C-suite more confident than practitioners about AI’s accuracy

More than a quarter of business executives (26%) say audits have detected AI-generated mistakes in materials that have made their way to the board or external audiences, according to a survey from corporate reporting platform Workiva.

The survey of more than 2,200 global finance, risk and sustainability professionals also highlighted a modest split between the C-suite and practitioners when it comes to AI’s trustworthiness. About 4 in 5 executives (84%) said they’d be at least somewhat confident in AI output appearing in an annual report without human review, while only 76% of practitioners said the same.

Investors are tracking both AI’s accuracy and its profitability. Most institutional investors in the survey (89%) said they were concerned about AI accuracy in corporate disclosures, while 51% said they are tracking revenue growth to gauge AI’s return on investment. 

Other findings include:

• 47% said their organizations formally model the climate-related impacts of AI investments and include them in the business case before approval.
• Among executives at public companies or those on the path to IPOs, more than 90% were at least somewhat likely to say they would continue to publish quarterly earnings figures even if the SEC adopts a rule to permit semiannual reporting.
• 88% of executives said training their workforce on AI is a top priority in the second half of the year. 

Less than 30% of organizations have full AI governance

Organizations are putting money into AI governance, but few have fully operationalized controls, according to a survey by Schellman, an IT compliance and cybersecurity firm. 

Surveying 525 US-based AI governance professionals, Schellman found that almost all (90%) said their organizations have allocated funding for AI governance, but only 27% say their AI governance is mature, operational and continuously monitored.

Despite funding AI governance, only two-thirds (64%) of organizations have a baseline formal, documented AI acceptable use policy that’s communicated to employees, respondents reported. Less than half (44%) have documented AI-specific incident response procedures, while 57% maintain a formal AI governance policy.

Organizations’ nascent AI governance is being outpaced by agentic AI adoption, according to the survey. A vast majority (86%) have put agents into testing and 46% have agents in production. Organizations don’t always require human oversight of AI agents with 38% reporting they require human review only for high-risk or high-impact AI agent decisions, 32% requiring human review for all agent actions and 22% having defined thresholds that would trigger a human review.

Data center boom means risk is booming, too

As data center project investment is expected to balloon to more than a trillion dollars by 2027, risks for these projects are also skyrocketing with climate and labor being some of the prominent liabilities, according to a report by business insurance provider Allianz Commercial.

Nearly 80% of global data center capacity is located in areas exposed to heightened natural catastrophe risk, the report said. Flood, wildfire and wind exposure is highest in the Americas, affecting 86% of capacity, while chronic heat and drought stress is greatest in Asia Pacific, where 89% of capacity is exposed. Natural catastrophes rank second behind fire as the cause of the highest financial loss for data centers, according to the report. Willful acts, including physical and cyber crime, are the third-highest cause.

The data center boom is being driven by the need for computing power for AI, which is being adopted rapidly by enterprises, quickly outpacing their governance of the technology, according to surveys.

The post 26% of Execs Say Audit Has Caught Public-Facing AI Mistake appeared first on Corporate Compliance Insights.

Compliance professionals face a paradox, writes Melisa Buie, Ph.D., organization strategist and author. Their job is to scrutinize every detail, anticipate regulatory shifts and protect the organization from consequences ranging from reputational damage to criminal liability with no margin for error. That can start a cycle undermining the cognitive sharpness their work demands.

There is no shortage of stress for compliance professionals. Regulatory environments are fragmenting at an accelerating pace. Teams are stretched thin trying to keep up with a patchwork of data privacy, digital asset and AI governance rules that shift from one jurisdiction to the next. Now add an arms race on top of that; criminals are using AI, automation and crypto to run increasingly sophisticated fraud schemes, while many compliance teams are still stuck with legacy systems built for a different era. Layer on top of that a troubling trend toward recentralizing compliance under legal departments and reducing its visibility to senior leadership, and you have a profession operating under extraordinary pressure with diminishing organizational support.

That pressure starts in the office, but it follows the compliance professional home, and it eventually goes to bed.

Inadequate sleep can lead to serious physical and emotional problems, regardless of occupation. A 2023 analysis published in the journal Psychological Bulletin synthesized more than 50 years of experimental research on sleep and emotion. The results, based on 154 studies and 5,715 participants, were clear: Losing any amount of sleep, whether it’s total loss, shorter sleep or waking up at night, decreased positive feelings like happiness and satisfaction, while increasing anxiety symptoms like a fast heartbeat and excessive worrying. What made the results particularly striking was the threshold. Even losing one or two hours of sleep on a single night was enough to measurably impair emotional functioning.

The snowball effect

Unlike many leadership roles, where a misstep can be quietly corrected, a compliance oversight can trigger regulatory investigation, financial penalties or reputational ruin for an individual and the organization. That reality breeds a particular species of fear: not merely the fear of making a mistake but the fear that a single lapse in attention will cascade into catastrophic failure.

Research tells us that fear of failure typically threatens one or more of three domains: identity, sense of belonging or safety. Compliance professionals routinely face all three. A missed regulatory change can raise doubts about their competence. Sidelining compliance in a restructuring doesn’t just hurt the function, it threatens everyone in it, professionally and financially, especially given how real personal liability is in this line of work.

Fear activates the amygdala, the brain’s rapid-response alarm, which bypasses the rational prefrontal cortex and floods the body with stress hormones, resulting in quickened heart rate, tightened breathing and a racing mind, replaying scenarios, scanning for threats and rehearsing worst-case outcomes. And when that racing mind meets a pillow at the end of the day, sleep becomes elusive.

Compliance

Half of Compliance Officers Have Anxiety; Their Org Chart Might Be the Culprit

by Jennifer L. Gaskin

February 26, 2025

Between whiplash-inducing policy shifts in Trump's second term and ever-present personal liability concerns, compliance officers already face unprecedented pressure. Editorial director Jennifer L. Gaskin examines CCI’s striking new survey findings that reveal an equally triggering stressor hiding in plain sight:

Read moreDetails

The result is a snowball effect. Detail-oriented stress and organizational pressure feed a fear of failure. That fear disrupts sleep. Disrupted sleep degrades the very cognitive functions, attention, memory, decision-making and emotional regulation that compliance work demands. And diminished cognitive performance generates more errors, more anxiety and more fear, which further disrupts sleep. Each revolution of the cycle adds another layer, and the snowball picks up speed.

