Board members rotate. Investigations close. Outside counsel completes an engagement. Remediation projects are marked complete.

Years later, new management may propose a business arrangement, third-party relationship, market strategy, or control change similar to one the organization previously determined was problematic. An effective compliance program should prevent important lessons from depending entirely on the memories of individual employees.

Significant investigation findings should inform future risk assessments. Root causes should influence control design. Remediation lessons should affect monitoring. Historical third-party concerns should remain available when relationships are reconsidered. An investigation’s purpose is not simply to resolve an allegation. It should also improve the organization’s understanding of its risks.

New Leadership and the Risk of Exceptionalism

Wolf demonstrates another challenge common to leadership transitions. New leaders often believe they can manage risks that previous leaders could not. Sometimes they can. New leadership may bring stronger systems, better controls, additional resources, and improved judgment. The problem arises when confidence leads management to discount why earlier controls or restrictions were established.

A new sales executive may propose reengaging a distributor previously terminated for compliance concerns. A new CEO may reconsider a market that previous management considered too risky. A new business leader may conclude that an approval requirement imposed after earlier misconduct is unnecessarily restrictive. Any of those decisions may be appropriate. Controls should not remain in place indefinitely simply because they are old. But management should understand the history before changing them.

Before removing a control, determine why it was created. Before reengaging a third party, understand why the relationship ended. Before changing monitoring requirements, identify the risk they were designed to address. Some controls become obsolete. Others represent lessons learned. Good governance distinguishes between the two.

Red Flags and the Governance Response

The central compliance issue arises when Wolf learns the Monster is alive. At that point, the question moves from discovery to response. Corporate compliance systems serve a similar purpose. Internal controls, monitoring, Internal Audit, risk assessments, investigations, hotlines, and management reporting should surface significant information.

The effectiveness of those systems depends upon what happens after the information arrives. The Evaluation of Corporate Compliance Programs (ECCP) suggests such inquiries as: Was the issue investigated? Was it escalated appropriately? Did management assign remediation? Was completion tracked? Was effectiveness tested? Did significant information reach the board or appropriate committee? A sophisticated reporting system provides little protection if material concerns repeatedly reach decision-makers without producing action.

For a CCO, this means escalation protocols matter. The organization should understand which issues remain within normal management processes, which require senior management attention, and which warrant board notification.

Legacy Third Parties Require Fresh Review

Inherited third-party relationships deserve particular attention because longevity can create a false sense of security. The distributor has worked with the business for fifteen years. The consultant is well known locally. The customs broker has always handled interactions with government agencies. No significant problems have been reported previously. Those facts provide context. They do not replace risk-based oversight.

Acquisitions and leadership transitions provide an opportunity to reassess significant legacy relationships. Is the third party still necessary? Is the business rationale documented? Is beneficial ownership information current? Has the risk profile changed? Are payment arrangements appropriate? Are contracts current? Has monitoring identified concerns? Longstanding relationships should not automatically be grandfathered into the current compliance program. Some may warrant closer attention precisely because they were established under different controls, different management, and different expectations.

Practical Actions for the CCO

Son of Frankenstein suggests a practical agenda for compliance leadership. Due diligence should examine actual business operations, not just the existence of policies. Unresolved diligence issues should move directly into the integration plan with defined ownership and deadlines. Integration should be risk-based and should include controls, training, reporting mechanisms, investigations, and third-party oversight.

Significant legacy third parties should be reassessed rather than automatically accepted. Preserve investigation findings and past control failures as institutional knowledge and incorporate them into future risk assessments. New leadership should understand why significant controls were established before deciding to eliminate or weaken them. Finally, significant inherited risks should have clear owners. Issues that sit between the transaction team, business leadership, Legal, Compliance, Finance, and Internal Audit can otherwise remain unresolved because everyone assumes someone else is responsible.

The Compliance Lesson

Son of Frankenstein demonstrates the difference between responsibility for creating a problem and responsibility for managing one. Organizations routinely inherit compliance risks through acquisitions, leadership transitions, longstanding business practices, third-party relationships, and unresolved control weaknesses. New management should not be treated as responsible for conduct that occurred before it arrived. Its responsibility begins with the response.

