Tag: risk

Categories
Popcorn and Compliance

Popcorn and Compliance: Frankenstein Meets the Wolf Man When Monsters Collide: Compliance and Enterprise Risk

This October, Tom Fox returns to one of his all-time favorite subjects: the Universal Pictures classic monsters. Over the years, he has explored the classics, including Dracula, The Mummy, The Wolf Man, and The Invisible Man, with detours into films by Val Lewton and Hammer Films. This year, Tom takes a deep dive into the first five Frankenstein films. The series has already covered the original Frankenstein, Bride of Frankenstein, Son of Frankenstein, and The Ghost of Frankenstein. The fifth and final episode turns to one of Tom’s favorite horror films of all time, Frankenstein Meets the Wolf Man, released in 1943. Tom’s AI co-hosts, Timothy and Fiona, join him for commentary.

Film Synopsis:

Frankenstein Meets the Wolf Man begins primarily as a continuation of Larry Talbot’s story from The Wolf Man. Talbot, played by Lon Chaney Jr., is resurrected and desperately seeks a way to end his werewolf curse. His search eventually leads him to the ruins of Frankenstein’s castle, where he discovers Frankenstein’s Monster frozen beneath the wreckage and revives him. Dr. Mannering becomes involved in an attempt to cure Talbot while also restoring the Monster to full strength. The inevitable result is the movie’s great selling point: the Wolf Man and Frankenstein’s Monster, now played by Bela Lugosi, finally collide. It was the first Universal film to bring two of its major horror characters together in this fashion.

Key Highlights:

  • Risks do not exist in silos.
  • Risk aggregation belongs in enterprise risk management.
  • AI governance demonstrates the problem perfectly.
  • The CCO should be a connector, not the owner of everything.
  • Boards need to see the entire castle.

Popcorn and Compliance takeaway: The greatest enterprise risk may not be Frankenstein’s Monster or the Wolf Man. It may be what happens when two risks nobody considered together finally collide.

Closing the Popcorn and Compliance Frankenstein Series

Across these five films, we get something remarkably close to the lifecycle of a corporate compliance failure.

Henry Frankenstein creates risk without adequate governance.

In Bride of Frankenstein, leadership knows the danger but succumbs to pressure and ethical compromise.

In Son of Frankenstein, a new generation inherits unresolved legacy risk.

In The Ghost of Frankenstein, supposedly resolved problems return because remediation and controls are ineffective.

Finally, in Frankenstein Meets the Wolf Man, an unresolved risk collides with another risk and becomes an enterprise problem.

That is what makes these movies such fertile territory for Popcorn and Compliance. The Monster is never simply the Monster. He is the product of decisions, incentives, weak controls, poor oversight, inadequate remediation, and leaders who repeatedly convince themselves that this time they can manage the consequences.

For the compliance professional, there may be no better question to take from the entire Universal Frankenstein cycle:

What Monster is your organization creating, inheriting, reviving, or failing to see today?

Timothy and Fiona are AI-generated voices, courtesy of Notebook LM.

Categories
Blog

Frankenstein and Compliance: Part 5 – Frankenstein Meets the Wolf Man: When Monsters Collide

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first four Frankenstein films provide a useful progression for corporate compliance. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands risk but lets pressure and rationalization override judgment. Son of Frankenstein moved to inherited risk and the obligations that arise when new leadership discovers legacy problems. The Ghost of Frankenstein asks whether remediation actually works. 

Frankenstein Meets the Wolf Man (1943) changes the risk equation. There are now two monsters. Larry Talbot, played by Lon Chaney Jr., returns from The Wolf Man seeking a way to end the curse that transforms him into a werewolf. His search eventually brings him to the ruins of Frankenstein’s castle, where he discovers the Monster, played in this film by Bela Lugosi. Talbot revives him, Dr. Mannering becomes involved, and the film eventually delivers what its title promises: Frankenstein’s Monster and the Wolf Man collide.

For corporate compliance professionals, the movie provides a useful way to think about enterprise risk. Organizations necessarily divide risk into categories and assign responsibilities to different functions. Compliance may oversee anti-corruption, sanctions, third-party, antitrust, and other regulatory risks. Information Security manages cyber risk. Privacy oversees data protection. HR manages employment-related risks. Finance owns financial controls. Internal Audit provides assurance. Enterprise Risk Management looks across the organization. 

That structure is necessary. It can also create silos. The most significant corporate risks do not always remain within the categories management assigns to them. They interact. When they do, the resulting exposure may be greater than the organization sees when each risk is assessed independently. The compliance challenge is not simply identifying each monster. It is understanding what happens when they meet.

Risk Does Not Respect the Organizational Chart

Companies assign risk ownership because someone must be accountable. That is good governance. The problem begins when risk ownership becomes information ownership. Consider a third-party distributor operating in a high-risk market. Compliance may identify concerns about the distributor’s beneficial ownership. Finance may identify unusual payment requests. Information Security may detect suspicious access involving the distributor’s credentials. Internal Audit may identify invoice exceptions. Legal may become aware of litigation or regulatory concerns involving related entities. Each function may respond appropriately to the information it possesses.

Yet the organization may still fail if nobody connects those facts. The compliance issue is therefore not simply whether individual control functions are doing their jobs. It is whether the organization’s governance structure allows information to move across functional boundaries. This distinction matters more as corporate risks become more interconnected.

A cybersecurity event can become a privacy incident. A privacy incident can become a regulatory investigation. A regulatory investigation can create disclosure obligations. A third-party issue can become an anti-corruption problem, which can become a books-and-records problem, which can become a securities issue. Risk categories are useful for management. They are not boundaries that real-world events respect. 

The Wolf Man and Frankenstein’s Monster Are Different Risks

One useful aspect of Frankenstein Meets the Wolf Man is that its two principal characters represent different kinds of risk. Larry Talbot understands his condition. He knows that particular circumstances trigger his transformation and that the consequences can be severe. His risk is recurring and linked to identifiable conditions. Frankenstein’s Monster represents something different. He is a legacy risk repeatedly inherited, revived, and unsuccessfully controlled by others.

Put them together and the problem changes. Companies experience similar combinations. A business may have a known third-party risk that becomes significantly more serious when combined with expansion into a high-risk jurisdiction. A weak control environment may become more consequential when management introduces aggressive sales incentives. A cybersecurity vulnerability may become more significant when the company deploys an AI system with access to sensitive information. The risks do not merely accumulate. They can amplify one another. That is why risk assessment should consider interdependencies. 

Risk Aggregation Should Be Part of the Compliance Conversation

Traditional compliance risk assessments often organize risks by subject matter.

  • Anti-corruption risk.
  • Sanctions risk.
  • Antitrust risk.
  • Third-party risk.
  • Privacy risk.
  • Conflicts of interest.
  • Books and records.

That approach is useful because it creates structure and allows organizations to identify controls and owners. It can also obscure combinations of risk. Consider a company acquiring a business in a high-risk jurisdiction. The acquisition may involve weak financial controls, substantial government interaction, a distributor-based sales model, aggressive growth assumptions, and a local culture unfamiliar with the acquiring company’s compliance expectations. Each issue may appear manageable when assessed separately. Together, they may produce a materially different risk profile. 