Reviews of sleep deprivation and cognitive performance in working professionals confirms the pattern: Insufficient sleep impairs executive function, attention and working memory, precisely the faculties compliance officers depend on to parse dense regulatory text, identify anomalies in transaction data and exercise sound judgment under ambiguity.

Breaking the cycle

Awareness is the first intervention. Many compliance professionals have normalized poor sleep and chronic anxiety as occupational inevitabilities rather than recognizing them as signals that the cycle has taken hold. By naming the pattern and understanding that the fear causing sleeplessness is being amplified by the lack of sleep, individuals can begin to loosen its grip.

From there, practical steps matter. Setting firm boundaries around after-hours regulatory monitoring, building intentional decompression routines before bed and engaging in structured self-reflection to separate genuine risk from catastrophic thinking can each serve as a small branch placed in front of the snowball. Organizations, too, have a role: ensuring compliance teams have adequate staffing, technology budgets and direct access to senior leadership reduces the structural stressors that set the cycle in motion.

Recognizing the hidden link between sleep deprivation and fear of failure is not a sign of weakness; it is an act of the same vigilance compliance professionals bring to every other risk they manage. This time, the risk just happens to be their well-being.

The post The Hidden Link Between Sleep Deprivation & Fear of Failure at Work appeared first on Corporate Compliance Insights.

The FTC is cracking down on “Made in USA” claims, but risk is not equal across all claims and all products. A series of July letters may reveal a hidden triage framework for who gets a warning and who gets a penalty, write Reed Smith attorneys John Feldman and Julia Solomon Ensor, the former leader of the commission’s Made in USA program.

If your company makes “Made in USA” (MUSA) or similar domestic-origin claims on labels, websites, social media or anywhere else in advertising, your risk profile has been steadily increasing. In March, the White House issued an executive order directing the Federal Trade Commission (FTC) to crack down on misleading origin claims, and enforcement has been accelerating since. But a recent agency signal may reveal something useful for compliance practitioners. In July, the FTC issued seven warning letters that appear to present a framework for assessing where your company falls on the FTC’s MUSA priority spectrum.

The message is clear: this is not a single enforcement sweep. It is a sustained campaign with escalating intensity in direct response to the White House’s orders.

Understanding the emerging framework and building your internal program around it could make the difference between receiving a warning letter or a law enforcement action and never hearing from the agency at all.

What the warning letters reveal about FTC priorities

The knee-jerk response may be that all MUSA claims are too high-risk in this environment. After all, the FTC’s Made in USA labeling rule gives the agency authority to seek civil penalties of up to more than $53,000 per violation per day from companies that make MUSA claims on labels for products that are not “all or virtually all” MUSA. And “all or virtually all” is a difficult — if not impossible — standard to meet in today’s global economy. But if you genuinely perform significant manufacturing functions in the US, eliminating all US-origin claims deprives consumers of important information and deprives your company of a valuable marketing opportunity. Instead, a more nuanced approach is needed, with careful attention to what the July letters reveal about risk and priorities.

The July letters went to a wide range of companies, including those selling e-cigarettes, coordinate measuring machines, industrial laser machinery and musical instruments. And the challenged claims spanned a wide range too, from “Made in USA” and “Built in the USA” to “handmade in Austin, Texas” and hashtags like “#madeinUSA” and “#madeincali.”

But the companies that received the letters had one important thing in common: They received warning letters, not immediate enforcement action. Why? The answer reveals how the FTC triages its targets and how you should triage your own risk.

Bucket 1: Jurisdictional complexity

Three of the seven companies sell vaping and e-cigarette products. The Food and Drug Administration (FDA) has federal jurisdiction over the labeling of electronic nicotine delivery systems through its Center for Tobacco Products, which regulates their manufacture, packaging and labeling. While the FTC has jurisdiction over advertising and marketing of these products, labels are generally the FDA’s domain, and the FTC’s MUSA labeling rule, the agency’s primary tool for getting monetary relief in connection with allegations of deceptive MUSA claims, specifically does not apply where another agency has authority over a product’s labeling. Indeed, the Federal Register notice announcing the final rule specifically acknowledged that “USDA and FDA have primary jurisdiction over labeling issues for the food products within their purview.” Enforcement against an FDA-regulated product’s labeling would invite a jurisdictional defense. And thus, sending a warning letter and being done is significantly less messy than trying for a penalty case.

If your product’s labeling is regulated by an agency other than the FTC, including FDA, US Department of Agriculture, Alcohol and Tobacco Tax and Trade Bureau or others, your enforcement risk from the MUSA labeling rule is lower. That does not mean the FTC cannot challenge your claims in advertising if they are misleading; the FTC retains authority over your advertising under Section 5, and a jurisdictional gray zone is not a compliance strategy, but it does mean the risk of a civil penalty or redress is lower.

Bucket 2: Claims outside the rule’s reach

The other four companies had claims appearing on websites, social media, brochures and trade-show materials rather than on product labels. This distinction is critical. The MUSA labeling rule was authorized by a law which specifically addresses labels on products. The commission’s authorization to apply the rule to non-label claims is tenuous to say the least. 

Non-label claims are not free from risk. The FTC can and will challenge deceptive origin claims in advertising under its general authority to pursue unfair or deceptive acts and practices under Section 5 of the FTC Act. But, as with claims subject to other agencies’ jurisdictions, the financial exposure is materially different. A rule violation on a label can mean six-figure civil penalties. A Section 5 advertising case is more likely to result in an injunction and corrective action without the same monetary sting.

Bucket 3: Qualified claims

Notably absent from either the warning letters or recent enforcement actions are allegations that companies have made deceptive “qualified” MUSA claims, like “Made in USA of Imported Components” or “Assembled in USA.” This is an important point related to the categories discussed above. Like claims subject to other regulatory regimes or non-label statements, qualified MUSA claims fall outside the coverage of the MUSA labeling rule. And, as long as they do not reference US-origin parts, the standard marketers need to meet to substantiate them is materially lower. Marketers that substantially transform their products in the USA, without further post-transformation processing overseas, can likely make the claim without risk.

