Tag: Risk Management

Categories
Blog

Speed as a Compliance Decision: Lessons from Amazon’s Andy Jassy

When Andy Jassy succeeded Jeff Bezos as CEO of Amazon in 2021, many questioned whether the company could maintain its legendary momentum. Four years later, Jassy has not only sustained but also accelerated growth, adding more than $230 billion in revenue, expanding AI initiatives, and reinventing the management culture of one of the world’s most complex enterprises. That is why I was intrigued by an article in the Harvard Business Review (HBR) entitled, Speed Is a Leadership Decision,” where reporter Adi Ignatius interviewed Andy Jassy.

For compliance professionals, Jassy’s insights about speed, risk, culture, and innovation offer timely lessons. Too often, compliance leaders fall back on the excuse that “we’re too big, too regulated, too constrained to move quickly.” Jassy flips that script: speed, he insists, is a leadership decision. And the same is true for compliance.

Today, we look at five key lessons compliance professionals can draw from Jassy’s leadership playbook.

1. Speed Is a Leadership Decision

Jassy bluntly states that “speed disproportionately matters in every business at every time”. He challenges leaders to stop accepting bureaucracy and regulation as excuses. Instead, leaders must actively identify and remove barriers, empowering teams to act with urgency.

For compliance professionals, the lesson is clear: do not let the weight of regulations, policies, or oversight structures become a drag on effectiveness. Yes, compliance requires controls, documentation, and approvals, but speed is also important. Think of third-party due diligence reviews, hotline triage, or incident investigations. When compliance moves slowly, it signals indifference or ineffectiveness, and risks fester.

The decision to prioritize speed, backed by streamlined processes, real-time monitoring, and empowered teams, can transform compliance from a bureaucratic bottleneck into a proactive partner to the business.

2. Risk-Taking and Failure Are Essential to Innovation

Jassy observes that as companies grow, they tend to become risk-averse. Achievement-oriented professionals “play not to lose” rather than take chances. He emphasizes that the only way to build something truly unique is to take risks, make mistakes, and learn from them. Compliance teams face this challenge daily. The instinct is to avoid risk entirely, to say “no” rather than take a chance. But compliance innovation, whether adopting AI for monitoring, piloting new training formats, or embedding compliance into business processes, requires taking calculated risks. This means that risk management strategies must be implemented, monitored, and updated as necessary.

Failure in compliance is not about missing a regulatory requirement. It is about learning that a new process does not resonate with employees, or a monitoring tool generates too many false positives. Leaders should create safe zones for experimentation. If you never fail, you are not pushing hard enough. Compliance innovation must be iterative, and tolerance for small, recoverable failures is the price of true progress.

3. Flattening Bureaucracy Fuels Accountability

Jassy highlights Amazon’s initiative to flatten its organization and empower individual contributors. By increasing the ratio of builders to managers, reducing layers of decision-making, and encouraging employees to own “two-way-door decisions”. Those are choices that can easily be reversed. With this strategy, Amazon streamlined processes and accelerated innovation.

Compliance functions are often drowning in pre-meetings and approval chains. A compliance officer identifies a risk, drafts a recommendation, and waits while three levels of committees review it. Meanwhile, the risk festers. The compliance profession should adopt Jassy’s model: empower frontline employees to make two-way decisions in real-time. For example, a compliance manager in Brazil should have the authority to pause a suspicious vendor engagement without waiting for headquarters. Flattening decision-making structures creates accountability, agility, and credibility. Compliance must be a builder’s mindset: see the problem, fix the problem, move forward.

4. Culture Must Be Reinvented Continuously

“Culture is not our birthright,” Jassy warns. As companies scale, their culture stretches and must be deliberately reinforced. At Amazon, this means reasserting ownership, accountability, and a customer-centric approach, even as new layers of management emerge. For compliance professionals, this is a powerful reminder: culture is not static. A “speak-up” culture may flourish in year one and decay by year five if it isn’t nurtured. New geographies, acquisitions, and technologies stretch corporate culture in unpredictable ways.

The compliance function must continuously assess cultural health: are employees still raising concerns? Do managers still model ethical behavior? Are incentive structures still aligned with compliance values? A strong compliance culture requires constant reinvention: new training, new channels, new metrics; so that employees see it as living and evolving, not stale or perfunctory.

5. AI, Innovation, and Responsibility Must Go Hand in Hand

Jassy views AI as the biggest transformation since the internet, with the power to reinvent every customer experience. He emphasizes that progress is inevitable, so leaders must focus on using AI responsibly and productively.

Compliance professionals face the same dual imperative. On the one hand, AI tools, such as automated transaction monitoring, predictive analytics, and natural language chatbots, can make compliance faster, smarter, and more effective. On the other hand, AI introduces new risks, including bias, opacity, privacy breaches, and increased regulatory scrutiny.

