Tag: M&A

Categories
Blog

CFIUS in 2026 and Beyond: Why Foreign Investment Risk Must Become a Core Compliance Priority

For years, many corporate compliance professionals saw the Committee on Foreign Investment in the United States (CFIUS) as primarily a concern for mergers-and-acquisitions attorneys. When a foreign investor sought to acquire a U.S. business, the legal team evaluated potential national security concerns, determined whether to file, and navigated the regulatory review process. Once the transaction closed, the matter often moved off the compliance radar. That approach is increasingly difficult to defend.

The recently released 2025 CFIUS Annual Report to Congress shows that foreign investment oversight has evolved into a sophisticated regulatory regime that includes transaction screening, national security investigations, mitigation agreements, ongoing compliance monitoring, and enforcement. In an analysis by Thaddeus McBride and Faith Dibble, CFIUS Annual Report Reveals Enforcement Trends highlights several developments that should command the attention of Chief Compliance Officers (CCOs), General Counsel, and corporate boards.

The key takeaway is that CFIUS compliance must become part of an organization’s broader enterprise risk management and internal controls framework. For compliance professionals, this creates both new responsibilities and opportunities to demonstrate the strategic value of an effective compliance program.

CFIUS Activity Remains High, and Scrutiny Is Intensifying

The numbers tell an important story. During 2025, CFIUS reviewed or assessed 347 covered transactions through written notices and declarations. Overall filing volume increased about 7 percent from 2024, driven primarily by a 21 percent increase in declarations.

Written notices remained relatively stable, declining approximately 1 percent. At first glance, the growing popularity of declarations might suggest that companies are finding more efficient ways to navigate the CFIUS process. However, the underlying statistics tell a more complicated story.

In 2024, approximately 78 percent of declarations resulted in CFIUS concluding action. That figure declined to approximately 66 percent in 2025. Meanwhile, the percentage of declarations resulting in requests for full written notices increased from 15 percent to 26 percent. This is significant. A declaration provides an abbreviated review process, generally involving a 30-day assessment. A full written notice involves an initial 45-day review, potentially followed by an additional 45-day investigation. For companies pursuing cross-border acquisitions, these timelines create substantial transaction uncertainty.

The compliance lesson: CFIUS risk assessment must occur during the earliest stages of transaction planning, not after the parties have negotiated their principal commercial terms.

CCOs should work closely with legal, corporate development, finance, and business leadership to ensure national security considerations are integrated into acquisition due diligence. The objective is not simply to determine whether a filing is required. It is to understand how regulatory risk may affect transaction structure, timing, valuation, and post-acquisition operations.

National Security Risk Extends Beyond Traditional Defense Industries

Another important finding concerns the industries attracting CFIUS attention. In 2025, finance, information, and services accounted for about 49.5 percent of non-real estate notices, while manufacturing accounted for another 39.5 percent. Together, these sectors accounted for nearly 90 percent of notices.

This demonstrates that CFIUS scrutiny extends well beyond traditional defense contractors and aerospace manufacturers. Companies in financial services, technology, telecommunications, data analytics, advanced manufacturing, and other commercial industries may hold assets that raise national security concerns.

Those assets may include sensitive personal information, proprietary technology, critical infrastructure, government contracts, or supply chain capabilities. Consider a foreign investor acquiring a U.S. technology company whose principal business involves collecting and analyzing consumer data.

The transaction may appear commercially straightforward. However, access to sensitive personal information, cybersecurity systems, or technology infrastructure could introduce significant national security considerations.

For CCOs, this means traditional anti-corruption and sanctions diligence is no longer sufficient when evaluating cross-border investments. A comprehensive assessment should examine beneficial ownership, sensitive technology, cybersecurity, data access, export controls, government relationships, and supply chain dependencies.

This is where compliance can provide real business value. By identifying these risks early, compliance professionals can help leadership make informed investment decisions before the organization commits substantial financial and operational resources.

Mitigation Agreements Are Continuing Compliance Obligations

Perhaps the most consequential findings for compliance professionals concern mitigation and enforcement. During 2025, CFIUS imposed mitigation measures and conditions in approximately 12 percent of transactions. At year-end, the committee monitored 234 mitigation agreements and conditions and conducted 40 compliance site visits.

These figures show that CFIUS oversight often continues long after a transaction closes. A mitigation agreement is not simply a legal document negotiated to obtain regulatory approval.

It establishes operational obligations that may require continuing monitoring, reporting, restrictions on access to information or technology, and other safeguards. Failure to implement those obligations effectively can create significant compliance and enforcement exposure.

This should sound familiar to anyone who has followed the Department of Justice’s approach to corporate compliance. Although CFIUS operates under a distinct legal framework, the underlying compliance principles mirror those in the DOJ’s Evaluation of Corporate Compliance Programs.

The compliance lesson: Every CFIUS mitigation agreement should be translated into an operational compliance framework with clearly assigned responsibilities. That framework should include documented procedures, employee training, testing, escalation protocols, and periodic management reporting. Internal audit should evaluate whether the organization is meeting its obligations.

The board or an appropriate board committee should receive meaningful information about significant mitigation requirements and compliance performance. The objective is to show not merely that the company agreed to certain restrictions, but that those restrictions work in practice.

Non-Notified Transactions Are Becoming an Enforcement Priority

During 2025, the committee investigated 90 potential non-notified transactions, opened 62 formal inquiries, and requested filings in nine cases. Two additional transactions were voluntarily submitted before CFIUS issued formal filing requests. These statistics show that CFIUS does not rely exclusively on companies to identify and report potentially covered transactions.

The committee obtains information through government agencies, congressional notifications, media reports, commercial databases, public tips, classified information, and voluntary disclosures. This has profound implications for corporate compliance.

Historically, some organizations may have viewed not filing as the conclusion of their CFIUS analysis. That assumption is increasingly risky. CFIUS can examine completed transactions and require parties to address national security concerns after closing. In certain circumstances, those concerns may result in mitigation obligations or divestiture.

The 2025 report identified seven transactions that parties abandoned after CFIUS could not identify acceptable mitigation or the parties declined proposed mitigation measures. Two matters also resulted in presidential orders prohibiting acquisitions or requiring divestment. For boards and senior executives, the implications are substantial.

The compliance lesson: Organizations should establish a documented process to evaluate CFIUS jurisdiction and filing obligations for relevant acquisitions and investments. Where management determines that a voluntary filing is unnecessary, the decision should be supported by a documented risk assessment. This documentation should explain the transaction’s ownership structure, relevant national security considerations, and rationale for the filing decision. A defensible decision-making process is essential to effective compliance governance.

Voluntary Self-Disclosure Must Be Part of the Compliance Conversation

The annual report also highlights CFIUS’s continued attention to voluntary self-disclosures involving potential mandatory-filing failures and violations of mitigation obligations. Importantly, the report notes that many instances of noncompliance do not result in penalties. This should not be interpreted as regulatory indifference. Rather, it reinforces the importance of identifying potential violations, investigating them promptly, and considering appropriate disclosure and remediation.