If you are confident your manufacturing process constitutes a substantial transformation in the US under US Customs and Border Protection laws, but you are not quite sure whether non-US content in the product is truly de minimis, a qualified claim is a low-risk option. Consider whether the marketing benefit of the unqualified claim truly outweighs the risk associated with it.

Risk

Managing Tariff Risk Through the Rest of 2026

by Charles Clevenger

August 11, 2026

The environment is likely to change even more with exclusions, negotiations, enforcement guidance, litigation and country-specific actions

Read moreDetails

Building your compliance program

Understanding the FTC’s enforcement logic is only useful if it informs your internal processes. Here is what a defensible MUSA compliance program should include:

A comprehensive claim inventory 

Identify every US-origin claim your company makes, across all channels:

• Product labels and packaging.
• Website copy, including product pages and “About Us” sections.
• Social media posts, captions, bios and hashtags (yes, “#madeinUSA” counts).
• Brochures, trade-show materials and sales collateral.
• Third-party marketplace listings (Amazon, etc.).
• Advertising.

Do not limit your inventory to the specific language, “Made in USA.” The FTC’s July letters flagged a range of claims, including “Precision Built in the USA,” “created by American workers, engineers, and innovators,” city- and state-origin claims like “handmade in Austin, Texas” and “Made in [state]” claims. The agency has made clear it will analyze these under the same “all or virtually all” standard it applies to traditional “Made in USA” claims.

Build and maintain substantiation files

For every origin claim you identify, you need a substantiation file documenting:

• Where final assembly or processing occurs.
• Where all significant processing occurs.
• The sourcing origin of all ingredients or components with particular attention to whether foreign content is more than de minimis.

This is not a one-time exercise. Supply chains shift. Substantiation must be current. If your file is more than 12 months old, or if you have had any supplier changes, it is time to re-substantiate or remove the claim.

Map your regulatory landscape

Determine which agencies have jurisdiction over your product’s labeling. Understand which rules each agency enforces regarding origin claims and where overlapping jurisdiction may create either additional exposure or potential defenses.

Differentiate risk by claim placement

Based on the FTC’s revealed enforcement priorities, assess your risk profile:

This does not mean it is OK to ignore non-label claims. The FTC’s warning letters demonstrate it is watching all channels. But it does provide important information on where to allocate compliance resources first.

Establish a review cadence

MUSA compliance is not a point-in-time exercise. Build recurring processes:

• Quarterly: Review social media accounts and advertising copy for new or changed origin claims.
• Annually: Full claim inventory refresh and substantiation file review.
• Trigger-based: Any supplier change, product reformulation or new product launch should trigger immediate review.
• Marketing review gate: No origin claim goes live without compliance sign-off, including social media posts and hashtags.

Looking ahead

“Made in USA” claims remain in the FTC’s crosshairs as it follows through on a central component of the Trump Administration’s domestic manufacturing agenda. Expect more action on the horizon.

In the meantime, the compliance practitioner’s job is straightforward, even if the execution is not: know who regulates you, know what claims you are making, confirm the claims are true and substantiated and build the internal processes to keep it that way. The companies that do this work now are the ones that will never see a warning letter (or worse) in their inbox.

The post Born in the USA? The FTC Wants Your Substantiation File appeared first on Corporate Compliance Insights.

With the SEC on the edge of changing reporting periods for listed companies from quarterly to semiannually, businesses must consider priorities in their calculations for making the adjustment, according to experts CCI asked about the change. Where does automation in reporting and lawsuit concerns fit into this equation, and what does the proposal signal about the SEC?

To date, the SEC has received hundreds of thousands of public comments on its May proposal to permit listed companies to report earnings semiannually rather than quarterly. According to a tracker created by Ohio State business professor Tzachi Zach, less than 1% of commenters support the proposal. Despite this, reporting by the Wall Street Journal suggests the commission is likely to move forward with some version of the rule. A final rule has yet to be issued, and as of this writing on Aug. 10, the public comment form was still active.

Among the small number of letters supporting the proposal, a reduction in the compliance burden was the most common rationale, Zach’s analysis found, being cited in 3% of all submissions. On the flip side, those opposed to the proposal were likely to cite investor protection and transparency (39%) and the risk for fraud or insider trading (27%). 

Assuming quarterly reporting does become optional rather than mandatory for public companies, whether they switch to semiannual reporting is a question that will come down, as most things do, to each company’s unique circumstances.

“The most important action item is talking to your investors, analysts and bankers before making any recommendations to the board,” Edward “Eddie” Best, co-chair of the capital markets practice at law firm Willkie Farr, said in a written Q&A with CCI. “Any decision by the board must be well-informed.”

Given the nature of being a company that sells stock to investors, that group should be top of mind, wrote Payton McCoy, CEO and co-founder of Greenshoe, an SEC reporting startup:  “Companies should ask themselves a simple question: ‘Will reporting less frequently increase or decrease investor confidence?’ If the answer is decrease, any compliance savings could easily be outweighed by a higher cost of capital.”

CCI: Assuming the rule is adopted as written, though the Wall Street Journal also reported people familiar with the matter said it’s possible the rule could change based on that negative feedback, what are the biggest action items for decision-makers inside public companies? How should they go about deciding whether this is a good move for them? What factors should they consider?

Eddie Best: The most important action item is talking to your investors, analysts and bankers before making any recommendations to the board. Any decision by the board must be well-informed. Next, confirm that your debt covenants and debt agreements give you flexibility on timing. Then, check your listing exchange’s rules. Nasdaq rules currently require distribution of quarterly financial information to shareholders, so even if the SEC finalizes the rule as written, Nasdaq-listed companies may still be on the hook for quarterly financial information to shareholders. After that, loop in the audit committee and outside auditors because this touches internal controls, SOX certification cadence and audit timing. Next, determine actual cost/benefit and model the cost of providing some interim data via 8-K. Once management has all of this information, it is in a position to give the board relevant information and its recommendation. In terms of whether semiannual reporting makes sense for a company, companies will need to look at the true cost/benefit analysis and that’s not just the amount saved by only reporting twice a year. Companies will need to assess their investor base. Index funds and buy-and-hold retail investors may be relatively indifferent, whereas active managers, quant funds and sell-side analysts who rely on quarterly data for models and comparables are likely to push back and could apply a valuation discount to less-transparent issuers. You also need to look at what your peers are signaling. Companies don’t want to be outliers, as their results can be harder to benchmark, which analysts and investors may penalize with a “transparency discount” regardless of actual performance. Boards will need to look at their control environment. A company with strong internal audit and real-time monitoring bears the risk of problems going undetected differently than one that relies on the quarterly close process itself as a forcing function. Companies also need to assess how semiannual reporting would impact their capital raising. Companies that raise debt or especially equity capital more frequently may be well-advised to continue quarterly reporting.