The compliance leader’s role is not to resist AI but to guide its responsible adoption. Establish AI governance frameworks. Ensure transparency and explainability. Audit data inputs and outputs. Partner with business units to embed compliance guardrails into AI development. If compliance can keep pace with AI’s speed while safeguarding ethics, it will become indispensable to the business.

Compliance at the Speed of Leadership

Andy Jassy’s mantra, “speed is a leadership decision,” rings true far beyond Amazon. For compliance professionals, it reframes the mission. Compliance does not require slow responses, being bureaucratic, or being risk-averse. (Always remember, you do not have brakes on a car to drive slowly; instead, you have brakes on a car to drive fast.) Leaders can choose speed by empowering their teams, flattening the decision-making process, fostering a culture of ownership, tolerating smart failures, and embracing technology responsibly.

The stakes are high. Compliance must move at the same speed as the business, not the other way around. Regulators expect swift detection and remediation. Employees expect rapid answers to ethics and compliance questions. Boards expect real-time risk visibility. Compliance that lags will be seen as irrelevant or ineffective.

The lesson from Amazon’s Jassy is that compliance speed is not about cutting corners. It is about clarity of leadership, empowerment of people, and continuous cultural reinvention. In an era of accelerating technology and mounting risk, compliance professionals must embrace speed as a core leadership choice.

Categories
Innovation in Compliance

Innovation in Compliance – Gaurav Kapoor on Risk Management and the Role of AI in GRC

Innovation comes in many areas, and compliance professionals need to be ready for it and embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, Tom Fox interviews Gaurav Kapoor, Vice Chairman, Co-Founder and Board Member of MetricStream, discussing his extensive professional background, from co-founding MetricStream to his current focus on customer intimacy amid AI market disruptions.

Kapoor delves into the evolving landscape of risk management, emphasizing the importance of midyear reviews and integration of various risk themes like operational risk, audit compliance, and cybersecurity. He elaborates on the role of AI in GRC, stating how generative and agent AI can streamline compliance processes and enhance risk management strategies. The conversation also touches on the increasing significance of cybersecurity, geopolitical instability, and climate impact on risk assessment. Kapoor highlights the shift from compliance to a more resilient and risk-aware culture within organizations.

Key highlights:

  • The Importance of July in Risk Management
  • AI’s Role in GRC
  • Emerging Risks and AI Applications
  • Counseling Boards on Risk Management
  • Top Concerns for the Second Half of 2025
  • Evolving Role of Compliance and Risk Officers

Resources:

MetricStream Website and on LinkedIn

Gaurav Kapoor on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 77 – Through the Atavachron: Risk Management Insights from All Our Yesterdays

When you think of Star Trek: The Original Series, certain episodes stand out for their moral clarity, exploration of ethics, and leadership lessons. Others, like All Our Yesterdays, are more subtle but no less rich in compliance and risk management insights.

As the story unfolds, the episode reveals more than just a sci-fi adventure; it presents a compelling case study in the importance of preparation, situational awareness, adaptability, and decision-making under pressure. For the compliance professional, All Our Yesterdays offers five key risk management lessons that are as relevant in the boardroom as they are in a time-portal crisis.

Lesson 1: Understand the Operating Environment Before You Act

Illustrated by: Kirk, Spock, and McCoy don’t fully grasp that the Atavachron sends people into different periods, permanently altering them to survive there, until after they have stepped through the portals.

Compliance Lesson. One of the most preventable compliance failures happens when leaders act without fully understanding the operational landscape.

Lesson 2: Know the Long-Term Consequences of Your Decisions

Illustrated by: Atoz explains that once a traveler passes through the Atavachron, they undergo physiological changes to survive in the chosen period. Returning without those adaptations can be fatal.

Compliance Lesson. Compliance decisions, especially around risk tolerance, often have long-term and sometimes irreversible consequences. For example, approving a high-risk third party because “we need them for this deal” can embed systemic vulnerabilities that are difficult to unwind later.

Lesson 3: Adapt Your Strategy to Changing Conditions

Illustrated by: Spock, under the influence of the prehistoric era, begins to revert to the more emotional mindset of ancient Vulcans, displaying anger, impatience, and even affection for Zarabeth, a woman trapped in that time

Compliance Lesson. Risk environments are dynamic. Market conditions shift, laws change, counterparties evolve, and cultural contexts can reshape behavior, sometimes subtly, sometimes dramatically.

Lesson 4: Factor in Human Behavior When Assessing Risk

Illustrated by: Zarabeth tells Spock and McCoy they can never return to their own time, a claim that at first appears to be based on Atoz’s rules but is also shaped by her emotional motives.

Compliance Lesson. Risk management isn’t just about numbers, metrics, or legal frameworks—it’s about people, their incentives, and their biases.

Lesson 5: Time Is a Critical Risk Variable

Illustrated by: The central urgency in All Our Yesterdays comes from the imminent nova of Sarpeidon’s sun. For Kirk, Spock, and McCoy, the clock is ticking.