Effective compliance requires the organization to identify inherited risks, prioritize them by significance, assign ownership, integrate acquired operations, preserve institutional knowledge, and verify corrective actions. That is the business lesson from Wolf von Frankenstein’s return to the family estate. The value of an inheritance cannot be separated from its risks.

The next stage of the Frankenstein story raises another familiar compliance issue. Organizations can identify problems, investigate them, revise policies, conduct training, complete remediation plans, and close findings. Yet sometimes the same problem returns.

In our next selection, we consider The Ghost of Frankenstein. In this movie, the compliance issue is no longer discovery or inheritance. It is program effectiveness. If management says the problem has been remediated, what evidence demonstrates that the remediation actually worked?

For a discussion on these topics and a review of the movie, check out Timothy and Fiona in this episode of Popcorn and Compliance.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 2: Bride of Frankenstein Dr. Pretorius and the Compliance Problem of Knowing Better

This October, Tom Fox returns to one of his all-time favorites: the Universal Pictures classic monsters. Over the years, Tom has covered classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, and has also explored films by Val Lewton and Hammer Studios. This year, he’s back with a deep dive into the first five Frankenstein movies. The series covers the original Frankenstein, Son of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This second episode tackles what many viewers call the greatest horror movie of all time: Bride of Frankenstein (1935). Tom’s AI friends, Timothy and Fiona, comment throughout.

Film Synopsis

Bride of Frankenstein picks up after Henry Frankenstein and the Monster survive the original film. Henry wants to leave his experiments behind, but the wonderfully sinister Dr. Pretorius pulls him back toward creation, ultimately forcing him to help create a female companion for the Monster. Meanwhile, the Monster himself develops emotionally and intellectually, experiences both human kindness and cruelty, and desperately seeks companionship. The experiment succeeds technically, but the Bride immediately rejects the Monster, setting up the film’s tragic conclusion.

Key highlights:

  • Knowing better changes everything.
  • Pretorius represents the dangerous adviser.
  • Culture is learned behavior.
  • Speak-up systems require psychological safety.
  • Ethical leadership is tested when ethics becomes expensive.

Popcorn and Compliance takeaway: The most dangerous compliance failure may occur when leadership already knows the right answer and allows someone to persuade it otherwise.

Timothy and Fiona are AI-generated voices courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 2 – Bride of Frankenstein: When Leaders Know Better

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox takes a deep dive into the first five Frankenstein movies. Over October, he will cover Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. The blog post accompanies the podcast series.

The compliance problem in Frankenstein was innovation without governance. Henry Frankenstein became so focused on whether he could create life that he failed to consider adequately what would happen if he succeeded. He had extraordinary technical capabilities but almost no governance infrastructure around his experiment. There was no meaningful risk assessment, no effective challenge function, no contingency planning, and no clear accountability for the consequences. In Bride of Frankenstein (1935), the compliance problem is different and considerably more troubling. Henry now knows better.

Henry has survived the consequences of his original experiment. He has seen the Monster die and the destruction it caused. He understands that his scientific ambition created risks he could not control. At the beginning of the sequel, Henry appears ready to put his experiments behind him and build a life with Elizabeth. Then Dr. Pretorius arrives.

Pretorius is one of the great characters in the Universal horror canon, but anyone who has spent time in corporate compliance will recognize him. He is intelligent, sophisticated, persuasive, and completely convinced that conventional ethical boundaries should not interfere with extraordinary achievement. More importantly, he understands Henry. Pretorius knows which arguments will appeal to Henry’s ambition and which pressures will overcome his judgment.

This changes the compliance analysis. Henry cannot claim that the risk is unknown. He has already experienced the consequences. The question is whether he has learned from them. That distinction provides the central compliance lesson of Bride of Frankenstein. A significant difference exists between an organization that fails to identify a new risk and one that identifies it, experiences the consequences, and then allows the same underlying conduct to return.

Knowledge Changes the Governance Obligation

Corporate compliance programs generate information. Risk assessments identify vulnerabilities. Internal audits identify control weaknesses. Investigations identify misconduct. Hotline reports identify cultural problems. Due diligence identifies third-party risks. Compliance monitoring identifies patterns that may require further attention. The value of that information depends upon what the organization does with it.