The CCO should therefore consider adding risk aggregation to the compliance risk assessment process. Where do significant risks intersect? Which business units face several elevated risks simultaneously? Which third parties create exposure across multiple compliance areas? Which strategic initiatives combine new technology, new markets, new partners, and aggressive financial expectations? A heat map that displays risks individually may not reveal these relationships. Compliance should be able to explain not only where the red boxes are but also what happens when several red boxes occupy the same part of the business.

AI Is an Enterprise Risk Multiplier 

Artificial intelligence provides one of the clearest modern examples of the problem. Companies sometimes discuss “AI risk” as though it were one category. Unfortunately, it is not. An AI deployment can simultaneously raise privacy, cybersecurity, intellectual property, employment, discrimination, consumer protection, regulatory, third-party, recordkeeping, and reputational issues.

What about an AI tool used to assist hiring decisions? HR may view it as a talent-management system. Information Security may assess the technology vendor. Privacy may examine candidate data. Legal may consider employment requirements. Compliance may evaluate governance and ethical concerns. Procurement may negotiate the contract. Every function may perform its assigned task. The organization still needs someone to evaluate the complete risk picture.

The same issue arises when AI is used for internal investigations, compliance monitoring, customer interactions, sales recommendations, financial decisions, or employee evaluation. This is why AI governance requires cross-functional management.

Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 are useful because they encourage organizations to think about governance, accountability, risk identification, measurement, monitoring, and continual improvement rather than treating AI exclusively as an IT issue. The central business question is not which department owns AI. It is whether the governance structure addresses the risks created by the particular use case.

The CCO Should Be a Connector, Not the Owner of Everything

The increasing interconnectedness of risk raises an important question about the CCO’s role. The answer should not be that Compliance owns every risk involving law, ethics, or reputation. That approach creates its own governance problem.

Business management owns business risk. Information Security should remain accountable for cybersecurity. HR should remain accountable for employment processes. Finance should own financial controls. Legal should provide legal advice. Internal Audit should preserve its independent assurance role. The CCO can nevertheless play an important role as a connector.

Compliance often receives information from multiple parts of the organization. Hotline reports, investigations, third-party due diligence, monitoring results, policy exceptions, training data, regulatory developments, culture assessments, and risk assessments all provide different views of organizational behavior. That perspective can allow Compliance to identify patterns that may not be visible within a single business function. The CCO should therefore ask where information needs to be shared, where cross-functional escalation is necessary, and where significant risks require joint governance. The goal is coordination without diluting accountability.

Mission-Critical Risk and Board Oversight

This also connects to the broader Marchand discussion about board oversight of significant and mission-critical risks. Directors do not need to become operational risk managers. They do need reasonable assurance that management has systems to identify significant risks and escalate material information.

For interconnected risks, that means understanding how management aggregates information. 

  • Which risks are sufficiently significant to require cross-functional oversight?
  • How does management identify emerging combinations of risk?
  • Who resolves disagreements between control functions?
  • What information reaches the board?
  • How are significant risks assigned when they do not fit within one organizational function?

These questions matter most when a risk is central to the company’s business model. The board does not need to manage the monsters. It needs to understand whether management can see when they are moving toward one another. 

Practical Actions for the CCO 

Frankenstein Meets the Wolf Man suggests several practical actions for compliance leadership. The compliance risk assessment should identify not only individual risks but also significant risk intersections. CCOs should look for business units, markets, third parties, products, and strategic initiatives where multiple elevated risks converge. Compliance should establish relationships and information-sharing mechanisms with Internal Audit, Legal, Finance, HR, Information Security, Privacy, Procurement, and Enterprise Risk Management. Significant cross-functional risks should have clear owners, escalation criteria, and decision rights.

CCOs should also consider whether existing compliance dashboards show relationships among risks or simply report individual metrics. Data from investigations, hotline reports, third-party monitoring, policy exceptions, audit findings, and other sources can become substantially more valuable when analyzed together. For emerging technologies such as AI, Compliance should participate in cross-functional governance while avoiding the temptation to own every associated risk. The objective is not centralized ownership. It is connected governance.

The Compliance Lesson

Frankenstein Meets the Wolf Man completes the compliance progression of the Universal Frankenstein films. Organizations create risks. Leadership can compromise in responding to them. New management can inherit them. Remediation can fail to eliminate them. Then those unresolved risks can interact with other risks.

That final stage matters because modern corporate risk is increasingly interconnected. AI touches privacy, cyber, employment, intellectual property, and regulatory compliance. Third-party risk can implicate corruption, sanctions, human rights, cybersecurity, and financial controls. Compensation can affect culture, sales practices, fraud risk, and books and records. No single function can manage these issues effectively on its own.

The solution is not to eliminate functional ownership. Clear accountability remains essential. The solution is to build governance mechanisms that allow information to move, risks to be considered together, and significant issues to be escalated across organizational boundaries. For the CCO, that means becoming an effective connector while preserving the accountability of the business and other control functions.

For management, it means looking beyond individual risk categories. For the board, it means ensuring that committee structures and reporting processes provide an enterprise view rather than a collection of disconnected risk reports. The ultimate lesson from Frankenstein Meets the Wolf Man is therefore not really about either monster individually. It is about interaction. 

A company may understand its corruption risk. It may understand its third-party risk. It may understand its cybersecurity risk. It may understand its AI risk. It may have capable people managing each one. The question is whether anyone understands what happens when those risks meet. That is where compliance moves beyond individual rules and controls and becomes part of enterprise governance. 

After five films, the Frankenstein story leaves us with a useful framework for the modern compliance program: govern what you create, learn from what goes wrong, take responsibility for what you inherit, test whether remediation works, and understand where risks intersect. Because in business, as in the movies, managing one monster is difficult enough. The real governance challenge begins when monsters collide.

Check out the podcast version and analysis of this episode of Popcorn and Compliance with Timothy and Fiona.

Categories
Innovation in Compliance

Innovation in Compliance: The Salus Blueprint: Episode 1 – What Must Keep Working When Things Go Wrong?

What question might a leader face on a difficult morning? In this special podcast series, Marc Duncan, Bridget Lee-Young, and Scott Pickett of Salus Solutions share one useful idea for corporate professionals, including risk and compliance leaders and anti-bribery and corruption professionals, and show how it changes a decision. This podcast is also for police and fire chiefs, emergency managers, finance and operations executives, CEOs, boards, and leaders of commercial, public, and private organizations. In Episode 1, we take a deep dive into what matters most: mission-critical dependencies and Salus Solutions’ Preparedness Toolkit.

Key Highlights:

  1. “If I run an organization and tell you, ‘We have a risk register and an emergency plan,’ what would you ask first to learn whether I know what matters most?”
  2. “What does ‘protect the mission’ mean for a hospital support service, a school, and a commercial operator in everyday terms?”
  3. “Who must be in the first conversation besides the chief executive? What will the front-line operator know that the board may not?”
  4. “Where do dependencies such as communications contractors, utilities, responders, or key individuals enter that conversation?”
  5. “Can you explain SalINTEL, SalTHIRA, SalCAPA, and SalOPS without an acronym chart, using this one organization?”
  6. “What decisions remain with the client, and what work can Salus advise on or support?”
  7. “If a board has only ten minutes, what one question should it ask management to expose an assumption about continuity?”