For compliance professionals familiar with the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, the broader principle is recognizable. Regulators place significant importance on how organizations respond when problems are discovered. However, CFIUS disclosure and enforcement procedures are distinct from DOJ criminal enforcement policies. Companies should not assume that DOJ disclosure incentives automatically apply to CFIUS matters.

The appropriate response starts with a credible internal process to identify and escalate concerns. Employees responsible for implementing mitigation agreements must understand their obligations and know how to report potential violations. Compliance teams should establish procedures to investigate concerns, preserve relevant evidence, determine root causes, and evaluate corrective action. Where a potential violation is identified, legal and compliance leadership should assess whether voluntary disclosure is appropriate under the applicable CFIUS framework.

What CCOs Should Do Now

The 2025 annual report provides a practical roadmap for strengthening foreign investment compliance.

  1. Incorporate CFIUS considerations into the enterprise risk assessment. Identify business activities, investment structures, and assets that may create national security exposure.
  2. Integrate CFIUS screening into transaction approval procedures. Require appropriate legal and compliance review before significant cross-border investments advance.
  3. Strengthen third-party and beneficial ownership diligence. Understanding who ultimately owns or controls an investor can be essential to identifying regulatory concerns.
  4. Establish ongoing monitoring for mitigation agreements. Assign control owners, set performance expectations, test periodically, and document remediation.
  5. Develop escalation and investigation procedures for potential violations. Ensure employees understand how to report concerns and management understands when disclosure decisions must be considered.
  6. Provide the board with meaningful reporting on material CFIUS risks, significant mitigation obligations, and emerging regulatory developments.

Conclusion: CFIUS Compliance Is a Lifecycle Responsibility

The 2025 CFIUS Annual Report reveals an enforcement environment characterized by sustained transaction activity, increased scrutiny of abbreviated filings, continuing mitigation oversight, and growing attention to transactions that were never submitted for review.

The fundamental lesson is straightforward. CFIUS risk begins before a transaction is signed and may continue long after the transaction closes. For CCOs, the challenge is to ensure that foreign investment compliance is integrated into governance, risk management, internal controls, and organizational accountability.

The companies best positioned to manage this environment will be those that identify national security risks early, make informed filing decisions, operationalize mitigation commitments, and continuously evaluate compliance effectiveness. CFIUS should no longer be viewed solely as a transaction approval process.

It is an ongoing compliance obligation that requires the same discipline, oversight, and commitment to continuous improvement expected of any effective corporate compliance program.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 3: Son of Frankenstein – Inheriting the Castle Means Inheriting the Risk

This October, Tom Fox returns to one of his all-time favorites: Universal Pictures’ Classic monsters. Over the years, Tom has explored classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, as well as films by Val Lewton and Hammer Studios. This year, he wanted to return for a deep dive into the first five Frankenstein movies. He has considered, or will consider, the original Frankenstein, Bride of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolfman. In this third episode, he considers what many viewers regard as the series’ best: Son of Frankenstein, released in 1939. This is the final film to feature Boris Karloff as Frankenstein’s Monster. In this exploration, Tom Fox uses his AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis:

Son of Frankenstein brings Basil Rathbone into the saga as Wolf von Frankenstein, who returns with his family to his father’s estate hoping to restore the Frankenstein name. Instead, he encounters Bela Lugosi’s extraordinary Ygor and discovers that his father’s Monster, played for the final time by Boris Karloff, is still alive but comatose. Wolf revives him, hoping to vindicate his father’s work, but Ygor has his own plans and uses the Monster to settle old scores. The result is another catastrophe created by a Frankenstein convinced that this time things will be different.

Key highlights:

  • You can inherit risk without creating it.
  • This is the M&A compliance movie.
  • Ygor represents institutional knowledge used for the wrong purpose.
  • Inspector Krogh represents institutional memory.
  • Red flags transform governance responsibility.

Popcorn and Compliance takeaway: You may not have created the Monster, but once you know he is in the basement, he becomes your governance problem.

Timothy and Fiona are AI-generated voices courtesy of NotebookLM.

Categories
Blog

Frankenstein and Compliance: Part 3 – Son of Frankenstein: You Inherited the Castle, You Inherited the Risk

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first two Frankenstein films present two distinct compliance failures. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands the risk but lets pressure, ambition, and rationalization override judgment. Son of Frankenstein (1939) presents the next stage: inherited risk, or in the business world, risks through acquisition.

Wolf von Frankenstein, played by Basil Rathbone, returns with his family to his ancestral estate hoping to restore the Frankenstein name. Instead, he encounters Ygor, played by Bela Lugosi, and discovers that his father’s Monster is still alive. Wolf had no role in creating the original problem, but his discovery forces him to decide how to address the legacy he has inherited.

That situation should be familiar to companies following acquisitions, leadership transitions, compliance investigations, or changes in the control environment. New management may have no connection to historical misconduct. An acquiring company may not have created the target’s problematic third-party relationships. A new CCO may inherit investigations and remediation projects that were initiated years earlier. Historical responsibility and current responsibility are different questions. The business issue is how management responds once a legacy risk becomes known.

The Castle Is an Acquisition

Think of Wolf’s return to the Frankenstein estate as an acquisition. He receives the property, assets, name, and opportunity to benefit from his father’s scientific legacy. He also assumes the consequences associated with that legacy. Corporate acquisitions work much the same way. Companies acquire revenue, customers, employees, technology, intellectual property, distribution networks, and market access. They may also inherit high-risk third parties, weak internal controls, questionable historical practices, unresolved investigations, government relationships, and cultural problems.

This is why compliance due diligence should focus on how the target actually conducts business rather than simply whether it has the expected compliance infrastructure. A target may have a Code of Conduct, an anti-corruption policy, annual training, and a hotline. Those are relevant data points, but they do not establish program effectiveness.

Compliance needs to understand the target’s business model and risk profile. Consider such questions as: Where does the business operate? Who are its customers? Does it interact with government agencies or state-owned entities? Which third parties generate or facilitate business? How does the company select and compensate those parties? What does the investigation history reveal? Are there recurring audit or control deficiencies? What does speak-up data indicate? Are significant policy exceptions concentrated in particular markets or business units? The objective is to understand the risk embedded in the business being acquired.

Due Diligence Is the Beginning, Not the End

Even well-designed pre-acquisition due diligence has limitations. Transactions operate under deadlines and time pressures. Access to employees and records may be restricted. (See: Opinion Release 08-02) Data may be incomplete. Privacy requirements may constrain review. Some risks simply do not become visible until the buyer gains access to systems, records, personnel, and financial information after closing. Those limitations make the connection between due diligence and post-acquisition integration critical.