An investigation that establishes what happened but produces no organizational change has limited compliance value. The same is true of an internal audit finding that is administratively closed without determining whether the underlying risk has been reduced. Knowledge must lead to action. This is where Henry fails. He possesses precisely the information that should prevent him from returning to the laboratory. He knows his previous experiment had catastrophic consequences. Nevertheless, Pretorius gradually pulls him back toward the same underlying conduct.

For a CCO, this raises an important question about repeat misconduct. When the same type of compliance problem appears more than once, the organization should ask whether the earlier incident was treated as an isolated event rather than a systemic warning. Questions you might ask include: Did the investigation identify root causes? Were controls changed? Were incentives examined? Was management behavior considered? Was remediation tested? Were lessons incorporated into the next risk assessment? Once an organization knows where a material risk exists, future failures become more difficult to characterize as unforeseeable.

The Pretorius Problem

Pretorius represents a particular type of organizational risk: an influential individual who consistently finds reasons why normal controls shouldn’t apply. Every experienced compliance professional has encountered some version of this problem. A business executive explains that a particular transaction is unique. A salesperson argues that a questionable practice is standard in the local market. A manager insists that due diligence must be completed after onboarding because the customer cannot wait or you will cause the company to miss the quarter’s numbers. None of those statements necessarily establishes misconduct. They should nevertheless cause a compliance professional to ask additional questions.

The danger often comes through rationalization rather than an explicit request to violate the law. The transaction is too important. The amount is too small. The customer relationship is too valuable. The competitor already does it. The process takes too long. The documentation can be completed later. Pretorius works on Henry in much the same way. He does not persuade Henry that the original experiment was harmless. He persuades him that there is a sufficiently compelling reason to cross the boundary again. That is a leadership problem because effective ethical leadership requires executives to recognize when commercial, personal, or organizational pressure is changing their risk tolerance.

When Exceptions Become the Business Process

One of the most important implications for a compliance program is managing exceptions. Most corporate policies need some mechanism for legitimate exceptions. Business circumstances are too complex to assume every rule applies equally in every situation. The problem arises when exceptions become routine.

Consider third-party due diligence. A distributor needs to begin work immediately because of a time-sensitive commercial opportunity. Management approves an exception that lets work begin before diligence is complete. The exception may be entirely defensible. Then another distributor receives the same treatment. Then another. Eventually, business personnel begin viewing due diligence as a process that can routinely be completed after onboarding. The written policy has not changed. The actual control environment has.

The same issue can arise with gifts and entertainment, conflicts of interest, expense approvals, sanctions screening, contracting requirements, AI approvals, cybersecurity requirements, or financial controls. Each exception may have a plausible business explanation. Taken together, the exceptions may demonstrate that the organization has developed an operating practice inconsistent with its stated policy.

Compliance should therefore monitor exceptions as data. How many are being granted? Which business units request them? Which executives approve them? Are the same reasons repeatedly used? Do temporary exceptions become permanent arrangements? A pattern of exceptions can early indicate the normalization of deviance.

Culture Becomes Visible When the Stakes Rise

Bride of Frankenstein also provides an important lesson about corporate culture. Culture is relatively easy to discuss when ethics and commercial objectives don’t conflict. The real test comes when the two appear to diverge.

Suppose Compliance identifies significant concerns about the company’s highest-revenue distributor. What happens next? Suppose an investigation substantiates allegations involving a senior executive responsible for a strategically important business. How does management respond? Suppose an AI application promises significant cost savings, but Legal, Privacy, Information Security, or Compliance recommends delaying deployment for additional testing. Does the company wait? Those decisions reveal more about corporate culture than a values statement.

Henry believes he has changed after the events of Frankenstein. Pretorius tests that belief. Once scientific ambition, pressure, and personal consequences enter the equation, Henry’s commitment to walking away begins to erode. Companies experience the same tension. A business may have strong written values and an extensive compliance program, but employees pay attention to what happens when adherence to those values becomes costly.