Compliance Lesson. In compliance risk management, timing is often the difference between proactive control and reactive crisis.

Final Compliance Reflections

All Our Yesterdays may be set in a science fiction universe, but its lessons are firmly grounded in the reality of corporate compliance. Every compliance officer will, at some point, face the equivalent of a ticking sun about to go nova, a high-stakes situation where incomplete information, shifting conditions, human bias, and the relentless march of time intersect.

Remember, you may not have an Atavachron in your compliance toolkit, but you do have the power to choose which “yesterday” you’ll prepare for today. The right risk management approach ensures that, when the heat is on, your organization is not scrambling for the exit portal, as it’s already where it needs to be.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Blog

All Our Yesterdays:Risk Management Lessons for the Compliance Professional

When you think of Star Trek: The Original Series, certain episodes stand out for their moral clarity, exploration of ethics, and leadership lessons. Others, like All Our Yesterdays, are more subtle but no less rich in compliance and risk management insights.

In this episode, Captain Kirk, Mr. Spock, and Dr. McCoy beam down to the planet Sarpeidon just before its sun is about to go nova. They find the planet seemingly deserted except for a mysterious librarian named Mr. Atoz. He explains that the people have escaped into the planet’s past using a time travel device called the Atavachron. Unfortunately, in true Star Trek fashion, the landing party becomes separated; Kirk into a duel-filled era resembling the late Middle Ages, and Spock and McCoy into a frozen prehistoric wilderness.

As the story unfolds, the episode reveals more than just a sci-fi adventure; it presents a compelling case study in the importance of preparation, situational awareness, adaptability, and decision-making under pressure. For the compliance professional, All Our Yesterdays offers five key risk management lessons that are as relevant in the boardroom as they are in a time-portal crisis.

Lesson 1: Understand the Operating Environment Before You Act

Illustrated by: When Kirk, Spock, and McCoy first arrive, they assume the library is a static place in the present day. They don’t fully grasp that the Atavachron sends people into different periods, permanently altering them to survive there, until after they have stepped through the portals.

Compliance Lesson. One of the most preventable compliance failures happens when leaders act without fully understanding the operational landscape. Just as Kirk should have gathered more intelligence before stepping through the portal, compliance officers must conduct thorough due diligence before making high-impact decisions, especially in new markets or with new business models.

Jumping into a jurisdiction with unfamiliar regulatory structures or cultural norms without advance research can leave your compliance program operating with blind spots. A robust risk assessment, stakeholder mapping, and regulatory scan are your “Atavachron briefing”; without them, you’re walking through the wrong portal unprepared.

Lesson 2: Know the Long-Term Consequences of Your Decisions

Illustrated by: Atoz explains that once a traveler passes through the Atavachron, they undergo physiological changes to survive in the chosen period. Returning without those adaptations can be fatal. This means each journey into the past is not just a visit—it’s a permanent commitment.

Compliance Lesson. Compliance decisions, especially around risk tolerance, often have long-term and sometimes irreversible consequences. For example, approving a high-risk third party because “we need them for this deal” can embed systemic vulnerabilities that are difficult to unwind later.

Spock and McCoy’s plight in the ice age is a reminder that once certain paths are chosen, backing out may be impossible or costly. Before green-lighting any strategy or business partner, ask: What will be the long-term compliance footprint? Are we setting ourselves up for future exposure? Risk management is not just about the next quarter; it’s about the next decade.

Lesson 3: Adapt Your Strategy to Changing Conditions

Illustrated by Spock, under the influence of the prehistoric era, begins to revert to the more emotional mindset of ancient Vulcans, displaying anger, impatience, and even affection for Zarabeth, a woman trapped in that time. McCoy, ill from the cold, must rely on Spock’s shifting judgment to survive.

Compliance Lesson. Risk environments are dynamic. Market conditions shift, laws change, counterparties evolve, and cultural contexts can reshape behavior, sometimes subtly, sometimes dramatically. The compliance officer must be alert to these shifts and recalibrate strategies accordingly.

Like Spock, even seasoned professionals can find themselves influenced by their environment in ways they don’t immediately recognize. Compliance teams need to build monitoring systems that not only track external risk factors but also assess how those factors may be affecting decision-makers internally. Adaptation is not a sign of weakness—it’s a core competency in sustainable risk management.

Lesson 4: Factor in Human Behavior When Assessing Risk

Illustrated by: Zarabeth tells Spock and McCoy they can never return to their own time, a claim that at first appears to be based on Atoz’s rules but is also shaped by her emotional motives. Her loneliness influences how she frames the “facts.”

Compliance Lesson. Risk management isn’t just about numbers, metrics, or legal frameworks—it’s about people, their incentives, and their biases. Vendors may hide problems to protect their contracts. Employees may omit details in self-reporting to avoid blame. Executives may downplay risk to push through a deal.