If the buyer cannot complete diligence on a high-risk distributor before closing, that relationship should become a post-closing priority. If investigation records are incomplete, they should be reviewed during integration. If significant controls cannot be tested before the transaction, testing should be incorporated into the integration plan. Compliance should therefore document unresolved diligence issues and carry them forward with assigned owners and deadlines.

This discipline matters because closing creates competing priorities. Management quickly shifts to customers, systems, personnel, financial reporting, cost savings, and expected synergies. Compliance integration can become one workstream among many. An unanswered compliance question doesn’t become less significant once the transaction closes.

Post-Acquisition Integration Is the Operational Test

An acquiring company can conduct excellent due diligence and still create exposure if it fails to integrate the acquired business effectively. Post-acquisition integration is where the buyer’s compliance expectations become operational. Employees need to understand the acquiring company’s Code of Conduct, policies, reporting mechanisms, investigation procedures, third-party requirements, approval processes, and internal controls. High-risk third parties may require additional diligence. Contracts may need updated compliance provisions. Financial controls may need harmonization. Employees need risk-appropriate training.

Integration should also reflect the acquired company’s actual risk profile. A business operating primarily in lower-risk markets with direct sales may require a different approach than a company that depends on agents and distributors in jurisdictions with substantial government interaction. Do not apply the same integration checklist mechanically to every acquisition.

The CCO should know which issues require immediate attention, which can be addressed over a reasonable integration period, and who is accountable for each significant action. Without ownership and monitoring, temporary integration gaps can become lasting control weaknesses.

Ygor and the Informal Organization

Ygor provides one of the movie’s most useful compliance lessons. He understands the Frankenstein estate better than Wolf does. He knows its history, its secrets, and how things actually work. Every organization has a formal structure and an informal operating system. The organizational chart describes reporting relationships. Policies describe required processes. Procedures identify approvals. Employees know how business actually gets done.

They know which approvals receive meaningful scrutiny and which are largely administrative. They know which managers routinely approve exceptions. They know which third parties have special relationships with executives. They know which controls become flexible near quarter-end. They know whether raising a concern is welcomed or career-limiting. This is why compliance risk assessment cannot rely exclusively on documents.

Policies lay out how an organization is supposed to operate. Interviews, focus groups, hotline information, investigations, transaction testing, third-party monitoring, audit findings, and employee surveys can show how it operates in practice. That distinction becomes particularly important following an acquisition. The buyer needs to understand not only the target’s compliance architecture but also its operating culture.

Institutional Memory Is a Compliance Control

Inspector Krogh represents the other side of organizational knowledge. He remembers the consequences of the original Frankenstein experiment because he experienced them personally. His perspective is shaped by history, not by Wolf’s confidence that the past can be managed differently. Companies need mechanisms for preserving similar institutional knowledge.

Investigations produce knowledge. Internal audits produce knowledge. Regulatory inquiries produce knowledge. Compliance monitoring and remediation projects produce knowledge. That knowledge can disappear surprisingly quickly. Employees retire. CCOs leave. Executives change roles. Board members rotate. Investigations close. Outside counsel completes an engagement. Remediation projects are marked complete.

Years later, new management may propose a business arrangement, third-party relationship, market strategy, or control change similar to one the organization previously determined was problematic. An effective compliance program should prevent important lessons from depending entirely on the memories of individual employees.

Significant investigation findings should inform future risk assessments. Root causes should influence control design. Remediation lessons should affect monitoring. Historical third-party concerns should remain available when relationships are reconsidered. An investigation’s purpose is not simply to resolve an allegation. It should also improve the organization’s understanding of its risks.

New Leadership and the Risk of Exceptionalism

Wolf demonstrates another challenge common to leadership transitions. New leaders often believe they can manage risks that previous leaders could not. Sometimes they can. New leadership may bring stronger systems, better controls, additional resources, and improved judgment. The problem arises when confidence leads management to discount why earlier controls or restrictions were established.

A new sales executive may propose reengaging a distributor previously terminated for compliance concerns. A new CEO may reconsider a market that previous management considered too risky. A new business leader may conclude that an approval requirement imposed after earlier misconduct is unnecessarily restrictive. Any of those decisions may be appropriate. Controls should not remain in place indefinitely simply because they are old. But management should understand the history before changing them.

Before removing a control, determine why it was created. Before reengaging a third party, understand why the relationship ended. Before changing monitoring requirements, identify the risk they were designed to address. Some controls become obsolete. Others represent lessons learned. Good governance distinguishes between the two.

Red Flags and the Governance Response

The central compliance issue arises when Wolf learns the Monster is alive. At that point, the question moves from discovery to response. Corporate compliance systems serve a similar purpose. Internal controls, monitoring, Internal Audit, risk assessments, investigations, hotlines, and management reporting should surface significant information.

The effectiveness of those systems depends upon what happens after the information arrives. The Evaluation of Corporate Compliance Programs (ECCP) suggests such inquiries as: Was the issue investigated? Was it escalated appropriately? Did management assign remediation? Was completion tracked? Was effectiveness tested? Did significant information reach the board or appropriate committee? A sophisticated reporting system provides little protection if material concerns repeatedly reach decision-makers without producing action.

For a CCO, this means escalation protocols matter. The organization should understand which issues remain within normal management processes, which require senior management attention, and which warrant board notification.

Legacy Third Parties Require Fresh Review

Inherited third-party relationships deserve particular attention because longevity can create a false sense of security. The distributor has worked with the business for fifteen years. The consultant is well known locally. The customs broker has always handled interactions with government agencies. No significant problems have been reported previously. Those facts provide context. They do not replace risk-based oversight.

Acquisitions and leadership transitions provide an opportunity to reassess significant legacy relationships. Is the third party still necessary? Is the business rationale documented? Is beneficial ownership information current? Has the risk profile changed? Are payment arrangements appropriate? Are contracts current? Has monitoring identified concerns? Longstanding relationships should not automatically be grandfathered into the current compliance program. Some may warrant closer attention precisely because they were established under different controls, different management, and different expectations.

Practical Actions for the CCO

Son of Frankenstein suggests a practical agenda for compliance leadership. Due diligence should examine actual business operations, not just the existence of policies. Unresolved diligence issues should move directly into the integration plan with defined ownership and deadlines. Integration should be risk-based and should include controls, training, reporting mechanisms, investigations, and third-party oversight.

Significant legacy third parties should be reassessed rather than automatically accepted. Preserve investigation findings and past control failures as institutional knowledge and incorporate them into future risk assessments. New leadership should understand why significant controls were established before deciding to eliminate or weaken them. Finally, significant inherited risks should have clear owners. Issues that sit between the transaction team, business leadership, Legal, Compliance, Finance, and Internal Audit can otherwise remain unresolved because everyone assumes someone else is responsible.

The Compliance Lesson

Son of Frankenstein demonstrates the difference between responsibility for creating a problem and responsibility for managing one. Organizations routinely inherit compliance risks through acquisitions, leadership transitions, longstanding business practices, third-party relationships, and unresolved control weaknesses. New management should not be treated as responsible for conduct that occurred before it arrived. Its responsibility begins with the response.