This is particularly important for boards. Boards cannot assess culture solely through training completion rates, hotline statistics, or employee surveys. Those metrics can help, but directors should also understand how management handles difficult decisions involving high performers, major customers, significant third parties, and substantial revenue. Culture becomes visible in decisions.

The Monster and the Importance of Organizational Experience

One of the most significant developments in Bride of Frankenstein is the Monster’s evolution. In the original film, he is largely reactive. In the sequel, he begins to learn about human relationships and the world around him. The sequence with the blind hermit is particularly important. The hermit does not judge the Monster by his appearance. He provides food, companionship, music, and kindness. The Monster responds to that environment. For a brief period, we see how different surroundings produce different behavior.

That provides a useful analogy for corporate culture. Employees learn what an organization values through experience. They observe how their supervisors behave. They see who receives promotions and bonuses. They notice whether high performers receive exceptions from policies. They see whether the organization respects or marginalizes people who raise concerns. They learn whether management wants bad news delivered promptly or prefers problems to stay below the surface.

Compliance should therefore pay particular attention to management behavior. Employee surveys, exit interviews, hotline data, investigation trends, turnover information, disciplinary records, and audit findings can help identify business units where the local management culture differs from the company’s stated expectations.

Incentives Can Become the Corporate Pretorius

Pretorius uses Henry’s ambition as leverage. Corporations use compensation and performance systems to influence employee behavior every day. That makes incentives a central compliance issue. A company may tell employees that integrity is its highest priority while evaluating them primarily on revenue, growth, margin, or quarterly performance. Employees will quickly determine which message matters more.

This does not mean financial incentives are inappropriate. Companies exist to generate economic value, and employees should be rewarded for performance. The compliance issue is whether the incentive structure unintentionally encourages excessive risk-taking or undermines controls.

Compliance should understand how significant employee populations are compensated. The Evaluation of Corporate Compliance Programs (ECCP) makes similar inquiries. Should questions include: Are sales targets realistic? Do employees get rewarded for the quality and sustainability of performance, or simply for the amount of revenue generated? Does compliance performance affect bonuses or promotion decisions? Are managers held accountable for control failures within their teams? Can compensation be reduced or recovered following significant misconduct? The goal is alignment. Employees should understand that how results are achieved matters as much as the results themselves.

High Performers Are the Real Test of Accountability

Perhaps the clearest test of ethical culture comes when a high-performing employee violates policy. If the organization disciplines junior employees while protecting commercially valuable executives, employees will understand that there are two compliance systems. One exists in the policy manual. The other exists in practice.

Consistency does not require identical discipline in every case. Facts, intent, seniority, cooperation, prior conduct, and other circumstances can legitimately affect disciplinary decisions. But commercial value should not create immunity. Boards should understand how management handles misconduct involving senior leaders and significant revenue producers. The issue is not whether directors should participate in routine disciplinary decisions. They should not. The governance question is whether accountability applies throughout the organization.

Pretorius operates as though ordinary ethical constraints are for other people. Companies should ensure they do not inadvertently create executives who reach the same conclusion.

The Compliance Lesson

Bride of Frankenstein is ultimately about organizational learning. Companies will make mistakes. Controls will fail. Employees will engage in misconduct. Compliance programs will occasionally fail to identify risks before those risks become problems.

Program effectiveness shows up in what happens next. An investigation should generate knowledge. That knowledge should inform root-cause analysis. Root-cause analysis should drive remediation. Remediation should change controls, incentives, training, supervision, or business processes where necessary. Those changes should then be tested to determine whether they work.

Henry Frankenstein fails because he doesn’t turn knowledge into durable change. He knows what happened the first time. He understands the consequences. Yet Pretorius finds the ambition, pressure, and rationalization needed to pull him back into the laboratory.

That is why Bride of Frankenstein provides such an important compliance lesson. The greatest organizational risk may not be the risk management failed to identify. It may be the risk management already knows about but has learned to tolerate.

The next stage of the Frankenstein story moves the problem forward again. Leadership changes. A new generation arrives. Wolf von Frankenstein did not create his father’s Monster and bears no responsibility for the decisions that originally brought him to life. Then Wolf discovers what he has inherited.