Questions for Our Listeners: Write down one essential service and ask what people, systems, outside organizations, and decisions it depends on. “If a worker reported a failing dependency tonight, could your organization capture it and get it to someone who understands its significance before the service stops?” Next time, we examine how to collect what matters.

About Salus Solutions (https://salus.solutions): “Salus helps organizations understand what matters, make informed protective decisions, and carry them into action. SalCAPA is the method and coordination environment that connects those steps.”

Categories
Blog

Frankenstein and Compliance: Part 4 – The Ghost of Frankenstein: Declaring the Monster Dead Is Not a Control

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first three Frankenstein films trace a recognizable progression in compliance. Frankenstein examined innovation without adequate governance. Bride of Frankenstein explored what happens when leadership recognizes a risk but lets pressure and rationalization override judgment. Son of Frankenstein shifts to inherited risk and the responsibility of new leadership to address problems its predecessors created. The Ghost of Frankenstein (1942) raises the next question. What happens when the organization believes the problem has already been addressed?

By the fourth film, no credible argument suggests that Frankenstein’s Monster represents an unknown risk. Communities have confronted him. Members of the Frankenstein family have attempted to control him. The consequences are well established. Yet the Monster remains. This time, Ygor, again played by Bela Lugosi, brings the Monster, now played by Lon Chaney Jr., to Ludwig Frankenstein, Henry Frankenstein’s other son. Ludwig initially wants nothing to do with his family’s legacy. He eventually concludes that he can solve the problem through a brain transplant. The proposed solution appears technically sophisticated. It is also compromised when Ygor and Ludwig’s colleague Bohmer secretly substitute Ygor’s brain for the intended brain.

For corporate compliance professionals, The Ghost of Frankenstein is a case study in remediation and control effectiveness. Companies routinely investigate misconduct, revise policies, conduct training, implement corrective actions, and close audit findings. Those activities matter, but they don’t prove the underlying risk has been reduced. The relevant compliance question is not whether management completed the remediation plan. It is whether the remediation worked.

Closure Is an Administrative Status

Compliance, Internal Audit, Legal, Finance, and business management are familiar with corrective-action plans. An issue is identified. Management develops remediation. Actions are assigned. Deadlines are established. Policies may be revised, systems changed, training delivered, or controls added. Eventually, the required actions are completed, and the finding is marked closed. That process is not inherently wrong. Organizations need a disciplined method for tracking remediation. The risk comes when administrative closure becomes confused with risk reduction.

Suppose an investigation finds that employees circumvented a third-party approval requirement. Management revises the policy and retrains the business. Both actions may be appropriate. They also may have little effect if the original problem arose because sales targets encouraged employees to bypass the process and local managers routinely approved exceptions. The policy was not necessarily the root cause. Training was not necessarily the solution. A closed action item therefore tells management that a required activity occurred. It does not automatically establish that the control environment changed. That distinction is central to compliance program effectiveness.

Start With Root Cause

Ludwig Frankenstein approaches the Monster as a technical problem. Replace the brain, and the problem is solved. Compliance can fall into the same trap with remediation. Organizations sometimes start corrective action before they have adequately identified why the failure occurred. Effective remediation should begin with root-cause analysis.

Suppose a salesperson makes an improper payment through a third-party distributor. The immediate facts may be straightforward. The employee violated policy, the payment was inappropriate, and the third party was involved. A root-cause analysis goes further.

Why was the third party selected? Was due diligence adequate? Were red flags identified? Did anyone override the process? Was the compensation structure unusually aggressive? Did management communicate unrealistic sales expectations? Were invoices sufficiently detailed? Did Finance question the payments? Had similar issues occurred previously? Did employees believe management would support them if they delayed the transaction? These questions shift the analysis from the individual event to the system that allowed it to happen.

Individual accountability remains important. A company should not use systemic explanations to excuse deliberate misconduct. But disciplining an employee does not repair a control environment. A strong remediation plan addresses both.

Repeat Findings Are Information

Recurring compliance issues should receive particular attention.

  • If Internal Audit repeatedly identifies the same control weakness, that is information.
  • If multiple investigations identify similar conduct in the same business unit, that is information.
  • If hotline reports repeatedly raise concerns about the same management behavior, that is information.
  • If third-party monitoring continually identifies the same documentation gaps, that is information.

Repeat issues may indicate that previous remediation addressed symptoms rather than causes. They may also indicate weak implementation, insufficient resources, inadequate supervision, or management resistance. The CCO should therefore have a mechanism to identify recurrence across data sources.

An audit finding may appear unrelated to a hotline complaint. A hotline complaint may appear unrelated to a third-party exception. A third-party exception may appear unrelated to an investigation. Viewed together, they may demonstrate a common control problem. This is where compliance data becomes more valuable than compliance statistics. The objective is not simply to count investigations, audit findings, policy exceptions, or hotline reports. The goal is to identify patterns that tell management how the organization operates.

Bohmer and Management Override

The brain-transplant sequence provides the film’s strongest internal-control lesson. Ludwig develops a plan to replace the Monster’s brain. Whatever one thinks of the underlying objective, the process is defined, and the outcome is intended. Then Bohmer and Ygor subvert it.

Control isn’t defeated because nobody designed a process. It fails because individuals with access and opportunity manipulate the process. That is management override. Corporate controls often assume authorized individuals will use their authority as intended. That assumption requires testing.

  • A manager can approve an expense.
  • A finance executive can authorize a journal entry.
  • A procurement leader can approve a vendor.
  • A senior executive can authorize a policy exception.
  • An administrator can change system permissions.
  • A business leader can influence a third-party decision.

Those authorities are necessary for business operations. They can also create risk when one individual possesses excessive discretion or when oversight is weak. Segregation of duties, approval thresholds, access controls, audit trails, independent review, exception reporting, and transaction monitoring exist partly to address this problem. For the CCO, the question is not simply whether a control exists. It is whether someone can circumvent it and whether the organization would know.

COSO and the Broader Control Environment

The Ghost of Frankenstein also provides an opportunity to consider the COSO Internal Control Integrated Framework. Controls do not operate in isolation. The control environment establishes expectations, authority, accountability, and standards of conduct. Risk assessment identifies threats to organizational objectives. Control activities translate those risks into specific preventive or detective measures. Information and communication ensure the right people receive relevant information. Monitoring determines whether the system continues to operate effectively.

Compliance failures often occur when organizations focus too narrowly on a single control activity. A company identifies misconduct involving gifts and entertainment, so it lowers approval thresholds. That may be useful.

  • But what if managers continue encouraging employees to find ways around the limits?
  • What if expense descriptions are vague?
  • What if Finance does not review unusual patterns?
  • What if senior executives routinely receive exceptions?
  • What if employees believe questioning an expense submitted by a powerful executive will damage their careers?

The approval threshold may be well designed. The broader control environment remains weak. This is why compliance should work closely with Internal Audit, Finance, HR, Legal, and business management. Compliance risk rarely fits neatly within one control owner.