Zarabeth’s well-intentioned but self-serving misinformation underscores the need for independent verification of claims. Compliance programs should be designed to collect and validate facts from multiple sources, reducing the risk of being swayed by the partial truths of a single stakeholder.

Lesson 5: Time Is a Critical Risk Variable

Illustrated by: The central urgency in All Our Yesterdays comes from the imminent nova of Sarpeidon’s sun. The people had to evacuate into the past before the moment of destruction; anyone left behind would perish. For Kirk, Spock, and McCoy, the clock is ticking.

Compliance Lesson. In compliance risk management, timing is often the difference between proactive control and reactive crisis. Delaying a decision, such as suspending a suspicious transaction, escalating a whistleblower report, or halting engagement with a questionable vendor, can mean the difference between a manageable incident and a reputational disaster.

The episode reinforces the importance of early detection and swift action. Compliance teams should have rapid-response protocols, much like an evacuation plan, that can be activated the moment credible risk signals appear. The longer you wait, the narrower your options become.

Final Compliance Reflections

All Our Yesterdays may be set in a science fiction universe, but its lessons are firmly grounded in the reality of corporate compliance. Every compliance officer will, at some point, face the equivalent of a ticking sun about to go nova, a high-stakes situation where incomplete information, shifting conditions, human bias, and the relentless march of time intersect.

The episode reminds us that effective risk management is not simply about having a well-written policy. It’s about equipping yourself and your team to:

  • Anticipate the terrain.
  • Weigh long-term consequences before stepping through the “portal.”
  • Stay agile under environmental pressures.
  • Test assumptions and verify information.
  • Act decisively when the moment demands it.

In All Our Yesterdays, Kirk, Spock, and McCoy return to the present just in time, thanks to quick thinking, adaptability, and the ability to work within and around constraints. In the corporate compliance world, those same skills can mean the difference between a controlled risk event and a full-blown regulatory disaster.

Remember, you may not have an Atavachron in your compliance toolkit, but you do have the power to choose which “yesterday” you’ll prepare for today. The right risk management approach ensures that, when the heat is on, your organization is not scrambling for the exit portal as it’s already where it needs to be.

 Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
AI Today in 5

AI Today in 5: August 13, 2025, The Beware the EU AI Act Episode

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

For more information on the use of AI in compliance programs, see Tom Fox’s new book, Upping Your Game. You can purchase a copy of the book on Amazon.com.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 71 – Surviving the Unknown: Risk Management Lessons from “That Which Survives”

In compliance, risk management is more than a checklist. It is the ongoing discipline of identifying threats, assessing their potential impact, and implementing measures to mitigate or neutralize them before they cause harm.

Few Star Trek episodes illustrate the escalating consequences of underestimated risks as effectively as That Which Survives. In it, the Enterprise crew encounters a seemingly lifeless planet guarded by Losira, an alien projection who can kill with a single touch. Her purpose is to protect the planet’s secrets, but her method is indiscriminate, deadly, and poorly aligned to the situation at hand.

For compliance professionals, this episode offers five important lessons on anticipating, assessing, and responding to risks, both known and unknown, within an organization.

Lesson 1: Identify Risks Before Engaging in New Ventures

Illustrated By: The Enterprise arrives at an uncharted planet. Within moments, a mysterious woman materializes and kills a crew member simply by touching him.

Compliance Lesson. Too often, companies rush into new markets, partnerships, or projects without conducting a thorough risk assessment. This can expose the organization to sanctions violations, corruption risks, cybersecurity vulnerabilities, or operational failures.

Lesson 2: Understand That Some Risks Are Intelligent and Adaptive

Illustrated By: Losira targets specific individuals and adapts her approach to their vulnerabilities.

Compliance Lesson. Not all risks are static. Fraudsters change tactics, cyber threats evolve, and corrupt third parties find new ways to conceal misconduct. A compliance program must anticipate that some risks will actively seek to bypass controls.

Lesson 3: Don’t Dismiss Low-Probability, High-Impact Threats

Illustrated By: At first, the crew assumes Losira’s appearances are isolated incidents, but they quickly realize she poses an existential threat.

Compliance Lesson. Rare events, such as a single high-value bribery transaction, a lone rogue employee, or a targeted cyberattack, can have catastrophic consequences. Organizations sometimes underprepare for these scenarios because they seem unlikely.

Lesson 4: Risk Mitigation Requires Cross-Functional Coordination

Illustrated By: The landing party on the planet and the Enterprise crew in orbit are each facing threats from Losira, but their survival depends on sharing information and coordinating responses. Without clear communication, both groups would be doomed.

Compliance Lesson. Compliance cannot manage risk in isolation. It must work with legal, internal audit, operations, IT, and HR to identify threats and implement controls.

Lesson 5: Address the Root Cause, Not Just the Symptoms

Illustrated By: The crew eventually discovers that Losira is an automated defense mechanism left behind by an extinct race. Once the crew understands her origin and purpose, they can neutralize the threat.