Payton McCoy: The decision should be driven by how investors value transparency in your industry. I don’t think we’ll end up with one market standard; I think we’ll end up with industry-specific standards. Some companies may find semiannual reporting makes perfect sense, while others may conclude that communicating more frequently is a competitive advantage. Ultimately, the SEC sets the minimum disclosure standard, but the market will determine the optimal one. Companies should ask themselves a simple question: “Will reporting less frequently increase or decrease investor confidence?” If the answer is ‘Decrease,’ any compliance savings could easily be outweighed by a higher cost of capital. Companies used to compete on products and services. Increasingly, they’ll compete on transparency.

CCI: This rule is part of a stated administration goal to “Make IPOs great again.” In your view, would this rule help achieve that goal, and is that a goal worth achieving? Does going public or staying public necessarily make a company more fiscally sound or successful?

EB: I really don’t think that quarterly vs. semiannual reporting will make a difference to a company’s decision to stay private or go public. The reporting burden is a real but secondary factor in the IPO decision. More important is the need and availability of capital liquidity for existing shareholders, incentivizing employees and having acquisition currency. Whether having more or fewer public companies is debatable, as is whether being public makes a company more fiscally sound or successful. There are numerous examples of public companies going bankrupt or having fiscal scandals, as well as private companies thriving and growing. Going public is a financing and liquidity decision, not a mark of quality. The “success” comes from the business itself, not the listing status. In my view, the regulatory and litigation burden of being a public company should not be impediments to going or staying public.

PM: It’s a goal worth pursuing because strong public markets are one of society’s greatest wealth-creation engines because they allow everyday investors to participate in the growth of great companies. This rule may help reduce some of the friction of being public, but it won’t determine whether a company succeeds. Going public doesn’t make a company better, and staying private doesn’t make it worse. What matters is that companies have the right access to capital while maintaining investor confidence.

CCI: A record number of comments were received and they have been overwhelmingly opposed to the proposal. The SEC is pressing forward anyway, at least according to reporting. What does that tell us about how companies should think about the rulemaking process more broadly, and does it change how they should approach commenting on future rules?

EB: The honest answer is more nuanced than “comments don’t matter” or “comments determine outcomes.” The comment process is not intended to make agency decisions up for the public to vote on. A reviewing court doesn’t look at whether more people support or oppose a rule; it’s whether the agency’s decision was “arbitrary and capricious.” In practice, a court will look at whether the agency considered dealing with significant comments rather than just ignoring them. In my experience, comments rarely reverse an agency’s direction once political leadership has committed to a policy; what they more often do is shape the details.

PM: I don’t think companies should conclude that commenting doesn’t matter. Rulemaking is an iterative process, and thoughtful participation remains important. What I do think it demonstrates is that companies should prepare for multiple regulatory outcomes rather than assuming any proposal will or won’t be adopted. 

CCI: The SEC’s position is that Form 8-K and Regulation FD are robust enough to fill the space between semiannual reports. Do you agree, and are there categories of information that routinely appear in quarterly filings that simply wouldn’t make it out to investors on the same timeline under a semiannual schedule?

EB: The SEC’s framing overstates how much 8-K and Reg FD actually substitute for periodic reporting. Form 8-K is event-triggered and involves mostly material non-recurring events. It does not require disclosure of gradual, non-event-driven developments. There is a lot of important information that is typically disclosed in a Form 10-Q that is not covered by Form 8-K requirements. Especially important are financial results and MD&A trend analysis. Regulation FD is a nondiscrimination rule. It only applies when a company chooses to disclose material nonpublic information and doesn’t obligate the company to disclose anything in the first place. A company that simply says nothing to anyone violates no Reg FD provision, no matter how stale the market’s information about it becomes. 

PM: 8-Ks and Regulation FD can fill part of the gap, but the bigger point is that investors no longer rely on a single filing for information. Earnings calls, investor presentations, press releases, industry data, social media, peer disclosures, litigation and regulatory developments all shape the market’s understanding of a company in real-time. That makes semiannual reporting more workable than it may have been decades ago, but it also makes the monitoring problem much harder. The relevant information may be spread across a dozen different sources instead of consolidated in one 10-Q.

Opinion

Making It Easier to Go Public Isn’t the Same as Making It Easier to Be Public

by Kyle Jeziorski

July 17, 2026

Investors won’t ignore a company’s lack of quarterly reporting and the controls that come along with it

Read moreDetails

CCI: The cost-savings argument for semiannual reporting tends to focus on eliminating cycles of auditor reviews, SOX certifications and disclosure committee sign-offs. But financial data collection and reporting have become increasingly automated. How much of the quarterly compliance burden is genuinely reducible through technology, and does that change how companies should think about the cost-savings case for switching?

EB: Automation has certainly reduced the mechanical burden of reporting, but the parts of quarterly reporting that remain expensive are exactly the parts technology hasn’t replaced. This includes auditor review procedures, disclosure committee sign-off and legal review and capital-markets-adjacent work like comfort letters. The SEC itself estimates that the approximate net reduction in direct compliance costs would be only $198,000 per fiscal year for each issuer that switches to semiannual reporting. While “every penny counts,” this amount really won’t move the needle for most public companies.

PM: A meaningful share of the quarterly burden is reducible through technology, particularly data collection, reconciliation, drafting, benchmarking and review. That means the cost savings from switching to semiannual reporting may be smaller over time as quarterly reporting itself becomes cheaper and more automated. Companies should therefore treat cost as one factor (not the deciding factor) and weigh it against investor expectations, transparency, litigation risk and potential effects on their cost of capital.