Design Effectiveness and Operating Effectiveness

One of the most useful distinctions in controls work is between design effectiveness and operating effectiveness. A control may be well designed. That does not mean it operates effectively. Consider third-party due diligence. The company may have a strong written process requiring risk classification, beneficial ownership review, screening, business justification, approval, contractual protections, and periodic monitoring. On paper, the control appears robust. Then testing reveals that business sponsors routinely submit incomplete information, reviewers approve files without resolving red flags, contracts are signed before diligence is complete, and periodic reviews are months overdue. The control design is not necessarily the problem. It is execution.

Conversely, employees may execute a poorly designed control exactly as instructed, even as it fails to address the relevant risk. Compliance needs to understand both. This matters especially when validating remediation. Management should not simply confirm that a new control was implemented. Someone should determine whether the control is appropriately designed and whether it operates consistently in practice. That is how an organization moves from remediation activity to evidence of effectiveness.

Investigations Should Improve the Program

Investigations represent one of the richest sources of compliance intelligence available to a company. They show where actual conduct differs from expected conduct. Yet organizations sometimes treat investigations primarily as case-management exercises. An allegation arrives, the company investigates, decides whether to substantiate it, takes disciplinary action where appropriate, and closes the matter. That process resolves the case. It does not necessarily improve the compliance program.

For significant matters, a compliance professional should ask what the investigation teaches the organization.

  • Did a control fail?
  • Was a policy unclear?
  • Was supervision inadequate?
  • Were incentives relevant?
  • Did the reporting system work?
  • Was retaliation alleged?
  • Were similar concerns raised previously?
  • Did management respond appropriately when warning signs appeared?
  • Should monitoring change?
  • Should the risk assessment change?

The investigation should feed the compliance program. Otherwise, the organization may become very efficient at investigating the same problem repeatedly.

Test the Remediation

Perhaps the most important lesson from The Ghost of Frankenstein is that remediation requires validation. Management implements a corrective action. Someone should return later and determine whether it worked. The timing and depth of testing should depend on risk. A significant control failure may require independent validation by Internal Audit, Compliance testing, or another qualified function. Lower-risk matters may be validated through management review or monitoring. The important point is that the organization should define what success looks like before declaring the remediation effective.

The Compliance Lessons

The Ghost of Frankenstein demonstrates a basic principle of compliance program effectiveness. Activity is not the same as effectiveness. A company can revise a policy, deliver training, add an approval, complete a corrective-action plan, and close an audit finding. Each action may be appropriate. The compliance question is whether those actions changed the risk.

That requires root-cause analysis, well-designed controls, disciplined implementation, monitoring, testing, and accountability. It also requires management to recognize that some failures are not caused by employees misunderstanding the rules. They may result from incentives, authority structures, management override, weak supervision, or a control environment that rewards the wrong behavior.

The goal of remediation is not to demonstrate that the organization did something. It is to demonstrate that the organization learned something and changed accordingly. That is why declaring the Monster dead is not a control. The evidence comes from whether he stays dead.

Our final installment of my Universal Classic Monster Movie Month for 2026 takes the Frankenstein compliance story in a different direction. After four films dealing largely with one persistent risk, Universal brings another major risk into the picture. In Frankenstein Meets the Wolf Man, the issue is no longer simply whether an organization can identify, govern, inherit, or remediate a single compliance problem. It is what happens when independently managed risks begin to interact. For modern companies confronting AI, cybersecurity, privacy, third-party, sanctions, anti-corruption, financial, and operational risks, that may be the most important governance question of all: What happens when the risks we manage separately collide?

For a review of the movie and audio analysis, check out Timothy and Fiona’s take on it in Popcorn and Compliance.

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 3: Son of Frankenstein – Inheriting the Castle Means Inheriting the Risk

This October, Tom Fox returns to one of his all-time favorites: Universal Pictures’ Classic monsters. Over the years, Tom has explored classics like Dracula, The Mummy, The Wolf Man, and The Invisible Man, as well as films by Val Lewton and Hammer Studios. This year, he wanted to return for a deep dive into the first five Frankenstein movies. He has considered, or will consider, the original Frankenstein, Bride of Frankenstein, Ghost of Frankenstein, and Frankenstein Meets the Wolfman. In this third episode, he considers what many viewers regard as the series’ best: Son of Frankenstein, released in 1939. This is the final film to feature Boris Karloff as Frankenstein’s Monster. In this exploration, Tom Fox uses his AI friends, Timothy and Fiona, to provide commentary.

Film Synopsis:

Son of Frankenstein brings Basil Rathbone into the saga as Wolf von Frankenstein, who returns with his family to his father’s estate hoping to restore the Frankenstein name. Instead, he encounters Bela Lugosi’s extraordinary Ygor and discovers that his father’s Monster, played for the final time by Boris Karloff, is still alive but comatose. Wolf revives him, hoping to vindicate his father’s work, but Ygor has his own plans and uses the Monster to settle old scores. The result is another catastrophe created by a Frankenstein convinced that this time things will be different.

Key highlights:

  • You can inherit risk without creating it.
  • This is the M&A compliance movie.
  • Ygor represents institutional knowledge used for the wrong purpose.
  • Inspector Krogh represents institutional memory.
  • Red flags transform governance responsibility.

Popcorn and Compliance takeaway: You may not have created the Monster, but once you know he is in the basement, he becomes your governance problem.

Timothy and Fiona are AI-generated voices courtesy of NotebookLM.

Categories
Blog

Ted Lasso Week: Part 2 – Rebecca Welton: Misuse of Authority, Conflicts of Interest, and the Path to Accountability

Season 4 of Ted Lasso is out. Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over five blog posts, I will consider Manager Ted Lasso, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today in Part 2, we consider compliance lessons through the character of team owner Rebecca Welton.

In Part 1, we considered how Ted Lasso built psychological safety and an ethical culture while sometimes allowing empathy to outrun accountability. Rebecca Welton presents the problem from the other side of the executive table. She begins as the source of AFC Richmond’s misconduct, then becomes the leader best positioned to acknowledge it.

Rebecca’s story is not simply a redemption arc. It is a governance case study about what happens when personal objectives capture corporate authority. It also shows why confession, forgiveness, and improved behavior are necessary but insufficient elements of an effective remediation program. The compliance lesson is direct: power creates risk when no independent mechanism can question the person exercising it.

When the Owner Becomes the Risk

In “Pilot” (Season 1, Episode 1), Rebecca hires Ted, an American football coach with no soccer experience, to manage a Premier League club. Her stated rationale is irrelevant because her actual purpose is to destroy the institution Rupert Mannion loves. She uses Richmond’s people, reputation, competitive position, and financial value to pursue a private grievance.

That is a classic conflict between personal interest and organizational duty. Rebecca is not accepting an envelope of cash or steering a contract to a relative. Her conflict is more fundamental: she has converted corporate decision-making into an instrument of revenge. The COSO Internal Control Framework begins with the control environment, including integrity, ethical values, oversight, authority, and accountability. At Richmond, the control environment fails at the top. The owner sets an improper objective, possesses the authority to execute it, and faces no visible independent challenge.