Effective compliance requires the organization to identify inherited risks, prioritize them by significance, assign ownership, integrate acquired operations, preserve institutional knowledge, and verify corrective actions. That is the business lesson from Wolf von Frankenstein’s return to the family estate. The value of an inheritance cannot be separated from its risks.

The next stage of the Frankenstein story raises another familiar compliance issue. Organizations can identify problems, investigate them, revise policies, conduct training, complete remediation plans, and close findings. Yet sometimes the same problem returns.

In our next selection, we consider The Ghost of Frankenstein. In this movie, the compliance issue is no longer discovery or inheritance. It is program effectiveness. If management says the problem has been remediated, what evidence demonstrates that the remediation actually worked?

For a discussion on these topics and a review of the movie, check out Timothy and Fiona in this episode of Popcorn and Compliance.

Categories
Red Flags Rising

Red Flags Rising: M&A and Export Controls – From Art of War to Art of the Deal

Mike and Brent revisit a discussion recorded in May 2026, before the prior US-China trade summit, which is timely again with the next round of meetings coming up on September 24, 2026. They also highlight their May 2026 national security enforcement and compliance event in Washington, DC, where Assistant Secretary for Enforcement David Peters spoke. Then they discuss how companies can best manage US export control risks in the context of M&A pre- and post-acquisition due diligence.

Specifically, Mike and Brent set the stage for the M&A discussion (01:49); preview what Sun Tzu’s Art of War means for the upcoming negotiations (03:50); provide a recap of their May 5, 2026, national security compliance and enforcement event in Washington, DC, and the key takeaways from the event in terms of M&A and export controls (05:36); discuss Brent’s recent NYU Program on Corporate Compliance & Enforcement (PCCE) article and how Brent’s Fraud Four-Circle Framework (SM) can help with pre-acquisition due diligence based on some anecdotal evidence from his own experience (10:32); some anecdotes from Mike’s experience (14:43); how export controls now pose “central compliance risks” in terms of boards of directors’ duty of oversight under Delaware law (20:35); and how these ideas can help sellers, not just buyers (23:36);

Mike and Brent then conclude with the latest installment of Brent’s “Managing Up” segment (24:41).

Contact Brent: brent@redflagsrising.com

More about Brent: www.redflagsrising.com/founder

Connect with Brent on LinkedIn

Brent’s article referenced in the episode: Brent Carlson, “A Light Shines Through the Darkness in Disputes, Investigations, and Trade Compliance: A Fresh Look at the Classic Fraud Triangle with the Fraud Four-Circle Framework℠,” NYU PCCE (Jan. 8, 2026)

Contact Mike: michael.huneke@morganlewis.com

More about

Mike: https://www.morganlewis.com/bios/michaelhuneke

Connect with Mike on LinkedIn

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 66 – Warp-Speed M&A Risks: Hidden Lessons from “Wink of an Eye”

Today, we’re setting our sensors on one of Star Trek: The Original Series’ most thought-provoking episodes—“Wink of an Eye.” While this story may not feature the grand courtrooms or battlefields you might expect for compliance lessons, it’s a goldmine for any compliance officer, in-house counsel, or business leader navigating the perilous and rapidly accelerating world of mergers and acquisitions.

In the world of M&A, deals can go from zero to warp speed in the blink of an eye, and those left operating in “normal” time often find themselves blindsided by risks, unseen motives, and cultural misalignments. Today, we use the lens of “Wink of an Eye” to explore five critical M&A lessons for today’s compliance professional.

Lesson 1: Beware the Dangers of Unseen Agendas

Illustrated by: The Scalosians are present, but moving too fast to be detected; observing, manipulating, and acting without the crew’s awareness.

Compliance M&A Lesson. In every M&A transaction, some risks and agendas may not be immediately visible.

Lesson 2: Speed Kills—Or at Least, Blindsides

Illustrated by: Captain Kirk and his crew are thrust into a reality where the Scalosians’ actions occur at warp speed.

Compliance M&A Lesson. Pressure to “get the deal done” quickly is endemic in today’s market. Boardroom bravado, aggressive timelines, or fear of losing out to a competitor can push compliance to the back burner.

Lesson 3: Cultural Misalignment Can Doom Even the Smartest Teams

Illustrated by: Kirk, once accelerated, finds himself isolated, unable to communicate or coordinate with his crew, who remain “out of phase.” The gulf between realities leads to mistrust, confusion, and near-catastrophe.

Compliance M&A Lesson. One of the most underestimated risks in any deal is cultural misalignment.

Lesson 4: Technology—Friend, Foe, or Trojan Horse?

Illustrated by: The Scalosians secretly tamper with the Enterprise’s environmental systems, seeking to convert the crew and ship to their needs.

Compliance M&A Lesson. Every acquisition brings a technology integration challenge and, with it, a potential compliance nightmare. Legacy systems may be vulnerable, riddled with security holes, or subject to data localization rules you never anticipated.

Lesson 5: Communication Is the Antidote to Chaos

Illustrated by: As chaos mounts, Kirk finds creative ways to bridge the communication divide—leaving clues and working with Spock to slow himself down, eventually restoring balance to the ship.

Compliance M&A Lesson. All too often, compliance is left out of critical conversations during a deal or brought in too late, when the train has already left the station. Information silos, unclear chains of command, or poor stakeholder engagement leave gaps where risk thrives.

Final ComplianceLog Reflections

“Wink of an Eye” is more than a sci-fi tale of hyper-acceleration and hidden threats. It’s a vivid parable for compliance officers tasked with shepherding organizations through the labyrinth of mergers and acquisitions. When the pace picks up and risks move faster than you can see, it’s easy to lose sight of the fundamentals. But as Star Trek teaches us, it’s precisely at these moments that discipline, vigilance, and creativity matter most.

In the ever-accelerating world of M&A, compliance is the brake that allows your ship to arrive safely, whatever the speed of your journey. So, the next time your organization beams into a new deal, ask yourself: Are you seeing the whole picture or missing the real action because it’s moving at the speed of a wink?

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Blog

When Time Accelerates: Five M&A Lessons from Star Trek’s “Wink of an Eye”

Today, we’re setting our sensors on one of Star Trek: The Original Series’ most thought-provoking episodes—“Wink of an Eye.” While this story may not feature the grand courtrooms or battlefields you might expect for compliance lessons, it’s a goldmine for any compliance officer, in-house counsel, or business leader navigating the perilous and rapidly accelerating world of mergers and acquisitions.

For those unfamiliar with the episode, “Wink of an Eye” finds the crew of the USS Enterprise responding to a distress call from the planet Scalos. But as soon as they beam down, most of the away team seem to vanish—or so it appears. In reality, the Scalosians exist in a hyper-accelerated state, moving so quickly that to the Enterprise crew, they’re invisible. Before long, Captain Kirk is forcibly accelerated to join them and quickly discovers the perils of operating at different speeds, hidden agendas, and the catastrophic results of unchecked assumptions.