CCI: Some practitioners have flagged that switching to semiannual reporting could actually increase litigation risk — that a longer gap between formal disclosures gives bad news more time to accumulate before it reaches investors, and that plaintiffs’ lawyers will take note. How real is that concern?

EB: This is a legitimate concern, especially for companies that do not continue to issue quarterly earnings information. Bigger disclosure gaps concentrate more information into single events, which mechanically produces bigger price moves on bad news, and bigger price moves are the raw material plaintiffs’ securities class actions are built on. In addition, any delayed disclosure of adverse material information could expand the class of shareholder plaintiffs who could sue in the event of a significant stock price reaction to a disclosure. Finally, there is a concern that less-frequent disclosure provides a longer runway for something to go wrong before anyone outside the company is required to look.

PM: It’s a legitimate consideration, but it depends on how companies respond. If a company interprets semiannual reporting as permission to think about disclosure only twice a year, I think risk increases. If instead companies adopt more continuous monitoring internally while simply changing the cadence of formal reports, the risk may be much more manageable. In other words, filing less frequently shouldn’t mean paying attention less frequently.

CCI: For a company that decides semiannual reporting makes sense, what does the actual transition look like internally? What are the sequencing issues — financing agreements, investor communications, trading window policies — that need to be resolved before flipping the switch?

EB: I think it’s a multi-step process. First is diligence, including talking to investors, analysts and bankers, and then checking listing rules and material agreements. A company also needs to do a careful cost/benefit analysis. Second, a company needs to decide what information, if any, it would continue to report on a quarterly basis. Third, with all of this information and analysis, a company’s management needs to make a thoughtful recommendation to the board. Fourth, a company needs to adapt its internal policies and procedures to the new reporting cadence. Finally, a company needs to communicate its decision and rationale to the market in a clear and thoughtful manner.

PM: It’s much broader than changing a reporting calendar. Companies would need to evaluate debt covenants, investor expectations, analyst communications, internal controls, disclosure committee processes, board reporting, earnings practices and numerous governance policies. I suspect many companies would spend as much time preparing for the transition as deciding whether to make it in the first place.

CCI: This rule is one of several disclosure-related changes the current SEC has pursued or signaled. Taken together, are these changes moving in a coherent direction, or does the cumulative effect on investor transparency concern you?

EB: There is a coherent, even explicit, program. Chairman Paul Atkins has stated the organizing principle directly: to restore the “foundation” of the SEC’s original mandate on requiring the disclosure of “material” information, with “materiality as the North Star” and disclosure imposed “only when the expected benefits justify the likely costs and burdens.” The SEC’s 2026 rulemaking agenda reflects a broadly deregulatory orientation aimed at cutting compliance burdens, facilitating capital formation, revitalizing public markets, widening retail access to private markets and building a crypto framework. I am not concerned about the general direction the SEC is taking. I personally agree with Chairman Atkins that the SEC has drifted from its statutory mandate. Many of its recent rules did less to protect investors than to advance political interests. On the enforcement side, the SEC seemed to focus less on protecting small investors and more on headline-grabbing settlement amounts for technical violations, such as the over $2 billion of settlements the SEC got for banks using text messaging where there was no allegation that a single investor was harmed. So, from that standpoint, I support the SEC’s agenda. Of course, the devil is in the details, and there are or will be some initiatives that I think may, in fact, lessen investor protections. Depending on the final rules, semiannual reporting may be one of those.

PM: The broader direction is toward giving companies greater flexibility in how they communicate with investors. The important question is whether flexibility ultimately produces better information for the market. My view is that markets tend to reward transparency. The SEC can establish minimum requirements, but investors will ultimately determine what level of disclosure earns confidence and commands a premium.

The post Q&A: SEC’s Proposed Quarterly Reporting Rule — Compliance Costs vs. Investor Protection appeared first on Corporate Compliance Insights.

Compliance technology provider and consultancy Red Oak and communications platform MirrorWeb, both Mainsail Partners portfolio companies, have consolidated under the Red Oak name, according to a news release. Details of the transaction, which was effective July 26, were not disclosed.

Romir Bosu, most recently executive chairman at MirrorWeb, is now the CEO of the combined company, while Dave Dutch, Red Oak’s former CEO, will serve as an adviser to the new Red Oak, the news release said. Other MirrorWeb executives, including CISO Philip Clegg, COO Harriet Christie and President Joshua Yulish, will remain, a company representative told CCI.

MirrorWeb will continue to operate under its name for an unspecified interim period, after which it will transition to the Red Oak name, the representative said. Red Oak will remain based in Austin, Texas, the representative told CCI, and it will provide content compliance, distribution and communications supervision in a single system for regulated financial services firms. 

MirrorWeb and Red Oak have been “critical partners,” Dutch said in the release, in delivering on the vision that compliance done right is a growth engine and enabling end-to-end governance of the communication lifecycle for an increasingly shared client base. 

“I’m proud of what we’ve done for clients together already and excited to see the combination of our platforms as the natural next step and growth driver for our clients,” he said in the release.

The post Red Oak, MirrorWeb Combine appeared first on Corporate Compliance Insights.

Healthcare providers, administrators and investors must scrutinize their financial arrangements to understand if their compensation structure fits into a safe harbor from anti-kickback statute prosecution, attorneys June S. Santiago and Kaleb Rasmussen of Spencer Fane write. An April reminder by federal healthcare officials made this clear.

Physician groups, hospital administrators and healthcare investors all navigate the complexities of healthcare fraud and abuse statutes, including compliance with the anti-kickback statute (AKS). 

The AKS is a criminal statute that makes it a crime to knowingly and willfully offer, pay, solicit or receive any form of remuneration (cash, gifts, rent, fees, etc.) to induce patient referrals for services paid by federal healthcare programs like Medicare or Medicaid. Individuals who violate the statute (as recipients or payers of such remuneration) risk prison time and significant financial penalties. 

While application of the AKS is broad, a specific intent to violate the statute is required. In addition, the AKS offers numerous provisions that provide protection from prosecution for arrangements that meet the rigorous safe harbor requirements. Safe harbor compliance is completely voluntary, and the failure to satisfy a safe harbor does not mean that an arrangement is illegal.