Compliance officers should take note. Conflicts of interest do not end with disclosure forms. They arise whenever personal relationships, status, resentment, financial incentives, or outside interests can distort business judgment. The greater the executive’s authority, the stronger the required safeguards.

Concentrated Authority Silences Challenge

Rebecca’s plan requires assistance. Higgins facilitates her agenda even though he recognizes the harm. In “Make Rebecca Great Again” (Season 1, Episode 7), Rebecca arranges for a photographer to capture Ted and Keeley in a compromising image. The objective is not legitimate media strategy. It is manufactured reputational damage intended to destabilize Ted and the club.

Higgins is not merely an unfortunate bystander. He is a senior employee who allows access, information, and organizational machinery to serve the owner’s improper purpose. His eventual resignation is a delayed act of conscience, but the episode demonstrates how authority can corrupt the escalation process. Employees may know that conduct is wrong and still conclude that challenging the owner is futile or career-ending.

The DOJ Evaluation of Corporate Compliance Programs asks whether “compliance personnel (1) sufficient qualifications, seniority, and stature (both actual and perceived) within the organization; (2) sufficient resources, namely, staff to undertake the requisite auditing, documentation, and analysis effectively; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” It also asks whether managers encourage or discourage compliance through their conduct. Richmond has no credible independent function capable of reviewing Rebecca’s decisions, investigating her conduct, or escalating around her.

Accountability Begins With Truth

Keeley becomes the effective speak-up channel Richmond lacks. Once she discovers Rebecca’s scheme, she does not accept friendship, hierarchy, or reputational risk as reasons to stay silent. She insists that Rebecca tell Ted the truth. Rebecca finally does so in “All Apologies” (Season 1, Episode 9). She admits that she hired Ted to fail, orchestrated the paparazzi scheme, and engineered Jamie Tartt’s return to Manchester City to weaken Richmond. Most importantly, she does not minimize her purpose. She explains that she wanted to hurt Rupert and used Ted and the club to do it.

This is an effective apology because it identifies conduct, intent, and harm. It also accepts the possibility of consequences. Yet it is not a remediation. Nevertheless, Ted forgives her immediately, but an actual organization could not stop there. The U.S. Sentencing Guidelines require an organization to respond appropriately after misconduct and take reasonable steps to prevent similar conduct. DOJ asks whether the company performed a root-cause analysis, disciplined responsible individuals, repaired controls, and tested whether remediation works.

Richmond would need an independent review of affected personnel decisions, financial consequences, sponsor and stakeholder impacts, the use of confidential information, and Higgins’s role. It would also need governance changes that prevent one executive from repeating the conduct. An apology can reopen trust. Only remediation can reduce recurrence risk.

The Conflict Problem Returns With Sam

Rebecca’s growth does not eliminate conflicts. In “The Signal” and “Headspace” (Season 2, Episodes 6 and 7), Rebecca discovers that her anonymous Bantr match is Sam Obisanya, a Richmond player. Their relationship develops in “Man City” (Season 2, Episode 8) and continues secretly into “No Weddings and a Funeral” (Season 2, Episode 10).

The relationship is portrayed with warmth and mutual affection. That does not resolve the organizational issue. Rebecca owns the club that controls Sam’s employment environment. Her decisions can affect contracts, playing resources, sponsorships, reputation, and career opportunities. Even if she never exercises that power improperly, the imbalance creates an appearance of favoritism and raises questions about consent, retaliation, confidentiality, and recusal.

The compliance response is not moral judgment. It is a process. A conflict policy must apply to owners and senior executives, not only employees. Disclosure should go to an independent board member or committee. The organization should document safeguards, remove the conflicted leader from relevant decisions, protect the less powerful party, and monitor for retaliation or preferential treatment. Rebecca eventually pauses the relationship, but Richmond never appears to activate a formal conflict-management process. Personal restraint is not a control.

From Personal Ownership to Stewardship

Rebecca’s leadership changes when she stops treating Richmond as property and begins treating it as an institution held in trust for others. In “Do the Right-est Thing” (Season 2, Episode 3), Sam protests sponsor Dubai Air because of its connection to environmental damage in Nigeria. Rebecca backs the players despite the commercial risk. She recognizes that sponsorship revenue does not outrank organizational values.

Her transformation is clearest in “International Break” (Season 3, Episode 10). Edwin Akufo invites elite club owners to join an exclusive league built around scarcity, control, and profit. Rebecca rejects the proposal by reminding the room that football belongs to the people whose lives and communities give it meaning. She chooses stakeholder legitimacy over a lucrative insiders’ arrangement.

In “So Long, Farewell” (Season 3, Episode 12), she completes that shift by selling 49 percent of Richmond to its supporters. The woman who once used the club as a weapon ultimately distributes part of its ownership to the community.

This is what ethical remediation should seek: not a return to the status quo, but a more accountable operating model.

Questions for CCOs

Rebecca’s journey should prompt five questions:

  1. Can an allegation against the CEO, founder, controlling shareholder, or board chair bypass that person and reach an independent decision-maker?
  2. Do conflict rules cover personal relationships, vendettas, reputational motives, and executive discretion, or only financial interests?
  3. When senior misconduct occurs, who controls the investigation, discipline, disclosure, and remediation plan?
  4. Does the board receive reliable information about culture and mission-critical risks without management filtering?
  5. Are remediation measures tested, documented, and sustained after the responsible leader apologizes?
  6. Rebecca Welton shows that leaders can change. Compliance must make that change governable. Trust is rebuilt when truth is followed by independent review, proportional accountability, control improvements, and evidence that the organization learned.

Next Up: Nate Shelley and Culture Risk

Rebecca’s failure begins with power concentrated at the top. Nate Shelley’s failure develops lower in the organization, where insecurity, humiliation, status, and unaddressed resentment turn a once-overlooked employee into a destructive manager and trusted insider. In Part 3, we will examine the warning signs Richmond missed, the consequences of promoting technical talent without preparing them to lead, and why a speak-up culture must detect harm committed by newly empowered employees as readily as misconduct committed by executives.

Categories
Blog

Connected Compliance: Part 2 – From Risk Register to Risk Radar

An effective compliance program is not a collection of disconnected policies, training modules, hotline reports, and investigation files. It is an operating system. Culture determines whether employees will use it. Risk assessment tells the organization where it must adapt. Investigations test whether the system responds credibly. Whistleblower programs reveal whether employees trust it enough to speak. Blog 1 examined communication as the control that connects those elements. In this Part 2, we examine what compliance must do with the intelligence that communication produces.

The traditional risk assessment was built for a world that moved more slowly. Compliance gathered a group of leaders, reviewed enforcement trends, scored familiar risks, produced a heat map, and returned to the exercise the following year. That process still has value, but it is no longer enough.

Today, a new market restriction, customer demand, artificial intelligence deployment, supply-chain disruption, sanctions measure, or data rule can alter the company’s risk profile before the annual plan is approved. The central question is therefore not whether the organization has a risk register. It is whether compliance has a risk radar that can detect change, decide what matters, assign ownership, and translate the signal into action.