In Son of Frankenstein, the compliance question becomes one every acquiring company, new CEO, board member, and CCO should understand: You did not create the problem. Once you know it exists, what will you do about it?

Check out Timothy and Fiona’s commentary on the compliance lessons from the Bride of Frankenstein here.

Categories
Popcorn and Compliance

Popcorn and Compliance: Frankenstein It’s Alive: Innovation, Governance, and the Responsibility of the Creator

This October we return to one of Tom Fox’s all-time favorites, the Universal Picture Classic monsters. Over the years, Tom has revisited the classics Dracula, The Mummy, The Wolf Man, and The Invisible Man and taken detours into films by Val Lewton and Hammer Studios. This year, Tom wanted to return for a deep dive into the first five Frankenstein movies, covering the original, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolfman. In this first episode, we consider the original and one of the greatest horror movies of all time, Frankenstein, released in 1931. In this exploration, Tom has used my AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis

James Whale’s Frankenstein remains one of the foundational movies of American horror, with Colin Clive as Henry Frankenstein and Boris Karloff giving us the definitive cinematic image of the Monster. Henry retreats to his laboratory with his assistant Fritz, determined to discover the secret of life. His experiment succeeds, but a crucial mistake has already occurred: Fritz has supplied the brain identified in the film as abnormal rather than the intended brain. Henry brings his creation to life without understanding what he has made, without controls to manage it, and without any real plan for what comes next. The resulting tragedy ultimately sends creator and creation toward their confrontation at the burning windmill.

Key highlights:

  • Innovation without governance is simply uncontrolled risk.
  • The abnormal brain is a third-party and supply-chain failure.
  • Waldman represents credible challenge without sufficient authority.
  • Henry abandons responsibility when responsibility matters most.
  • The catastrophe begins before the Monster escapes.

Popcorn and Compliance takeaway: Do not wait until the Monster is running through the village to conduct the risk assessment.

Timothy and Fiona are AI-generated voices courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 1 – It’s Alive: Innovation Without Governance

Ed. Note: This month, on my podcast series Popcorn and Compliance, I am taking a deep dive into the first five Frankenstein movies. Over October, I will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolfman. The blog post is a companion to the podcast series.

The most famous moment in Frankenstein (1931) comes when Henry Frankenstein’s experiment succeeds. Electricity surges through his laboratory, the body on the table begins to move, and Frankenstein celebrates what he believes is an extraordinary scientific achievement.

“It’s alive!”

For the corporate compliance professional, however, the critical decisions occurred before Henry ever activated his equipment. He had decided to proceed without an adequate risk assessment, effective oversight, meaningful challenge, or a plan for managing the consequences if his experiment succeeded. Viewed through that lens, Frankenstein is not simply a horror movie about a scientist and the Monster he creates. It is a case study in innovation without governance.

That lesson is especially relevant as companies accelerate the adoption of AI and other emerging technologies. Businesses are appropriately focused on innovation, productivity, efficiency, growth, and competitive advantage. Yet technological capability can develop faster than the governance structures needed to manage the resulting risks. The compliance issue is not whether companies should innovate. They must. The issue is whether governance keeps pace with innovation.

The Business Case Was Clear. The Governance Case Was Not.

Henry Frankenstein has a compelling objective. He believes he can accomplish something no one has accomplished before. He assembles the equipment, obtains the materials, develops the technical capability, and builds a team capable of executing the project. In corporate terms, Henry has a strategy, resources, technical expertise, and executive sponsorship. He lacks an effective governance framework.

Before activating his creation, Henry conducts no meaningful risk assessment. He does not identify potential failure scenarios or establish control requirements. He does not define stopping criteria or determine who has authority to challenge the project. No meaningful contingency plan exists for an adverse outcome. This is precisely where compliance should enter the business process.

An effective compliance function should not first encounter a significant new technology when the business seeks approval immediately before deployment. Compliance needs to participate early enough to understand the business objective, identify the associated risks, and help determine appropriate controls.