Compliance Lesson. In risk management, addressing surface-level problems without finding the underlying cause only delays future incidents. Compliance should integrate root cause analysis into all investigations.

Final ComplianceLog Reflections

That Which Survives is more than a suspense episode; it is a cautionary tale about the dangers of underestimating risk. Losira was not inherently evil; she was a misunderstood, unexamined part of an environment the crew did not fully assess before engagement.

The compliance officer’s mandate is to ensure the company doesn’t make the same mistake: to scan for threats before beaming in, to adapt to risks that evolve, to prepare for unlikely but devastating events, to coordinate across the enterprise, and to address the root cause when problems arise. Risk management is not just about surviving; it is about ensuring that your organization thrives in any environment, whether it’s an unexplored planet or a rapidly changing market.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Blog

Risk Management in Compliance: Five Lessons from Star Trek’s That Which Survives

In compliance, risk management is more than a checklist. It is the ongoing discipline of identifying threats, assessing their potential impact, and implementing measures to mitigate or neutralize them before they cause harm.

Few Star Trek episodes illustrate the escalating consequences of underestimated risks as effectively as That Which Survives. In it, the Enterprise crew encounters a seemingly lifeless planet guarded by Losira, an alien projection who can kill with a single touch. Her purpose is to protect the planet’s secrets, but her method is indiscriminate, deadly, and poorly aligned to the situation at hand.

For compliance professionals, this episode offers five important lessons on anticipating, assessing, and responding to risks, both known and unknown, within an organization.

Lesson 1: Identify Risks Before Engaging in New Ventures

Illustrated By: The Enterprise arrives at an uncharted planet, scans it briefly, and beams down a landing party. Within moments, a mysterious woman materializes and kills a crew member simply by touching him.

Compliance Lesson. Too often, companies rush into new markets, partnerships, or projects without conducting a thorough risk assessment. This can expose the organization to sanctions violations, corruption risks, cybersecurity vulnerabilities, or operational failures. Compliance should lead or be deeply involved in pre-engagement risk assessments. Before “beaming down” into a new business environment, map potential threats—regulatory, operational, reputational—and identify safeguards. Skipping this step can lead to preventable harm and costly remediation.

Lesson 2: Understand That Some Risks Are Intelligent and Adaptive

Illustrated By: Losira’s ability to appear anywhere, both on the planet and aboard the Enterprise, shows she is not a passive hazard. She targets specific individuals and adapts her approach to their vulnerabilities.

Compliance Lesson. Not all risks are static. Fraudsters change tactics, cyber threats evolve, and corrupt third parties find new ways to conceal misconduct. A compliance program must anticipate that some risks will actively seek to bypass controls. Build adaptive monitoring into your compliance systems. Use continuous transaction monitoring, real-time alerts, and data analytics to detect changes in patterns. A one-time risk assessment is not enough—ongoing vigilance is essential.

Lesson 3: Don’t Dismiss Low-Probability, High-Impact Threats

Illustrated By: At first, the crew assumes Losira’s appearances are isolated incidents, but they quickly realize she poses an existential threat. Even though she is only one individual, her capabilities could destroy the Enterprise if not addressed.

Compliance Lesson. Rare events, such as a single high-value bribery transaction, a lone rogue employee, or a targeted cyberattack, can have catastrophic consequences. Organizations sometimes underprepare for these scenarios because they seem unlikely. Compliance departments should incorporate low-probability, high-impact risks into the risk register. Conduct tabletop exercises to simulate rare but potentially devastating events, ensuring the organization has both prevention and response plans in place.

Lesson 4: Risk Mitigation Requires Cross-Functional Coordination

Illustrated By: The landing party on the planet and the Enterprise crew in orbit are each facing threats from Losira, but their survival depends on sharing information and coordinating responses. Without clear communication, both groups would be doomed.

Compliance Lesson. Compliance cannot manage risk in isolation. It must work with legal, internal audit, operations, IT, and HR to identify threats and implement controls. Silos breed blind spots, and blind spots breed crises. Establish cross-functional risk committees or working groups. Ensure that incident reporting and escalation procedures are well understood across departments. Make compliance the hub of a collaborative risk network, not a separate spoke.

Lesson 5: Address the Root Cause, Not Just the Symptoms

Illustrated By: The crew eventually discovers that Losira is an automated defense mechanism left behind by an extinct race. She’s not malicious—she’s simply executing a program without context or adaptability. Once the crew understands her origin and purpose, they can neutralize the threat.

Compliance Lesson. In risk management, addressing surface-level problems without finding the underlying cause only delays future incidents. For example, punishing an employee for violating a policy without examining why the policy was ignored leaves the organization vulnerable to repeat violations. Compliance should integrate root cause analysis into all investigations. Whether it’s a process flaw, cultural issue, or oversight gap, solving the real problem is the only way to reduce recurrence.