Sound familiar? In the world of M&A, deals can go from zero to warp speed in the blink of an eye, and those left operating in “normal” time often find themselves blindsided by risks, unseen motives, and cultural misalignments. Today, we use the lens of “Wink of an Eye” to explore five critical M&A lessons for today’s compliance professional.

Lesson 1: Beware the Dangers of Unseen Agendas

Illustrated by: The Enterprise crew responds to a distress signal, only to find an abandoned city. In truth, the Scalosians are present but moving too fast to be detected, observing, manipulating, and acting without the crew’s awareness.

Compliance M&A Lesson. In every M&A transaction, some risks and agendas may not be immediately visible. Target companies may appear transparent, but unseen issues, ranging from latent liabilities to regulatory exposures or even toxic cultures, can operate just out of sight. Compliance professionals must be vigilant for “hyper-accelerated” problems: sudden regulatory changes, emerging enforcement risks, or compliance gaps that could metastasize after closing.

What should you do now? Never assume what you can’t see can’t hurt you. Invest in robust, multilayered due diligence. Do not rely solely on surface-level representations. Engage with local counsel, scrutinize whistleblower hotlines, and dig deep for signs of hidden trouble.

Lesson 2: Speed Kills—Or at Least, Blindsides

Illustrated by: Captain Kirk and his crew are thrust into a reality where the Scalosians’ actions occur at warp speed. The Scalosians manipulate the ship’s systems, jeopardizing the Enterprise, all before the crew can respond.

Compliance M&A Lesson. Pressure to “get the deal done” quickly is endemic in today’s market. Boardroom bravado, aggressive timelines, or fear of losing out to a competitor can push compliance to the back burner. But as the Enterprise learned, speed without visibility or controls can spell disaster. When critical steps are skipped or rushed, whether in compliance, due diligence, or integration planning, the seeds for future crises are sown.

What should you do now? Fight the tyranny of the urgent. If deal velocity is forced, demand appropriate pauses for compliance risk assessment. Build “speed bumps” into the process: no sign-off until compliance and legal due diligence are complete, and clear escalation paths for unresolved red flags.

Lesson 3: Cultural Misalignment Can Doom Even the Smartest Teams

Illustrated by: Kirk, once accelerated, finds himself isolated, unable to communicate or coordinate with his crew, who remain “out of phase.” The gulf between realities leads to mistrust, confusion, and near-catastrophe.

Compliance M&A Lesson. One of the most underestimated risks in any deal is cultural misalignment. Whether it’s differences in compliance cultures, attitudes toward regulation, or simply management style, these differences are often invisible until they aren’t. Like Kirk trying to bridge the gap between two timelines, post-deal integration can become a chaotic, error-prone process if cultural divides aren’t acknowledged and addressed.

What should you do now? Assess and plan for cultural integration from Day One. Compliance must have a seat at the table, not just for “hard” issues like controls and policies, but for the “soft” issues that often determine long-term success. Early joint training, culture assessments, and leadership buy-in are vital.

Lesson 4: Technology—Friend, Foe, or Trojan Horse?

Illustrated by: The Scalosians secretly tamper with the Enterprise’s environmental systems, seeking to convert the crew and ship to their needs. Their subtle manipulations are initially undetectable, nearly leading to disaster.

Compliance M&A Lesson. Every acquisition brings a technology integration challenge and, with it, a potential compliance nightmare. Legacy systems may be vulnerable, riddled with security holes, or subject to data localization rules you never anticipated. “Plug and play” is rarely plug-and-play. Worse, legacy tech can act as a “Trojan Horse,” hiding systemic weaknesses, cyber risk, or even evidence of past misconduct.

What should you do now? Demand comprehensive IT and data risk assessments before closing. Ensure data mapping is part of due diligence. Post-acquisition, prioritize integration of compliance tech solutions, hotlines, monitoring tools, and incident management platforms to avoid inheriting someone else’s problems.

Lesson 5: Communication Is the Antidote to Chaos

Illustrated by: As chaos mounts, Kirk finds creative ways to bridge the communication divide—leaving clues and working with Spock to slow himself down, eventually restoring balance to the ship.

Compliance M&A Lesson. All too often, compliance is left out of critical conversations during a deal or brought in too late, when the train has already left the station. Information silos, unclear chains of command, or poor stakeholder engagement leave gaps where risk thrives. Success in M&A is measured not just in legal agreements but in the effectiveness of communication between all parties before, during, and after the deal.

What should you do now? Champion open, continuous communication throughout the deal lifecycle. Establish clear escalation channels. Engage early and often with all stakeholders—from executive leadership to local compliance officers at the target entity. After closing, maintain the cadence: town halls, FAQs, and feedback loops can help manage uncertainty and set expectations.

Final ComplianceLog Reflections

“Wink of an Eye” is more than a sci-fi tale of hyper-acceleration and hidden threats. It’s a vivid parable for compliance officers tasked with shepherding organizations through the labyrinth of mergers and acquisitions. When the pace picks up and risks move faster than you can see, it’s easy to lose sight of the fundamentals. But as Star Trek teaches us, it’s precisely at these moments that discipline, vigilance, and creativity matter most.

In the ever-accelerating world of M&A, compliance is the brake that allows your ship to arrive safely, whatever the speed of your journey. So, the next time your organization beams into a new deal, ask yourself: Are you seeing the whole picture or missing the real action because it’s moving at the speed of a wink?

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 54 – Beneath the Surface: Uncovering M&A Risk with Guidance from ‘Bread and Circuses’

If there is one area in business where risk, opportunity, and culture collide, it is in mergers and acquisitions. The promise of new markets, talent, and technology is always balanced against the possibility of hidden liabilities, clashing values, and operational chaos. In the world of corporate compliance, no moment is more perilous or more revealing than when companies come together.

Star Trek: The Original Series’ episode “Bread and Circuses” offers an unlikely but fitting parable for M&A compliance professionals. Here are five key compliance-related M&A due diligence lessons from “Bread and Circuses.”

Lesson 1: Go Beyond Surface Appearances—Assess the True Culture

Illustrated by: On the planet 892-IV, Kirk and his landing party discover an authoritarian state built on forced entertainment and oppression.

Compliance M&A Lesson: It is easy to be seduced by a target company’s top-line numbers, glossy facilities, and impressive management presentations. However, proper due diligence requires a thorough examination beneath the surface.

Lesson 2: Identify Hidden Liabilities—Don’t Ignore the Risks Beneath the Entertainment

Illustrated by: The population of 892-IV, which is kept docile through violent gladiatorial games that serve as literal bread and circuses.

Compliance M&A Lesson: Effective due diligence involves identifying these concealed dangers. Compliance professionals must review litigation histories, regulatory filings, and environmental and safety records, as well as ongoing investigations and audits, to ensure compliance.