That does not mean Compliance should own innovation or assume responsibility for the underlying business decision. Risk ownership should remain with the business. Compliance should help ensure that management understands the legal, regulatory, ethical, and control implications of the decision before significant commitments are made.

For the CCO, this raises a practical question: When does Compliance become involved in our company’s innovation process? If the answer is immediately before launch, the organization may already be too far downstream.

AI Has Made the Frankenstein Problem Immediate

Artificial intelligence makes the Frankenstein governance issue particularly relevant. Companies are deploying AI to analyze information, generate content, assist customer service, support investigations, screen candidates, evaluate transactions, enhance due diligence, identify suspicious activity, and improve decision-making. These applications can generate significant business value. They also raise governance questions that organizations must address before deployment.

Organizations need to understand what data an AI application uses, how it obtained that information, who approved the use case, and which regulatory requirements apply. They should determine how outputs are validated, where human review is required, how confidential information is protected, and what happens when a system produces an unexpected or inappropriate result.

There must also be clear accountability. Someone should own the business risk associated with the use case, and the organization should understand who has authority to suspend or terminate the application if circumstances warrant.

The NIST AI Risk Management Framework provides one useful approach through its Govern, Map, Measure, and Manage functions. ISO/IEC 42001 similarly treats AI through a management-system framework emphasizing governance, accountability, risk management, and continual improvement.

Both approaches reinforce a broader compliance principle: technology risk needs governance throughout the lifecycle. Henry Frankenstein has no lifecycle governance. His approach is essentially to build the system, activate it, and evaluate the consequences afterward. That is not an acceptable corporate control environment.

The Abnormal Brain and the Importance of Validating Inputs

One of the film’s most useful compliance scenes occurs before the Monster comes to life. Henry needs a brain for his creation. His assistant Fritz obtains one, but the intended specimen is destroyed. Rather than report what happened, Fritz substitutes another brain, identified in the film as abnormal, without telling Henry. (Abbey Normal—if you know, you know.) The project therefore proceeds after a critical input has changed without the project leader’s knowledge.

For compliance professionals, the scene provides a useful analogy for third-party risk, supply-chain controls, due diligence, and data governance. Organizations routinely rely on information others provide. A distributor provides beneficial ownership information. A vendor completes a compliance certification. An employee submits an expense report. An acquisition target makes representations during due diligence. A supplier certifies compliance with contractual obligations. An AI application relies upon data obtained from multiple sources.

The relevant control question is not simply whether the required information was received. It is whether the organization appropriately validated important information based on risk. Fritz completed his assignment in the narrowest sense. He returned with a brain. The process failed because nobody verified that he returned with the correct brain. That distinction is important for compliance program effectiveness. A completed checklist demonstrates that an activity occurred. Appropriate validation assures that the control achieved its purpose.

Dr. Waldman and Credible Challenge

Henry is not entirely without oversight. Dr. Waldman understands what Henry is attempting and recognizes the potential danger. He raises objections. Henry proceeds anyway. This takes the film from risk assessment into the effectiveness of the challenge function. Many companies can demonstrate that compliance participated in a significant decision. That does not necessarily establish that a compliance professional had meaningful influence over the outcome. A CCO can attend meetings, review proposals, identify concerns, and recommend additional controls. If commercial leadership can routinely disregard those concerns without escalation, the company may have consultation without credible challenge.

This is why the authority, stature, resources, independence, and access of the compliance function matter. The effectiveness of a corporate compliance program becomes most visible when it disagrees with an important business proposal. Boards should therefore look beyond whether your compliance function was consulted. They should understand what happens when a compliance officer disagrees with the business. They need to ask such questions as: Can the CCO escalate a significant concern? Does the CCO have appropriate access to the Audit Committee or board? Are material disagreements documented? Who has authority to accept significant compliance risk? Can commercial management override a compliance objection without further review?

If a CCO can raise a concern but nobody with decision-making authority has to address it, the organization has created the appearance of challenge without its substance. Dr. Waldman had a voice. He lacked the influence to change the decision.