The Enterprise as a Risk Management Model

Captain Kirk and his crew succeed not because they are lucky, but because they adapt quickly, share intelligence, and dig deeper to understand the nature of the threat. These are precisely the attributes a corporate compliance department needs to lead risk management:

  • Proactive assessment before engagement.
  • Adaptive controls that respond to evolving risks.
  • Preparation for rare but high-impact events.
  • Collaboration across organizational functions.
  • Root cause remediation for lasting solutions.

Practical Compliance Takeaways

From That Which Survives, compliance professionals can draw these operational insights:

  1. Integrate Compliance Early—Risk management starts before contracts are signed or operations begin, not after.
  2. Invest in Technology—Data analytics, AI monitoring, and continuous auditing tools make adaptive risk management possible.
  3. Conduct Scenario Planning—Practice responding to “Losira-like” threats: targeted, intelligent, and hard to predict.
  4. Build Risk Alliances—Partner with all departments to create a unified threat picture.
  5. Close the Loop—Use each incident to strengthen your program against future threats.

Final ComplianceLog Reflections

That Which Survives is more than a suspense episode; it is a cautionary tale about the dangers of underestimating risk. Losira was not inherently evil; she was a misunderstood, unexamined part of an environment the crew did not fully assess before engagement.

The compliance officer’s mandate is to ensure the company doesn’t make the same mistake: to scan for threats before beaming in, to adapt to risks that evolve, to prepare for unlikely but devastating events, to coordinate across the enterprise, and to address the root cause when problems arise.

In other words, risk management is not just about surviving; it is about ensuring that your organization thrives in any environment, whether it’s an unexplored planet or a rapidly changing market.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
AI Today in 5

AI Today in 5: August 5, 2025, The AI at the SEC Episode

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI. 

 

For more information on the use of AI in Compliance programs, Tom Fox’s new book is Upping Your Game. You can purchase a copy of the book on ⁠Amazon.com.⁠

Categories
Blog

10 Prompts for Compliance

A colleague recently asked me to provide them with some prompts they could use to start their journey using AgenticAI, machine learning, and natural language processing. They also wanted an explanation of why these prompts would be helpful. I thought about it and came up with a list of the Top 10 prompts compliance professionals frequently use or need to use, along with a detailed explanation of their critical importance. I have added an answer for each prompt. To obtain these prompts, I began with the following query to ChatGPT. ‘You are a compliance professional at a US corporation. Please list the top 10 prompts I can use to start my journey of using AI to improve a corporate compliance program.’

1. “Identify emerging compliance risks in our industry.”

Explanation:

This prompt is foundational for proactive compliance management. Compliance professionals must continuously scan the regulatory landscape, industry developments, technology advancements, and geopolitical shifts to detect emerging risks. Understanding new threats before they fully materialize allows compliance teams to take proactive steps, adapt policies, provide training, and mitigate potential issues before they result in violations or enforcement actions. Moreover, this prompt promotes a forward-looking compliance program, which aligns with regulatory expectations such as those outlined by the DOJ’s Evaluation of Corporate Compliance Programs (ECCP), making this a critical practice for effective compliance professionals.

2. “Summarize recent regulatory updates relevant to our business operations.”

Explanation:

Compliance landscapes are dynamic, with rules frequently evolving. This prompt ensures compliance professionals remain fully informed about current regulatory changes that directly impact their company’s operations. Effective compliance teams leverage these summaries to update policies, provide timely training, and communicate clearly to management and employees. Staying abreast of regulatory developments also positions compliance professionals to strategically advise senior leadership on business decisions, mitigate regulatory risk, and avoid costly penalties or enforcement actions resulting from non-compliance or outdated practices.

3. “Provide best practices for conducting a thorough compliance risk assessment.”

Explanation:

Risk assessment is the cornerstone of an effective compliance program, as emphasized by regulatory guidelines from bodies as diverse as the DOJ and COSO. This prompt enables compliance professionals to leverage proven methodologies, frameworks, and standards to identify, prioritize, and address key risk areas systematically. An effective compliance risk assessment not only satisfies regulatory expectations but also informs strategic allocation of compliance resources. Moreover, a robust risk assessment is foundational for proactive management, policy development, and training, enhancing an organization’s overall compliance posture and reducing potential liabilities.

4. “Generate scenario-based training examples on ethical dilemmas and compliance issues.”

Explanation:

Training remains a critical element in a strong compliance program. Scenario-based prompts help compliance professionals create realistic, relatable training modules that resonate with employees. Ethical dilemmas and practical compliance scenarios allow employees to practice decision-making, reflect upon corporate values, and internalize compliance expectations. Such scenario-based training significantly improves retention, awareness, and adherence to corporate standards. Additionally, regulators frequently examine training effectiveness during compliance reviews, and scenario-based training demonstrates a genuine commitment to fostering a culture of compliance.

5. “Draft a communication plan for implementing significant compliance program changes.”