Every Compliance Risk Has a Political Dimension

Compliance obligations do not develop in a vacuum. They reflect choices made by governments about national security, trade, technology, labor, privacy, corruption, competition, and corporate accountability. For a multinational company, those choices may conflict, overlap, or change with little notice. Particularly in this political age, the single most-used byword is volatility.

That makes geopolitical awareness a compliance capability. It does not require the CCO to become a foreign-policy analyst. It requires the compliance function to understand how political priorities can become legal obligations, enforcement pressure, customer expectations, or operational constraints. Export controls can reshape product access. Sanctions can alter payment and counterparty risk. Forced-labor requirements can reach deep into a supply chain. AI rules can change how a business collects data, develops products, and makes decisions.

The practical lesson is that legal change is often the last stage in a longer policy development process. Compliance should monitor the earlier signals: legislative proposals, agency speeches, enforcement patterns, trade measures, customer questions, supplier difficulties, and operational workarounds. These indicators do not all demand a program change, but they should enter a disciplined triage process.

What the DOJ Is Really Asking

The Department of Justice has made dynamic risk assessment part of the effectiveness inquiry. The 2024 Evaluation of Corporate Compliance Programs (ECCP) directs prosecutors to consider “emerging risks as internal and external circumstances impacting the company’s risk profile evolve.” This risk profile can change due to factors outside a company’s control or its own business decisions. Moreover, the ECCP language moves risk assessment beyond a scheduled document and into continuous management.

DOJ then asks: “Is the company’s approach to risk management proactive or reactive?” The distinction is critical. A reactive program updates controls after a failure, enforcement action, or audit finding. A proactive program uses operational information across functions to identify change before misconduct occurs. The ECCP also asks whether periodic review is merely a point-in-time exercise or draws on continuing access to operational data, and whether the results lead to updates in policies, procedures, and controls.

The enforcement question is not whether the company predicted every development. No program can. The question is whether the company had a reasonable process for identifying material changes, directing resources to higher-risk areas, documenting its decisions, and revising the program over time.

Build the Risk Radar From Multiple Signals

A dynamic risk process begins with a wider field of vision. Regulatory alerts and outside counsel updates are useful, but they show only part of the environment. Some of the earliest warnings come from inside the business. Sales may see unusual customer demands in a new market. Procurement may find suppliers unable to provide origin information. Finance may identify payment routes that no longer fit the expected transaction. Information security may discover employees using unapproved AI tools. Human resources may raise concerns about retaliation or pressure related to performance targets. Audit may identify recurring exceptions. Hotline reports and investigations may reveal a pattern that a heat map missed.

Compliance should bring these signals together through a repeatable cadence. A quarterly cross-functional review can examine changes in the business model, geography, products, third parties, technology, enforcement, and employee concerns. High-velocity risks may require monthly or event-driven review. The objective is not to create another committee. It is to establish a reliable place where weak signals are compared, challenged, and assigned.

Or simply look at the changes wrought by the Trump Administration in 2026 alone. Venezuela is now open for business. How about the Democratic Republic of Congo? See here and here. Of course there is Iran, but you have to ask what week it is and are we doing business with Iran or are we at war with Iran.

Give One Person the Clock

Emerging risks often fall between organizational boxes. Legal understands the rule. Compliance sees the control issue. Operations owns the process. Procurement controls the supplier relationship. Technology owns the system. To use a well-worn maxim, if everyone is in charge, no one is in charge. In the corporate world, when everyone is generally responsible, no one is specifically accountable. This is both why and where compliance needs to step up its game.

Every material risk needs a named owner with the authority to convene the necessary functions, set deadlines, escalate disagreements, and report on the disposition. That person does not perform every task. The owner keeps the clock, maintains the decision record, and ensures that the issue does not disappear between meetings.

Governance should also define escalation triggers. A credible framework identifies which developments require immediate executive attention, which can be handled through a working group, and which should remain under observation. Without thresholds, organizations either under-escalate material risk or flood leadership with undeveloped issues.

Use a Two-Speed Assessment

Not every signal requires an enterprise-wide risk assessment. Compliance needs two speeds. The first is rapid triage. A small group of subject-matter experts identifies the potential legal obligation, affected operations, time horizon, severity, available data, current controls, and immediate containment needs. This is where AI can play a key role in compliance, essentially superforecasting risks to enable quick, efficient risk management strategies when volatility hits. Additionally, such an approach may lead to a decision to monitor, take interim action, or launch a deeper review.

The second is formal assessment. Complex or high-impact risks may require structured interviews, data analysis, control testing, external counsel, forensic support, or scenario planning. The deeper process should be proportionate to the exposure, not triggered simply because the issue is new. This two-speed model protects agility without sacrificing rigor. It also creates evidence that the company made a reasoned decision. A short written triage record can show what information was considered, who participated, why the company chose its response, and when the issue will be reviewed again.

Convert Assessment Into Real Controls

The most common failure is not the inability to identify risk. It is the failure to convert assessment into a viable risk management strategy and then to implement, monitor, and improve your business operations. A new questionnaire, certification, or policy may create documentation, but documentation alone does not mitigate the underlying exposure.

Consider third-party risk. A supplier questionnaire can identify missing information, but the control lies in what happens next: enhanced diligence, contractual protection, source verification, payment restrictions, audit rights, monitoring, remediation, or a decision not to proceed. The same principle applies to AI. An AI-use policy matters, but effective governance also requires an inventory of use cases, approval gates, data controls, human oversight, testing, monitoring, and accountability.

Each response should identify the control objective, owner, implementation date, evidence, and testing method. Compliance should also ask what existing control can be adapted before building a separate program. Strong governance, escalation, training, data access, and investigation processes are reusable infrastructure across risk domains.

Resource allocation is part of that conversion. If a changing risk profile calls for deeper third-party monitoring, faster export review, or additional AI oversight, the organization must decide what people, technology, and budget will support the response. Compliance cannot claim to be risk-based when yesterday’s priorities continue to dictate today’s resources. The allocation decision, including any accepted constraint, should be visible and documented.

Treat Change Management as a Control

A technically correct response can still fail if employees do not understand it or the business cannot implement it. New requirements frequently collide with established incentives, systems, customer commitments, and local practice. Change management should therefore be part of the control design. Explain why the risk changed. Identify which decisions and workflows are affected. Train the employees and gatekeepers who must act differently. Provide a practical escalation route. Test understanding. Gather feedback. Then revise the process when implementation exposes friction or unintended consequences. For a full discussion of change management as a compliance control, listen to the podcast Ronnie Feldman and I did with Caveni Wong on this episode of Creativity and Compliance.

This is where blog post 1’s communication discipline comes into play. Compliance cannot adapt to risk through broadcast messages alone. It needs a two-way channel that tells employees what changed and tells compliance whether the response works in practice.

Measure Adaptation, Not Activity

The number of risk meetings or completed assessments says little about effectiveness. Better measures test whether the organization moves from signal to decision and from decision to control. Useful indicators include the time required to triage a material development, percentage of actions with named owners and deadlines, overdue remediation, control implementation and testing results, repeat exceptions, unresolved ownership disputes, and lessons incorporated from investigations.