Maria and the Risk of Unintended Consequences

Next we consider one of the most poignant scenes in the movie. The encounter between the Monster and young Maria provides another important business lesson. This is certainly one of the most unforgettable, and indeed tragic, scenes in all the Frankenstein movies. If you have ever seen it, you will never forget it. A small child, Maria, shows the Monster how flowers float on the lake. He imitates what he observes. When the flowers are gone, he throws Maria into the water, apparently expecting her to float as the flowers did. The consequences are tragic. The Monster recognizes a pattern without understanding its context.

That distinction has obvious relevance for artificial intelligence and automated decision-making. A system may identify patterns, generate recommendations, and produce technically consistent outputs without understanding their broader legal, ethical, or business implications. A technically accurate output can still create an inappropriate result.

This is why human oversight cannot exist merely as language in an AI policy. Companies need to determine where human judgment is required, who provides that judgment, what qualifications reviewers need, when automated recommendations can be overridden, and how significant exceptions are documented.

Management should also understand whether human review is substantive or simply procedural. An employee clicking an approval button after an automated recommendation does not necessarily constitute meaningful oversight. The relevant control question is not simply whether the technology performed as designed. It is whether the resulting decision was appropriate.

Innovation Requires Accountability

Henry eventually discovers that creating something and controlling it require different capabilities. Corporate leaders should understand the same distinction. Management establishes incentive structures, sales strategies, compensation plans, technology deployments, acquisition strategies, third-party relationships, and performance expectations. Those decisions shape employee behavior and create risk. Leadership accountability therefore does not begin only after misconduct occurs. It begins with the decisions that establish the operating environment.

For the CCO, this means integrating compliance risk into strategic business decisions. For management, it means risk ownership remains with the business. For the board, oversight should focus on whether management has reasonable systems to identify, manage, monitor, and escalate significant risks. Compliance does not own a business risk simply because the compliance function identifies it. Management remains responsible for the business decision and the risks it creates.

That principle becomes particularly important with emerging technology. The CCO should contribute expertise regarding regulatory requirements, ethical considerations, controls, monitoring, and escalation. Technology leaders should contribute technical expertise. Legal, Privacy, Information Security, HR, Internal Audit, and other functions may have roles depending on the application. Business leadership remains accountable for the decision to deploy the technology and the resulting business risk.

Practical Actions for the CCO

Frankenstein suggests a practical agenda for compliance leadership. Compliance should move upstream and identify significant business processes where its participation adds the most value before making commitments. Emerging technology, acquisitions, market entry, compensation design, significant third parties, and new products are obvious candidates.

Risk assessment should occur before deployment and should address foreseeable legal, compliance, ethical, operational, and reputational consequences. High-risk inputs supplied by employees, vendors, third parties, acquisition targets, or technology systems should receive risk-based validation.

The organization should also define what credible challenge means in practice. Escalation procedures should be clear when Compliance and business leadership disagree about significant risk.

Finally, treat approval as the beginning of governance rather than its conclusion. Test controls, monitor outcomes, analyze exceptions, and update risk assessments as the business and technology evolve. The objective is not to slow innovation. It is to make innovation governable.

The Compliance Lesson

Frankenstein is not an argument against innovation. It is an argument for governance.

Henry Frankenstein failed not because he attempted something extraordinary. He failed because his technical ambition outpaced his ability to identify, understand, govern, and control the resulting risk.

Companies face the same challenge today. Technology will advance. Business models will change. New markets will open. Competitive pressure will accelerate decision-making. New risks will emerge. Compliance’s role is not to stand outside the laboratory and demand that the electricity be turned off.

It is to help ensure that management has assessed the risk, validated critical inputs, established appropriate controls, defined accountability, created meaningful challenge, and determined how the organization will respond if the initiative produces an unexpected result. The best time to build that governance structure is before deployment.

Our next installment moves the compliance analysis forward. In Bride of Frankenstein, Henry no longer faces an unknown risk. He has already experienced the consequences of his original experiment and understands what can go wrong. Then Dr. Pretorius persuades him to return to the laboratory.

The compliance issue is no longer whether leadership identified the risk. It is what happens when leadership knows better, but pressure, ambition, and rationalization push the organization toward the same risk again.

Check out Timothy and Fiona’s commentary on Frankenstein here.