Lesson 3: Map Third-Party and Supply Chain Risks—Everyone in the Arena Matters

Illustrated by: Kirk discovers that the planet’s leader, Merikus, is a missing Starfleet captain who has chosen to assimilate rather than resist.

Compliance M&A Lesson: No company operates in isolation. A target company’s third-party relationships, joint ventures, and supply chains can be sources of immense risk; think FCPA, anti-bribery, human rights violations, or simply the risk of operational disruption.

Lesson 4: Understand Local Laws, Customs, and Power Structures—Context Is Everything

Illustrated by: Spock and McCoy are baffled by the local laws and power dynamics.

Compliance M&A Lesson: Every M&A deal is shaped by its legal, regulatory, and cultural context. Don’t assume what works in your home country will transfer easily.

Lesson 5: Don’t Underestimate the Human Element—Values and Ethics Matter

Illustrated by: Throughout the episode, it is the values and resolve of the Enterprise crew and the oppressed “Children of the Sun” that make resistance to tyranny possible. The episode ends not with a technical solution, but with an ethical stand.

Compliance M&A Lesson: Values alignment is not just a “soft” factor; it’s a predictor of post-merger success and resilience in a crisis.

Final ComplianceLog Reflections

“Bread and Circuses” is more than just a classic science fiction adventure. It is a powerful parable for today’s compliance professional navigating the high-stakes world of mergers and acquisitions. For compliance officers, the episode’s narrative reinforces that adequate due diligence must go far beyond the numbers and surface-level impressions. It requires a holistic investigation into the culture, values, and relationships that truly define an organization. The success or failure of a merger often hinges on the ability to identify hidden liabilities, assess third-party and supply chain risks, and deeply understand the legal and regulatory landscape unique to each deal.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Blog

Beyond the Arena: M&A Due Diligence Lessons from Star Trek’s ‘Bread and Circuses’

If there is one area in business where risk, opportunity, and culture collide, it is in mergers and acquisitions. The promise of new markets, talent, and technology is always balanced against the possibility of hidden liabilities, clashing values, and operational chaos. In the world of corporate compliance, no moment is more perilous or more revealing than when companies come together.

Star Trek: The Original Series’ episode “Bread and Circuses” offers an unlikely but fitting parable for M&A compliance professionals. The Enterprise crew stumbles upon a planet with a civilization that mirrors Ancient Rome: gladiatorial games, a rigid class system, and a society that on the surface appears functional but underneath hides deep ethical and existential fault lines. As Captain Kirk, Mr. Spock, and Dr. McCoy navigate the complexities of this alien world, compliance professionals can draw out critical lessons for conducting effective due diligence in the high-stakes world of mergers and acquisitions.

Here are five key compliance-related M&A due diligence lessons from “Bread and Circuses.”

Lesson 1: Go Beyond Surface Appearances—Assess the True Culture

Illustrated by: On the planet 892-IV, Kirk and his landing party are initially impressed by the planet’s technological advancement. It boasts twentieth-century comforts, such as television, cars, and an advanced infrastructure. Yet, beneath the veneer, they discover an authoritarian state built on forced entertainment and oppression.

Compliance M&A Lesson: It is easy to be seduced by a target company’s top-line numbers, glossy facilities, and impressive management presentations. However, true due diligence requires a thorough examination beneath the surface. What’s the real culture? Is there a hidden culture of fear, ethical lapses, or compliance gaps? Cultural misalignment is one of the top reasons M&A deals fail. The Enterprise’s discovery of “Rome with cars” is a reminder to go beyond the show. Investigate how employees act when management isn’t around, what values truly drive decisions, and whether there’s a “bread and circuses” dynamic masking underlying dysfunction.

What should you do? Interview employees at every level, not just leadership. Review whistleblower hotlines, past HR investigations, and third-party reviews to reveal what may be hidden.

Lesson 2: Identify Hidden Liabilities—Don’t Ignore the Risks Beneath the Entertainment

Illustrated by: The population of 892-IV, which is kept docile through violent gladiatorial games that serve as literal bread and circuses. The ruling class avoids unrest by distracting the masses, but the peace is an illusion. When Kirk, Spock, and McCoy are thrust into the games, the underlying brutality and danger become clear.

Compliance M&A Lesson: In any transaction, there may be hidden liabilities—such as ongoing investigations, regulatory risks, potential litigation, or toxic business practices that have been overlooked or concealed. The “games” may keep things running, but only until something disrupts the balance. Effective due diligence involves identifying and addressing these hidden dangers. Compliance professionals must review litigation histories, regulatory filings, and environmental and safety records, as well as ongoing investigations and audits.

What should you do? First, do not be distracted by “good news only” presentations.

Request full disclosure of pending investigations, lawsuits, and regulatory actions. Utilize forensic audits and data analytics to examine financials and operational practices thoroughly.

Lesson 3: Map Third-Party and Supply Chain Risks—Everyone in the Arena Matters

Illustrated by: Kirk discovers that the planet’s leader, Merikus, is a missing Starfleet captain who has chosen to assimilate rather than resist. He justifies his choices as necessary for survival, but his complicity also enables oppression and exposes him to risk.

Compliance M&A Lesson: No company operates in isolation. A target company’s third-party relationships, joint ventures, and supply chains can be sources of immense risk, including FCPA, anti-bribery, human rights violations, and operational disruptions. Merikus’s collaboration illustrates how easily “good people” can enable unfavorable outcomes when incentives are misaligned. Map out all third-party relationships and conduct risk-based due diligence on significant partners.

What should you do? Consider the reputational and regulatory risks that the combined entity could pose. Are there red flags in high-risk geographies or industries? Implement a robust third-party due diligence program pre- and post-acquisition. Prioritize high-risk vendors and intermediaries for enhanced review.

Lesson 4: Understand Local Laws, Customs, and Power Structures—Context Is Everything

Illustrated by: Spock and McCoy are baffled by the local laws and power dynamics. What seems irrational by Federation standards makes sense only in the context of this world’s history and social structure. Understanding these nuances proves vital for their survival and escape.

Compliance M&A Lesson: Every M&A deal is shaped by its legal, regulatory, and cultural context. Don’t assume what works in your home country will transfer easily. Local labor laws, anti-corruption regimes, data privacy rules, and unwritten power structures can significantly impact an integration. A failure to appreciate these nuances can result in compliance violations, regulatory penalties, or reputational damage after the deal closes. Contextual awareness—legal and cultural—is non-negotiable.

What should you do? Partner with local counsel and compliance experts to conduct a jurisdiction-by-jurisdiction review. Document and plan for local regulatory requirements in the integration roadmap.

Lesson 5: Don’t Underestimate the Human Element—Values and Ethics Matter

Illustrated by: Throughout the episode, it is the values and resolve of the Enterprise crew—and the oppressed “Children of the Sun”—that make resistance to tyranny possible. The episode ends not with a technical solution, but with an ethical stand.