Compliance should also examine whether resources shifted when risk shifted. A program that identifies a higher risk but leaves staffing, monitoring, and controls unchanged has produced analysis without management. The result should be a closed loop: detect, assess, assign, mitigate, test, and learn. That loop turns risk assessment from an annual artifact into a management process.

That transition is where program credibility is tested. Join us tomorrow as we consider how organizations scope investigations, preserve independence, establish consistency, document decisions, and convert findings into remediation. A dynamic risk process helps the company see the signal. A credible investigation determines what happened and what the organization must do next.

Bonus Questions for Compliance Professionals

  1. Which internal and external signals can change the company’s risk profile between formal assessments?
  2. Who has specific ownership for emerging risks that cross legal, compliance, operations, procurement, finance, and technology?
  3. What criteria determine whether an issue is monitored, triaged, escalated, or formally assessed?
  4. Can the company show how a recent risk assessment changed a policy, control, resource allocation, or business decision?
  5. Do substantive mitigation and ongoing monitoring support questionnaires and certifications?
  6. How quickly can the organization move from a weak signal to a documented decision?
  7. What recent investigation finding should change the current risk assessment?
Categories
Daily Compliance News

Daily Compliance News: June 26, 2026, The Forever Chemicals Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Eric Adams, the Chief of Staff, was arrested in a corruption probe.  (CNN)
  • War, volatility, and risk. (NYT)
  • Chemours to pay $450MM to forever chemicals claims. (WSJ)
  • Apple raises computer prices by 20%. (FT)

To learn about the intersection of Sherlock Holmes and the modern compliance professional, check out Tom’s latest book, The Game is Afoot-What Sherlock Holmes Teaches About Risk, Ethics and Investigations on Amazon.com.

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 16 – Leadership Lessons from The Galileo 7

Show Summary

In the rich tapestry of leadership parables woven by Star Trek: The Original Series, the episode “The Galileo Seven” offers an extraordinary case study in adaptive leadership for compliance professionals.

Captain Kirk dispatches the shuttlecraft Galileo, commanded by Mr. Spock, to investigate a mysterious spatial phenomenon known as the Murasaki 312 quasar-like formation. Things quickly escalate when Galileo crash-lands on Taurus II, a hostile and primitive planet. Faced with limited resources, dwindling time, and escalating internal conflicts among the shuttlecraft crew, Spock must navigate his first significant command crisis without the immediate guidance of Captain Kirk.

Drawing parallels from “The Galileo Seven,” we explore critical leadership lessons and their practical implications for compliance professionals.

1. Logic vs. Emotional Intelligence—Know When to Adjust

Illustrated by: Spock’s initial adherence strictly to logic, which causes friction among his crew.

Initially, Spock applies logic rigidly, prioritizing scientific analysis and efficiency above all else. However, his lack of emotional awareness and inability to adapt to crew concerns cause resentment and weaken morale. For compliance officers, this highlights the importance of emotional intelligence in leadership. Successful compliance leaders understand that emotions, fears, and motivations drive people. 

2. Collaborative Decision-Making—Recognize the Power of the Team

Illustrated by: Spock’s initial refusal to accept team input, followed by his eventual realization of its value.

Initially, Spock resisted his team’s input, confident that his logic alone would lead them to safety. However, after multiple setbacks, including the loss of crew members and mounting internal pressure, Spock recognizes the need for collaborative input. In compliance, unilateral decision-making can often lead to resistance or compliance failures. Encouraging team participation fosters diverse perspectives, enriches problem-solving, and enhances implementation success.

3. Adaptive Communication—Tailor Your Message

Illustrated by: Spock learning to communicate more effectively under crisis conditions.

Initially, Spock’s communication style was overly technical, direct, and unemotional. This approach alienates crew members who need reassurance, context, and encouragement. For compliance professionals, transparent, adaptable communication is paramount. Compliance officers regularly interact with diverse audiences, and each group requires a tailored approach to communication. Employees need practical, understandable instructions; senior executives seek strategic implications and bottom-line impacts; regulators require precise, factual responses.

4. Strategic Flexibility—Be Prepared to Shift Tactics

Illustrated by: Spock’s decision to jettison shuttle fuel as a distress signal.

Spock makes an unconventional decision to ignite Galileo’s remaining fuel to create a distress signal. This act is a decisive departure from his logic-based strategy, demonstrating Spock’s ability to pivot rapidly under pressure. Compliance leadership requires similar strategic flexibility. Regulations evolve, new risks emerge, and organizational dynamics shift quickly. Compliance officers must be agile, ready to abandon approaches that are not working and to pivot to new strategies that address a changing landscape.

5. Crisis Leadership—Maintain Composure and Provide Clarity

Illustrated by: Spock’s calm demeanor under extreme pressure.

Throughout the escalating crisis, Spock maintains remarkable composure, never allowing panic or emotional strain to overtly influence his behavior. Employees and executives alike look to compliance professionals for clear-headed leadership during turmoil.

6. Continuous Learning—Grow Through Experience

Illustrated by: Spock’s reflection on the mission’s challenges and outcomes.

By the end of the episode, Spock demonstrates meaningful growth as a leader, reflecting on the lessons learned from the crisis and acknowledging his initial shortcomings. Compliance officers should adopt this same mindset of continuous learning. Rather than viewing mistakes as purely negative, compliance professionals can treat them as opportunities to refine their approach, enhance their strategic perspective, and improve compliance practices.

Final ComplianceLog Reflections

“The Galileo Seven” is not just a thrilling adventure; it is a masterclass in adaptive leadership that compliance professionals can emulate. Spock’s journey from rigid logic to adaptive, compassionate leadership underscores that effective compliance officers must be dynamic, empathetic, collaborative, flexible, composed, and continuously learning.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Timothy and Fiona are AI-generated voices.

Categories
Blog

The Muppet C-Suite: A Compliance Professional’s Guide to Culture, Controls, and Chaos Part 4: Animal as Chief Operating Risk Officer: Managing Chaos Before Chaos Manages You

This week we are honoring the return of The Muppets for a 2026 Special Edition. I thought it would be fun to look at business leadership teams through the lens of The Muppets. Every compliance professional has worked with a Kermit, managed a Piggy, worried about a Gonzo, or tried to contain an Animal. Today, we conclude by looking at The Animal problem. This series has used the Muppet executive team as a framework to explore leadership, governance, innovation, operational risk, and corporate compliance through the lens of the DOJ’s Evaluation of Corporate Compliance Programs and modern governance expectations.

Every organization has an Animal. Sometimes it is a person. Sometimes it is a business unit. Sometimes it is a revenue stream so profitable that leadership stops asking difficult questions. But every organization eventually encounters a force that is energetic, productive, volatile, difficult to control, and capable of creating enormous operational damage if left unmanaged. That is Animal.

As Chief Operating Risk Officer, Animal represents a truth many organizations struggle to confront: the greatest operational risks are often tolerated because they generate short-term success. An animal is loud, destructive, impulsive, emotional, and frequently one bad day away from catastrophe. Yet he is also highly effective in the environment for which he was designed. He brings energy, intensity, speed, and momentum.