However, because all of the requirements of a safe harbor must be met in order for an arrangement to be protected, many arrangements fall outside the safe harbors. These unprotected arrangements often rely on ensuring compensation at fair-market value (FMV) to show that the requisite intent is not present. Just pay the other side at market rate for the goods or services, the thinking goes, and you cannot also have the requisite intent to receive remuneration for referrals because the remuneration is FMV for the goods or services provided — there is no overage to allocate as remuneration for referrals. 

Not so. 

In April, the US Department of Health and Human Services Office of Inspector General (OIG) published an update to an FAQ reiterating past guidance and further clarifying that an arrangement may violate the AKS even if it is FMV. The OIG occasionally updates FAQ pages with relevant and applicable subregulatory guidance on how to apply the more nuanced laws and regulations based on current market trends and the OIG’s evolving enforcement focus. 

Specifically, in the recent update the OIG states: “… Some health care industry stakeholders have taken the position that, so long as the remuneration offered, paid, solicited, or received in an arrangement is consistent with fair market value, there is no unlawful remuneration under the Federal anti-kickback statute, and consequently, there can be no liability under the Federal anti-kickback statute . . . OIG’s guidance has been consistent and unwavering that fair market value is not a dispositive defense under the Federal anti-kickback statute.”

The recent guidance emphasizes that complying with the AKS means more than ensuring the compensation arrangements are FMV, and this position is supported by the fact that the AKS does not use the term “fair market value” even once. Rather, FMV is a foundational condition that each stream of remuneration must meet to be compliant with the applicable safe harbor requirements. The OIG is reiterating its view that while all payments related to referrals paid for by federal healthcare funds should always be FMV, the OIG looks at many more factors when considering if an arrangement is violative and the market should recalibrate its reliance on FMV accordingly.

Compliance

The Feds Are Telling You How to Mitigate FCA Liability; Have You Paid Attention?

by Veronica Nannis

June 16, 2026

Both DOJ and OIG have issued compliance guidance in recent years

Read moreDetails

Anticipated Impact

Expect to see the commercial reasonableness and bona fide business purpose tests play a much larger role in the OIG’s facts and circumstances analysis of arrangements that fall outside safe harbor protections. Commercial reasonableness asks why a payment is happening. Does the arrangement make sense independent of any referrals? An arrangement is commercially reasonable if it is sensible for well-informed parties to enter into it even if they are not in a position to generate business for one another. The bona fide business purpose test looks at whether the services are necessary, real and actually provided. These tests require a much more detailed analysis than the FMV analysis, which only looks at how much is being paid and whether the amount is consistent with the market. 

Accordingly, an arrangement that is compensated at FMV but is not commercially reasonable or fulfilling a bona fide business purpose will likely be found to violate the AKS. For example, leasing more space than is commercially reasonable at FMV; paying multiple medical directors FMV compensation when only one medical director is needed; and paying a referring physician at FMV for 50 hours of consulting when five hours is needed to meet the business need. These are all arrangements with FMV compensation that would fail one or both of the commercially reasonable and bona fide business purpose tests and likely violate the AKS. 

In addition to more applications of the commercial reasonableness and bona fide business purpose tests, we expect to see greater reliance on the one purpose rule. The one purpose rule states that “[i]f one purpose of the payment is to induce referrals, the entire arrangement is illegal.” In application this means that where an arrangement is at FMV, is commercially reasonable and for a bona fide business purpose, if one underlying purpose of the arrangement is to induce referrals, the entire arrangement, regardless of multiple legitimate business purposes, is illegal. Accordingly, if the OIG can show that any part of the motivation for the arrangement was to secure referrals — such as an email stating that the arrangement may improve referrals — FMV, commercially reasonable, and a bona fide business purpose will not prevent a conviction.

Finally, we expect greater scrutiny of percentage-based fees that fluctuate based on the volume or value of referrals. As the OIG focuses on intent, percentage-based fee models may more frequently be viewed as circumstantial evidence of an intent to influence referrals and thereby increase the share in referral profits.

This was adapted with permission.

The post Safe Harbor Compliance Means More Than Fair Pricing in Healthcare appeared first on Corporate Compliance Insights.

Charles Clevenger of UHY explains why country-level summaries no longer capture a company’s true tariff exposure — multiple duties can apply to one shipment and a rate that vanishes may be replaced by another — and lays out a disciplined approach to determining what applies now, planning for what could change and confirming how tariffs interact before repricing or reshuffling suppliers.

Halfway through 2026, another layer of complexity has been added to the tariff landscape. The expiration of the temporary 10% Section 122 import surcharge on July 24 removed one broadly applied cost from many imports. But on that date, Section 301 tariffs took effect across 60 major US trading partners, generally at rates of 10% or 12.5%. Separate trade actions have added a 25% tariff to certain Brazilian imports, while specified Canadian goods are scheduled to face an additional 50% tariff under Section 338 beginning Aug. 19, just a few days out from this writing. Section 232 tariffs continue to apply to steel, aluminum, copper and covered derivative products.

Each action has its own legal authority, effective date, product scope, exclusions and rules governing how it interacts with other duties. A tariff that disappears may be replaced by another. A rate that appears to apply to an entire country may exclude certain products. Multiple duties may apply to the same entry, while anti-stacking provisions may prevent certain combinations.

Businesses navigating the rest of the year need a disciplined process for determining what applies today, anticipating what could change and remaining flexible if duties are later modified or invalidated.

Understand the tariff exposure at the product level

Country-level tariff summaries can help executives understand the direction of trade policy but will not always capture total exposure.

The duty owed on a shipment may depend on its harmonized tariff schedule classification, country of origin, component materials, entry date and eligibility for an exclusion. The analysis may also need to consider ordinary customs duties, Section 232 or Section 301 tariffs, antidumping or countervailing duties and other trade measures.

The new Section 301 action involving 60 trading partners demonstrates the importance of product-level analysis. The action generally applies additional tariffs of 10% or 12.5%, subject to product exemptions and special calculations for certain trading partners. Products subject to Section 232 tariffs are excluded from the new action.

Brazil adds another layer. Certain Brazilian goods may be affected by both the separate 25% Section 301 action and the broader forced-labor-related Section 301 tariffs. Depending on the product and applicable exemptions, the additional Section 301 burden can reach 37.5% before considering ordinary duties or other charges.