Compliance M&A Lesson: No due diligence checklist can substitute for evaluating the ethical climate and values of a target organization. Are there tone-at-the-top issues? Does the company reward ethical behavior or cut corners? Is there a history of retaliation against whistleblowers? Ultimately, mergers are about people, bringing together teams, customers, and cultures. Values alignment isn’t just a “soft” factor; it’s a predictor of post-merger success and resilience in a crisis.

What should you do? Include values and ethical culture assessments in your due diligence. Leverage employee surveys, exit interviews, and culture audits to gauge whether ethics are truly embedded.

Final ComplianceLog Reflections

“Bread and Circuses” is more than just a classic science fiction adventure. It is a powerful parable for today’s compliance professional navigating the high-stakes world of mergers and acquisitions. As the Enterprise crew discovers, the trappings of prosperity and modernity can easily mask underlying risks, cultural misalignments, and ethical fault lines that, if left unexamined, can undermine even the most promising deal.

For compliance officers, the episode’s narrative reinforces that effective due diligence must go far beyond the numbers and surface-level impressions. It requires a holistic investigation into the culture, values, and relationships that truly define an organization. The success or failure of a merger often hinges on the ability to identify hidden liabilities, assess third-party and supply chain risks, and deeply understand the legal and regulatory landscape unique to each deal. Just as

Kirk and his team had to adapt to a world with its own rules and power structures. Compliance professionals must approach every transaction with humility, curiosity, and an unwavering commitment to ethical standards. In the arena of M&A, organizations that thrive are those that embrace rigorous, context-driven due diligence, protecting not only their assets but also their reputation and long-term success. The “arena” of M&A is as perilous as any gladiatorial contest. With rigorous, holistic due diligence, compliance officers can ensure their organizations don’t become unwitting spectators to someone else’s bread-and-circuses.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Blog

The Warner Bros. Bidding War: Part 3 – The CCO Playbook for Transactions Under Pressure

The Warner Bros. Bidding War: Part 3 – The CCO Playbook for Transactions Under Pressure

The Warner Bros. (WBD) bidding war is not simply a Board story. It is a compliance operating model test. When a superior proposal emerges, the Chief Compliance Officer (CCO) must move from program design to execution discipline. Today, we conclude our short review of the Warner Bros./Netflix/Paramount dance and sale by considering lessons for the compliance professional.

In Part 1, we focused on the deal mechanics that led Warner Bros. Discovery to move from an agreed transaction with Netflix to a superior proposal from Paramount Skydance. In Part 2, the focus shifted to Board governance and fiduciary duty. This final post, Post 3, answers the operational question. What must the Chief Compliance Officer do when the process accelerates and governance must be proven in real time?

The answer is grounded in the DOJ’s Evaluation of Corporate Compliance Programs (ECCP). The core question remains constant. Is the program working in practice? A live transaction provides the answer.

Move Compliance Into the Transaction Control Room

Too many compliance functions treat M&A as a legal and financial activity. That approach fails when the transaction becomes contested. Once a superior proposal is identified, the compliance function must:

  • Participate in transaction governance meetings
  • Map control risks across disclosure, communications, and decision-making
  • Establish escalation pathways for new information

This is consistent with the expectations embedded in the DOJ’s Corporate Enforcement Policy, which rewards companies that demonstrate real-time awareness, escalation, and action. A compliance function that is not present during the decision-making process cannot later demonstrate that controls were effective.

Build and Execute an Evidence Protocol

The most significant compliance failure point in transactions is not misconduct. It is the absence of a reliable evidentiary record. In the WBD process, multiple streams of information were created simultaneously:

  • Board materials
  • Banker communications
  • Draft proposals and revisions
  • Internal analyses and emails

The CCO must ensure that the company has an evidence-based protocol that includes:

  • Centralized collection of transaction-related materials
  • Defined custodians for document integrity
  • Time-stamped records of key decisions and communications

Under the DOJ’s framework, this directly ties to the question of whether the company can demonstrate effectiveness through data and documentation. If the company cannot reconstruct its decision-making process, it cannot defend it.

Treat Disclosure Controls as a Real-Time Compliance System

Post 2 emphasized that disclosure is a governance issue. For the CCO, it is a control system. The compliance function should validate that:

  • The disclosure committee is activated and functioning continuously
  • There is a clear trigger matrix for Form 8-K filings and proxy updates
  • All external communications are coordinated and controlled

This is not theoretical. In a contested transaction, the volume and speed of information create a risk of selective disclosure, inconsistent messaging, or delayed filings. The CCO must ensure that disclosure controls meet the same standard as financial controls. They must be tested, documented, and operational.

Control Third-Party and Advisor Risk

Transactions introduce intense third-party engagement. Investment banks, legal advisors, consultants, and communications firms all operate at speed. In the WBD scenario, third-party actions included:

  • Structuring revised proposals
  • Communicating deal terms
  • Interacting with market participants

The CCO must ensure:

  • Clear protocols for third-party communications
  • Defined boundaries on who can speak on behalf of the company
  • Documentation of all material third-party interactions

This aligns with long-standing expectations under the Foreign Corrupt Practices Act (FCPA) and the broader third-party risk principles embedded in compliance programs. Even in a domestic transaction, third-party risk remains a control issue.

Align Governance With Internal Controls Frameworks

The events described in Parts 1 and 2 map directly onto internal control frameworks such as the COSO Internal Controls Framework. For the CCO, this means:

  • Control Environment: Tone at the top regarding disciplined decision-making
  • Risk Assessment: Identification of disclosure, litigation, and regulatory risks
  • Control Activities: Implementation of approval processes and documentation protocols
  • Information and Communication: Real-time disclosure and coordination
  • Monitoring: Ongoing review of transaction-related controls

This mapping is not academic. It is how the company demonstrates that governance is structured, repeatable, and effective.

Prepare for Day Two Risk

The transaction does not end with signing or closing. It creates a new risk profile. The CCO must plan for:

  • Integration of compliance programs across entities
  • Review of legacy decisions made during the transaction process
  • Preservation of records for litigation or regulatory review

This is where the DOJ’s focus on continuous improvement becomes critical. The company must show that it learns from the transaction and strengthens its program.

Connecting the Lessons Across the Series

Part 1 showed that deal terms, including termination fees and superior proposal mechanics, can change outcomes. Part 2 demonstrated that the Board must govern those changes through documented, disciplined processes. In Part 3, we demonstrated the connections between the two. The compliance function is the mechanism that allows the company to prove that governance worked. Without compliance execution, governance is an assertion. With compliance execution, governance becomes evidence.

Practical Action Steps for CCOs

  1. Embed compliance into the transaction governance structure at the outset of any deal.
  2. Implement an evidence protocol that captures all material transaction activity in real time.
  3. Test disclosure controls under accelerated conditions, including mock 8-K scenarios.
  4. Define and enforce third-party communication protocols.
  5. Map transaction governance to COSO and DOJ ECCP requirements before a contested situation arises.