Explanation:

Clear, structured communication is essential when changes occur in compliance programs, procedures, or policies. This prompt helps compliance professionals ensure they address critical points transparently and consistently to all stakeholders. A thoughtful communication plan ensures key messages are effectively conveyed, minimizes confusion, and reinforces the seriousness of compliance updates. Effective communication plans also document a defensible record of the company’s efforts to implement and socialize compliance changes, satisfying regulatory expectations for robust internal communication, transparency, and awareness across the organization.

6. “Suggest steps for performing effective third-party due diligence and monitoring.”

Explanation:

Third-party relationships pose significant compliance and reputational risks, especially concerning bribery, corruption, fraud, and sanctions violations. This prompt assists compliance professionals in defining robust due diligence and monitoring procedures aligned with international best practices and regulatory expectations such as those in the FCPA and the UK Bribery Act. Effective due diligence steps allow companies to proactively identify potential red flags, implement controls, and continuously monitor third-party activities. This approach helps mitigate liability from third-party misconduct and demonstrates regulatory rigor and commitment to compliance oversight.

7. “Explain key lessons learned from recent enforcement actions relevant to our sector.”

Explanation:

Learning from regulatory enforcement actions is pivotal in compliance. This prompt ensures compliance professionals leverage real-world cases to strengthen their compliance programs. By analyzing enforcement trends and critical lessons, compliance officers identify and rectify gaps before they lead to serious issues. Regulators often expect companies to adjust their compliance efforts based on industry-specific enforcement activity, and proactively analyzing recent cases underscores an organization’s commitment to continuous improvement and diligent compliance management. This practice helps mitigate risk, avoid similar pitfalls, and demonstrate compliance program effectiveness.

8. “Guide developing or updating a whistleblower policy and protection procedures.”

Explanation:

Whistleblower protection is not just regulatory guidance; it’s often legally required. This prompt helps compliance professionals craft robust whistleblower policies to encourage employees to report misconduct safely without fear of retaliation. An effective whistleblower program builds trust, integrity, and accountability within an organization. Regulatory bodies, such as the SEC and DOJ, evaluate whistleblower programs as indicators of a mature compliance culture. Hence, this prompt helps compliance teams align policy with best practices and legal mandates, protecting both whistleblowers and the company from serious compliance violations and reputational harm.

9. “Outline a structured root cause analysis process for compliance failures.”

Explanation:

Conducting a root cause analysis (RCA) is essential for compliance professionals to identify underlying factors contributing to compliance failures. This prompt provides compliance officers with a structured methodology to systematically evaluate incidents, prevent recurrence, and make informed decisions on corrective measures. Regulators, including the DOJ, increasingly require companies to demonstrate a systematic RCA process following a compliance breach. Utilizing RCA strengthens an organization’s ability to enhance controls, improve policies, refine training, and demonstrate commitment to compliance effectiveness, thus enhancing credibility with regulators.

10. “Draft a checklist for auditing and monitoring compliance program effectiveness.”

Explanation:

Auditing and monitoring are fundamental elements of a strong compliance program. This prompt helps compliance professionals systematically evaluate their programs’ design, implementation, and ongoing performance. Detailed checklists facilitate consistent reviews, identify vulnerabilities, track remediation progress, and ensure continuous improvement. Regulators regularly review auditing and monitoring processes as evidence of a compliance program’s maturity. Thus, having articulated auditing checklists underscores a proactive approach to maintaining compliance program effectiveness and regulatory readiness and ensures swift corrective actions whenever issues arise.

Conclusion:

These top 10 prompts embody essential practices in modern compliance management. Leveraging these prompts enables compliance professionals to proactively manage risk, remain informed, educate effectively, communicate clearly, and demonstrate regulatory rigor. They ensure that organizations maintain robust compliance programs that protect the business and sustain an ethical, accountable, and risk-aware culture.

Categories
Blog

Chasing Shadows: Five Compliance Lessons from the Hound of the Baskervilles

“The Hound of the Baskervilles,” penned by Sir Arthur Conan Doyle, is not only the most famous Sherlock Holmes story and a riveting detective tale but also presents timeless lessons in compliance applicable to corporate governance and risk management. Through its intricate plot and detailed character portrayals, the novel underscores several critical principles that every compliance professional should heed.

The story itself blends mystery, suspense, and supernatural elements. Sherlock Holmes and Dr. Watson investigate Sir Charles Baskerville’s mysterious death on the eerie Devonshire moors, connected to a legendary demonic hound curse. Holmes sends Watson with his heir, Sir Henry Baskerville, to the estate, where suspicious servants, an escaped convict, and peculiar neighbors—the Stapletons—heighten tensions. Watson’s observations reveal Jack Stapleton’s instability and jealousy over Sir Henry’s attention to Beryl Stapleton. Secretly investigating, Holmes identifies Stapleton as a Baskerville relative plotting Sir Henry’s death to claim the inheritance. Stapleton’s deception includes staging supernatural events to exploit local superstition. In the climax, Stapleton releases a phosphorus-painted hound to kill Sir Henry, but Holmes and Watson intervene, killing the beast. Stapleton flees, presumed dead in the Grimpen Mire. Holmes’s rational deductions triumph, dismissing supernatural fears and reinforcing logic and reason. Watson’s meticulous work is instrumental, showcasing his courage and skill. The novel concludes by affirming reason over superstition, demonstrating the dangers of irrational fear.