Companies should determine which products are included in each tariff action and confirm that their country-of-origin treatment is accurate and well supported. That approach requires reviewing product classifications, sourcing and manufacturing details, applicable exclusions, the importer of record and relevant effective dates before estimating the financial impact.

Plan for durability without assuming permanence

The staying power of a tariff depends in part on the statute used to impose it; it remains to be seen how this will play out pending any litigation, but companies should assume these tariffs will be in place for an extended period.

Section 122 expressly limited the temporary surcharge to 150 days unless Congress extended it. Its July expiration was therefore built into the original action.

Other authorities operate differently. Section 301 tariffs can remain in place while the US seeks changes in another country’s trade practices. They may be modified through negotiations, product exclusions, administrative reviews or changes in policy. Section 232 measures can also remain in effect for extended periods because they are tied to national security findings rather than a fixed statutory expiration date.

The use of Section 338 against Canadian goods introduces an additional variable. That authority has been used infrequently, and the recently announced duties apply to broad lists of specified Canadian products, including some goods that qualify for preferential treatment under the United States-Mexico-Canada Agreement. Energy, potash, products subject to Section 232 and certain other goods are excluded.

For planning purposes, companies should treat tariffs currently in effect as part of their near-term cost structure while maintaining scenarios for modification, expansion or removal. Forecasts based on a single assumed rate may become outdated before a purchase order is fulfilled.

Scenario planning should include goods already ordered, products in transit and future purchases. It should also account for the possibility that things will change.

Featured

After SCOTUS Tariff Ruling, the Hard Work Begins

by Jennifer L. Gaskin

February 25, 2026

Read moreDetails

Follow the legal authority behind each action

Legality cannot be evaluated across the tariff environment as a whole. Each tariff program rests on a distinct statute, administrative record and procedural history.

Current actions under Sections 232, 301 and 338 may raise different legal questions. A decision affecting one authority does not automatically determine the validity of another.

Businesses should continue complying with tariffs being collected while monitoring litigation and administrative developments relevant to their entries. They should also preserve classification records, entry documents, customs communications and proof of payment. Those materials may become important if a court decision, exclusion or agency action creates a recovery opportunity.

Legal uncertainty should also be incorporated into accounting and forecasting. A potential legal challenge generally does not eliminate the immediate cash requirement when goods enter the country, and a possible future refund should not be treated as available operating cash.

Confirm tariffs stack before changing prices

One of the most consequential questions for the rest of the year is whether multiple tariffs apply to the same product.

Some trade actions are imposed in addition to existing duties. Others contain exclusions designed to prevent overlap. The expired Section 122 surcharge, for example, generally applied in addition to other duties but did not apply to portions of imports already subject to Section 232 tariffs. The new 60-economy Section 301 action also excludes articles and parts covered by Section 232.

These provisions can produce different results for products with similar descriptions or supply chains. A steel component may receive different treatment from the finished product containing it. Two products from the same supplier may fall under different tariff classifications and exclusion lists.

Companies should conduct a stacking analysis before changing customer prices, renegotiating supplier terms or shifting sourcing. Decisions made using an incomplete tariff rate can lock a business into unfavorable pricing or cause it to abandon a supplier that remains economically competitive after exclusions are considered.

Connect customs compliance with commercial decisions

Tariff management should involve procurement, finance, legal, tax, operations, compliance and sales. Each function controls information needed to assess the full impact.

Procurement knows which orders can be delayed, redirected or renegotiated. Customs professionals understand classification, origin and entry requirements. Finance should quantify margin and working-capital effects while legal evaluates contract language governing tariff increases, force majeure, price adjustments and refund ownership. Sales leaders need to understand which costs can be passed through to customers and which may need to be absorbed.

Contracts deserve particular attention. Businesses should determine who is responsible for duties under current shipping terms, whether pricing provisions permit tariff-related adjustments and who is entitled to a refund if duties previously passed through to a customer are later recovered.

This review is especially important for long-term agreements negotiated before the recent tariff actions and for open purchase orders involving goods that may enter after a new effective date.

Treat refunds as an active workstream

IEEPA refunds have created a meaningful recovery opportunity, but the process requires active oversight.

Importers should identify potentially eligible entries, reconcile duties paid to their customs and accounting records, confirm the importer of record and review the status of each entry. They should also ensure that their banking information is properly established in the automated commercial environment. CBP requires eligible automated commercial environment account users to enroll for electronic refunds through the portal and provides reporting tools for monitoring refund status.

Companies should also examine whether recovered amounts affect customers, suppliers or other parties under their contracts. A refund received by the importer of record may represent a financial recovery for the company, an amount owed to a customer or a combination of both.

The post Managing Tariff Risk Through the Rest of 2026 appeared first on Corporate Compliance Insights.

There is no single compliance model for handling minors’ data, but companies can take several steps now to mitigate the risks, attorneys Greg Szewczyk and Madison Etherington of Ballard Spahr explain. 

For years, many companies treated youth’s privacy on their apps as a narrow compliance question: Is the app directed to users under 13 years old, or does the company have actual knowledge a user is younger than 13?

The federal Children’s Online Privacy Protection Act (COPPA) remains a cornerstone for children’s privacy compliance, but state laws are rapidly joining and expanding the scope of efforts to regulate how businesses collect, use and share young people’s personal information online. App store accountability measures add yet another layer by introducing new evaluation and notice requirements governing methods by which companies receive age-related information. 

As a result, businesses are being forced to review the way they collect and process information of users.

COPPA applies to operators of websites and online services directed to youths under 13 as well as those that have actual knowledge that they collect personal information from someone under 13. Covered operators must provide notice and obtain verifiable parental consent before collecting, using or disclosing such data.

This baseline, however, is evolving. The FTC finalized COPPA Rule amendments in 2025 that, among other changes, require separate parental opt-in consent before certain disclosures of youths’ personal information to third parties for targeted advertising.

In general, businesses should continue to treat COPPA as a floor for compliance, generally disclosing that products or services are not directed at children and that information will not be collected from children without first obtaining verifiable parental consent. In the event a company becomes aware of the inadvertent collection of children’s information, it should be immediately remediated by deleting the information and ceasing all related processing.

However, while COPPA has been the baseline governing processing of children’s information for years, a growing number of state privacy laws are beginning to regulate data belonging to teenagers separately.