Questions for the CCO

  1. If a regulator requested the full decision record tomorrow, could the company produce it?
  2. Are disclosure controls capable of operating continuously under transaction pressure?
  3. Is there a single source of truth for transaction-related documentation?
  4. Are third-party interactions fully documented and controlled?
  5. Has the compliance program been stress-tested in a high-speed governance scenario?

Final Thoughts

The Warner Bros. Discovery bidding war is not unique. What is unique is how clearly it illustrates the modern role of the Chief Compliance Officer. Compliance is no longer limited to preventing misconduct. It is responsible for enabling the company to act, decide, and disclose with integrity under pressure and then prove it. That is the standard set by the DOJ. That is the expectation of Boards. And that is the future of the compliance profession.

 

Categories
Blog

The Warner Bros. Bidding War: Part 2 – Board Governance Under Pressure

When a superior proposal emerges, the Board is no longer evaluating strategy. It is proving governance. The Warner Bros. transaction shows how fiduciary duty, disclosure discipline, and control execution must function in real time. We are exploring Warner Bros./Netflix/Paramount’s bidding and purchase processes for lessons for the compliance professional. In Part 1, we focused on what happened. This post focuses on how the Board must respond when events accelerate.

The process moved from a negotiated transaction with Netflix to a contested situation with a rival bidder, Paramount. At that moment, the Board’s role shifted from approving a deal to managing an auction under fiduciary duty. This is the precise moment contemplated by Delaware fiduciary law and the Board oversight obligations often framed through the lens of Caremark duties. The question is no longer whether the Board can approve a transaction. The question becomes whether the Board can demonstrate that it acted on an informed basis, in good faith, and in the best interests of shareholders. That is not a conclusion. It is a record.

Waiver Discipline and the Fiduciary Record

In a live bidding environment, the Board will be asked to consider waiving contractual provisions, including standstill agreements, exclusivity clauses, and information-sharing restrictions. The governance risk is not the waiver itself. The governance risk is undocumented decision-making. A Board must ensure that every waiver is:

  • Reduced to writing with a defined scope and duration
  • Reviewed by counsel with a clear statement of fiduciary rationale
  • Reflected in contemporaneous Board minutes that explain why the waiver was necessary

Under the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) framework, the question is whether the company can demonstrate that its processes work in practice. A waiver without documentation is indistinguishable from a control failure.

Termination Fees as Board-Level Risk

The WBD transaction turned the $2.8 billion termination fee into a live issue. When Paramount agreed to fund the fee, the Board had to evaluate more than price. It had to evaluate:

  • Who ultimately bears the economic and legal risk
  • Whether the funding mechanism introduces new contingencies
  • How the arrangement should be disclosed to shareholders

Termination fees are often treated as deal protections. In a contested process, they serve as mechanisms for risk allocation. That places them squarely within Board oversight. A Board that does not interrogate the assumptions behind a termination fee, including third-party assumptions, is not exercising informed judgment.

Real-Time Disclosure Controls

Disclosure obligations in a transaction are not periodic. They are continuous. Once a superior proposal is identified, the company must:

  • Update proxy materials where required
  • Ensure that all material information is disclosed without selective leakage
  • Align communications across legal, investor relations, and management

The governance challenge is that information moves faster than process. Emails, banker discussions, draft proposals, and internal analyses all become part of the evidentiary record. Boards must ask whether the company has a real-time disclosure protocol. This includes:

  • A defined disclosure committee process
  • A single point of accountability for filings such as Form 8-K
  • Controls over who can communicate with external stakeholders

This is where governance intersects directly with compliance. Disclosure failures are not merely technical. They can trigger enforcement exposure.

The 8-K and Proxy Playbook

In a fast-moving transaction, the company does not have the luxury of drafting disclosures from scratch. A Board should expect management to have a predefined playbook that includes the following:

  • Trigger thresholds for filing obligations
  • Pre-approved disclosure templates for common scenarios
  • A documented approval chain involving legal, finance, and executive leadership

The absence of such a playbook creates a delay. Delay creates inconsistency. Inconsistency creates risk. From a COSO internal control perspective, this is a failure in control activities and information and communication. From a DOJ perspective, it is evidence that the program is not operationalized.

Regulatory Readiness and Remedy Planning

Both competing transactions carried regulatory risk. The difference was how that risk was allocated and mitigated. A Board must understand the following:

  • The regulatory approval pathways
  • The likelihood of a challenge
  • The remedies available if regulators object

More importantly, the Board must ensure that management has pre-developed the following:

  • Divestiture scenarios
  • Behavioral remedies
  • Escrow or holdback mechanisms tied to regulatory outcomes

This is not theoretical planning. It is part of the decision to determine which proposal is superior. A Board that does not understand regulatory risk is not fully evaluating the transaction’s value.

Post-Termination Control and Evidence Custody

When WBD terminated the agreement with Netflix, the transaction did not end. It transitioned into a new phase of risk. The company must:

  • Ensure proper handling of confidential information shared during the termination process
  • Preserve all records relevant to the decision-making process
  • Maintain audit trails for potential litigation or regulatory review

This is where evidence discipline becomes critical. The record must be complete, organized, and defensible. In the absence of such controls, the company risks being unable to demonstrate how decisions were made.

Why This Matters for Boards

The WBD process illustrates that governance is tested when conditions change rapidly. A Board cannot build governance in the middle of a transaction. It must already exist. The DOJ and SEC will not evaluate the Board based on the outcome. They will evaluate the Board based on the effectiveness of its processes, documentation, and controls. This is the essence of modern corporate governance. It is not about whether the Board chose Netflix or Paramount. It is about whether the Board can prove how and why it made that choice.

Practical Takeaways for Boards

  1. Ensure that superior proposal mechanics are understood at the Board level before a transaction is signed.
  2. Treat termination fees and regulatory protections as governance issues requiring full Board engagement.
  3. Demand real-time disclosure controls with clear ownership and escalation protocols.
  4. Require a pre-built 8-K and proxy playbook to manage disclosure risk under time pressure.
  5. Mandate regulatory scenario planning as part of transaction evaluation.

Questions for the Board

  1. Can the Board demonstrate, through contemporaneous documentation, how it evaluated a superior proposal?
  2. Does the company have a real-time disclosure control framework that supports rapid filings and updates?
  3. Are termination fee structures and third-party funding arrangements fully understood and documented?
  4. Has the Board reviewed regulatory risk scenarios and approved a default remedy strategy?
  5. Who is accountable for evidence preservation and record integrity during and after the transaction?

Please join us tomorrow; in our final post, we’ll focus on the Chief Compliance Officer. The question will be direct. What must a CCO do, in operational terms, to ensure that the company can execute governance under pressure and prove it after the fact?