Here are five key compliance lessons derived from specific events within this classic tale.

Lesson 1: Avoiding Complacency in Risk Assessment

The initial approach to the mystery of Sir Charles Baskerville’s death illustrates a critical lesson in risk assessment: the importance of maintaining vigilance. Dr. Mortimer initially attributes the death to supernatural causes, influenced by local legends of a family curse. Sherlock Holmes immediately challenges this complacency, emphasizing the need for rational investigation over reliance on myths or unexamined assumptions. Holmes insists on examining evidence logically rather than accepting straightforward, sensational explanations.

Compliance professionals must similarly avoid complacency. It is easy for an organization to rely on historical assumptions or superficial risk assessments. However, genuine vigilance requires continuous questioning and reevaluation of all potential threats. By regularly revisiting risk assessments and remaining skeptical of conventional wisdom, compliance teams can better anticipate, mitigate, and respond to potential compliance failures before they escalate into significant issues.

Lesson 2: Effective Use of Data and Evidence

Throughout “The Hound of the Baskervilles,” Holmes’s meticulous use of evidence exemplifies the necessity of thorough documentation and analysis in achieving effective compliance outcomes. One key example is Holmes’s careful examination of Sir Henry Baskerville’s stolen boots. Holmes correctly deduces that the shoes were stolen to provide the hound with Sir Henry’s scent. This attention to minute detail and systematic analysis underscores the importance of robust documentation and record-keeping.

Compliance professionals should similarly prioritize precise data collection, rigorous documentation, and evidence-based decision-making. Proper documentation provides transparency, facilitates effective audits, and ensures clarity when addressing compliance issues or regulatory inquiries. By fostering a culture where data-driven decision-making is standard practice, organizations can strengthen their compliance programs and more effectively prevent violations.

Lesson 3: Maintaining Independence and Objectivity

A pivotal moment in the novel occurs when Holmes secretly arrives on the moor, independent of Watson’s investigation. Holmes understands the importance of maintaining independence to gather unbiased information. By conducting a parallel investigation that is free from local biases and personal relationships, Holmes preserves objectivity and ultimately identifies the true culprit, Jack Stapleton.

For compliance professionals, maintaining independence and objectivity is equally vital. Conflicts of interest can obscure judgment and compromise investigations. Compliance officers must be empowered to act independently, free from undue influence, to ensure the integrity of their findings and recommendations. Establishing clear reporting structures and supporting unbiased investigative procedures can significantly enhance an organization’s overall compliance effectiveness.

Lesson 4: Transparent Communication and Reporting

Transparency is repeatedly highlighted as essential throughout Conan Doyle’s narrative. Watson’s regular and detailed correspondence with Holmes exemplifies clear, transparent reporting. Watson meticulously records his observations, suspicions, and interactions, ensuring Holmes remains informed of developments in real time. This ongoing communication proves instrumental in Holmes’s eventual successful intervention.

In the realm of corporate compliance, transparent communication and reporting are equally critical. Employees must feel encouraged and supported in reporting suspicious activities or compliance concerns without fear of retaliation or retribution. Implementing precise and accessible reporting mechanisms, while ensuring open lines of communication, fosters a culture that is compliant-friendly. This transparency enables compliance teams to detect and address issues promptly, thereby reducing organizational exposure to risk and promoting an ethical business environment.

Lesson 5: Importance of Culture and Ethics

The actions and eventual downfall of Jack Stapleton underscore a profound lesson in compliance regarding organizational culture and ethics. Stapleton manipulates local fears and exploits the legend of the supernatural hound to facilitate his criminal plans. His unethical behavior, driven by greed and a disregard for human life, ultimately led to his ruin.

Organizations must prioritize building and maintaining a strong ethical culture. Leadership should exemplify ethical behavior, clearly communicate expectations, and swiftly address unethical actions. Regular training and communication regarding ethical standards reinforce an organization’s values and expectations. By cultivating a robust ethical culture, organizations not only reduce the likelihood of compliance violations but also enhance their reputation and long-term sustainability.

“The Hound of the Baskervilles” offers rich insights for compliance professionals. Avoiding complacency, emphasizing evidence-based decision-making, maintaining independence, ensuring transparent communication, and fostering a robust ethical culture are foundational principles that are vividly highlighted throughout Conan Doyle’s timeless narrative. These lessons, illustrated through specific events and character decisions within the story, remain deeply relevant in guiding modern corporate compliance practices.