The problem is not that Animal exists. The problem is when the organization mistakes unmanaged volatility for sustainable performance. That is where compliance, governance, and operational discipline become critical.

Operational Risk Rarely Arrives Quietly

One of the most dangerous assumptions organizations make is that operational failure arrives gradually and predictably. Often, it does not. Operational breakdowns tend to emerge after warning signs have already been normalized:

  • repeated policy exceptions,
  • constant escalation failures,
  • excessive workload pressure,
  • ignored complaints,
  • control fatigue,
  • unmanaged third parties, and
  • and high-performing employees who are allowed to operate outside established expectations.

Animal embodies this normalization problem perfectly. Everyone knows he is dangerous. Everyone knows he is unpredictable. Everyone knows he creates operational instability. Yet the organization repeatedly tolerates the behavior because the show benefits from his energy. This is how many operational crises develop in real organizations. The issue is rarely ignorance. The issue is tolerance.

The Compliance Challenge of High-Performing Risk Creators

One of the DOJ’s most important compliance questions is whether organizations apply discipline consistently, regardless of title, status, or revenue generation. That sounds straightforward. In practice, it is extraordinarily difficult. Organizations routinely create informal exceptions for:

  • top producers,
  • senior executives,
  • innovative teams,
  • politically connected employees, and
  • and operational leaders are perceived as indispensable.

An animal represents this exact governance problem. A mature compliance program recognizes that unmanaged high performers create enterprise risk because they gradually teach the organization that controls are optional for the “right” people. Once that message spreads, culture deteriorates quickly. Employees notice:

  • who gets exceptions,
  • whose misconduct is ignored,
  • whose violations are minimized, and
  • and whether leadership consistently enforces standards.

That is why operational risk is deeply connected to culture. Operational instability rarely begins with a single process failure. It usually begins with accountability failure.

Animal and the Failure of Escalation

Perhaps the most dangerous thing about Animal is not his volatility. The organization tends to underestimate the seriousness of the risk until after damage occurs. This reflects a common corporate governance problem: escalation fatigue. Over time, organizations become accustomed to recurring dysfunction:

  • “That is just how he operates.”
  • “That team is always difficult.”
  • “They are under pressure.”
  • “The business results justify the headaches.”
  • “We can manage around it.”

Those statements are operational-risk warning signs. A mature compliance program must create escalation structures capable of identifying:

  • repeated near misses,
  • recurring control failures,
  • cultural deterioration,
  • operational shortcuts, and
  • and conduct risks before they evolve into crises.

An animal should not require an explosion before leadership intervenes. Unfortunately, many organizations wait for exactly that moment.

Root Cause Analysis Matters

When operational failures occur, organizations often focus immediately on the visible event:

  • the failed transaction,
  • the misconduct,
  • the regulatory inquiry,
  • the system failure, and
  • or the public embarrassment.

But effective governance requires deeper analysis. The ECCP specifically emphasizes root cause analysis because sustainable remediation depends on understanding why the failure occurred in the first place. With Animal, the obvious answer might be: “Animal lost control.”

But the real questions are:

  • Why was the risk tolerated repeatedly?
  • Why were escalation signals ignored?
  • Why were controls insufficient?
  • Why did leadership normalize the volatility?
  • Why were prior incidents dismissed as isolated?

Those questions move the organization from blame to governance. A mature compliance function should always ask whether operational failure reflects:

  • incentive problems,
  • leadership failures,
  • staffing pressures,
  • inadequate oversight,
  • resource constraints, and
  • or cultural normalization of misconduct.

Without root cause analysis, organizations simply reset the stage for the next crisis.

Speak-Up Culture and Operational Risk

Animal also highlights the importance of a culture of speaking up. In many organizations, employees recognize operational risk long before leadership does. The problem is that employees often conclude:

  • raising concerns changes nothing,
  • leadership already knows,
  • retaliation risk is too high,
  • or operational pressure outweighs ethical concerns.

That silence becomes dangerous. The DOJ increasingly expects organizations to maintain effective reporting channels, anti-retaliation protections, and meaningful investigative response mechanisms. But a speak-up culture is not merely a hotline issue. It is a credibility issue. Employees must believe:

  • concerns will be heard,
  • escalation will occur,
  • retaliation will not be tolerated,
  • and leadership is willing to intervene even when operational performance is affected.

In Animal’s world, the organization often appears resigned to the chaos. That resignation is itself a governance failure.

Crisis Management Is a Governance Discipline

Animal is also a reminder that crisis management is not public relations. It is governance under pressure. Operational crises test:

  • leadership credibility,
  • escalation systems,
  • internal communication,
  • decision-making discipline,
  • documentation quality, and
  • and organizational resilience.

Strong organizations prepare for operational disruption before it occurs. That means:

  • crisis-management protocols,
  • escalation matrices,
  • tabletop exercises,
  • communication plans,
  • cross-functional coordination, and
  • and clear authority structures.

Animal should never be the organization’s first operational surprise.

Yet many companies operate as though volatility itself is unpredictable when, in reality, warning signs existed for months or years. The question is whether leadership chose to recognize them.

Control Fatigue Is Real

One of the most overlooked operational risks is control fatigue. When organizations operate under constant pressure, employees gradually begin bypassing safeguards:

  • approvals become rushed,
  • documentation becomes incomplete,
  • exceptions become routine,
  • monitoring weakens,
  • and oversight becomes reactive instead of preventive.

Animal accelerates this dynamic because his operational style rewards speed and intensity over discipline and sustainability. That creates a dangerous cycle:

  1. pressure increases,
  2. controls weaken,
  3. near misses increase,
  4. normalization expands, and
  5. and eventually failure becomes inevitable.

A mature compliance program continuously monitors for this pattern because operational collapse rarely occurs without warning.

5 Key Takeaways for the Compliance Professional

1. Operational risk is often tolerated because it produces results.

Organizations must resist creating informal exceptions for high-performing but destabilizing individuals or business units.

2. Escalation failures are early warning signs.

Repeated policy exceptions, ignored concerns, and normalized dysfunction frequently precede major operational breakdowns.

3. Root cause analysis is essential for sustainable remediation.

Organizations should investigate not only what failed, but why leadership and controls allowed the failure to persist.

4. Speak-up culture directly affects operational resilience.

Employees must trust that concerns will be heard, investigated, and acted upon without retaliation.

5. Crisis management is a governance function.

Effective organizations prepare for operational disruption through planning, escalation structures, monitoring, and cross-functional coordination.

The Final Governance Lesson

Across this series, Kermit, Piggy, Gonzo, and Animal together represent the four forces constantly shaping corporate governance:

  • leadership,
  • reputation,
  • innovation,
  • and operational risk.

The lesson is not that organizations should eliminate strong personalities, ambition, experimentation, or intensity. The lesson is that mature governance recognizes these forces early and builds systems capable of channeling them responsibly.

Kermit provides stability.

Piggy creates visibility.

Gonzo drives innovation.

Animal tests the strength of operational controls.

Every organization contains all four. The real question for compliance professionals is whether the governance structure is strong enough to keep the theater standing when all four are operating at the same time. Because eventually, they will be.

Long Live The Muppets