Teen data is becoming its own compliance category

Several states have begun to enact laws that require businesses to treat the data of individuals between 13 and 18 differently.

• New York’s Child Data Protection Act regulates personal data belonging to covered users under 18. For users 13-17 years old, certain processing must either be strictly necessary for specified activities or supported by informed consent. The law also limits some uses of personal data collected while a user was a minor after the user becomes an adult.
• Maryland’s Online Data Privacy Act prohibits targeted advertising and the sale of personal data involving consumers whom an organization knew or should have known were under 18.
• Arkansas’ Children and Teens’ Online Privacy Protection Act creates different obligations relating separately to children below 13 and teens ages 13-16 when a company has actual knowledge it collects their personal information.
• Colorado’s Privacy Act was recently amended to provide additional protections over the data of children under 18 when a controller has actual knowledge or willfully disregards information that establishes that a user is a minor, and the Department of Law has rulemaking authority. In the draft rules that have been published, the attorney general lists factors that should be considered when determining whether a controller has willfully disregarded whether a consumer is a minor. Those factors include if the user can provide their age, if the user can edit their age, if the user has a bio section of a profile, if there is indicia of age, such as grade level, and if the company categorizes them differently for marketing purposes. However, the draft rules expressly state that the list is not exhaustive, and the determination will be based on the totality of the circumstances.

Because of this breadth of legislation, companies face highly granular questions: When does it make sense — or become mandatory — to disable targeted advertising altogether? To limit third-party sharing? To restrict social features? In some situations, creating dedicated interfaces just for minors might offer the simplest path forward.

Along with the US, Canada’s approach is continuing to develop. In May 2026, the Office of the Privacy Commissioner of Canada released guidance advising organizations to assess whether age assurance is necessary, use methods proportionate to the risks involved and consider alternatives, such as limiting certain data practices or turning them off by default.

Canada’s Personal Information Protection and Electronic Documents Act requires meaningful consent before organizations collect, use or disclose any individual’s personal information. Canadian guidance says parental/guardian permission is needed below age 13, while older minors’ maturity level matters more than simple birthdate cutoff. Quebec goes further, barring collection directly from minors under 14 years old without parent or tutor permission unless the collection is clearly for the minor’s benefit.

Ultimately, companies should not assume that one national policy will satisfy every age threshold, consent standard or advertising restriction. All policies deserve careful review against each region’s definitions, age thresholds, consent requirements and restrictions on marketing, profiling and data transfers.

Compliance

A Field Guide to Privacy Law for Companies Entering the US Market

by Kevin Coy and Erin Doyle

July 20, 2026

Businesses wanting to operate in the US have a variety of laws and regulations to consider

Read moreDetails

App-store age signals are an emerging compliance issue

App-store accountability laws create another compliance layer. Rather than leaving every developer solely responsible for building a separate age gate, these laws allocate responsibilities among app stores, operating-system providers and app developers.

With multiple laws already passed — and several laws that have been proposed — we are likely to see a patchwork that adds to the confusion. Some of these laws will place the core age-verification and parental-consent obligations on app stores while requiring developers to provide age ratings and notifications. Others will be more developer-facing. And to make matters more complicated, legal challenges will impact the timing and scope of the laws.

For example, Texas S.B. 2420 took effect after the Fifth Circuit stayed a preliminary injunction blocking the law. The law requires covered app stores to verify users’ age categories, associate minor accounts with parent accounts and obtain parental consent in specified circumstances. App stores must also make age-category and consent information available to developers. Developers in turn must assign age ratings, respond to significant changes and use the information consistently with the law’s restrictions.

To make matters more complicated for app developers, app stores may have their own requirements.

Compliance requires more than a privacy-notice update

Companies should begin to mitigate risk in handling minors’ data by determining whether they are collecting any data within the scope of any of these laws, which may not be as simple as whether they are collecting just age data. Companies then need to assess the value of that data, what kinds of compliance obligations may need to be met and what kind of operational changes may need to be made. Vendor contracts, analytics tools and advertising technologies should also be reviewed to confirm that minors’ information is not transmitted in ways that conflict with the company’s policy or applicable law.

Ballard Spahr summer associate T’Phani Perley-Schiele contributed to this report.

The post What Companies Need to Know About the Evolving Youth Privacy Landscape appeared first on Corporate Compliance Insights.

A compliance leader’s advantage is rarely access to more words when investigating possible wrongdoing; it is the ability to notice when the words become hard to say or grow vague and devoid of accountability, writes author and speaker Pamela Meyer. And be warned: That is often where the unexamined risk sits. 

Intake calls, investigative interviews and executive briefings produce lots of information that compliance leaders unknowingly miss. Most professionals are not trained to notice or track patterns in hesitation. Their notes might record what an employee alleged but not the moment “I saw” became distancing language, such as “People are concerned,” or the point at which a detailed account collapsed into, “And then there were some issues.”

Those changes matter. While they do not prove dishonesty or culpability, they can be signals that the conversation has entered difficult territory.

Compliance professionals are trained to separate fact from impression. That discipline is essential, but it can lead them to discard useful information. A shift in language, timing or participation can mark an inflection point where memory becomes strained or personal exposure increases.

Understanding story structure

We listen carefully to the content of someone’s story, but we rarely pay attention to the story’s structure. People rarely admit that they are afraid of naming a senior executive, implicating a colleague or exposing their own failure to act. But if you pay attention to how a story is told, the red flags will emerge.

Callers often begin with direct observation: “I saw him change the numbers.” A few minutes later, when asked who knew, they retreat into collective language: “People were uncomfortable.” Another employee describes an ordinary meeting in close detail, then reduces the crucial 20 minutes to “we discussed the situation.” A third minimizes the allegation before stating it: “This may be nothing, and I do not want to cause trouble, but … ”

Here are some red flags an interviewer should notice and dig deeper on:

Stories told in strict, rehearsed-sounding chronological order

Natural, honest stories tend to be told with the most emotional elements of the story being most prominent. “The conference went well … Oh, but the speaker fell off the stage at the end.” Or, “When we arrived, I saw him throw the documents in the trash in the lobby.” Stories that jump around tend to be honest. The executive who needs to avoid key facts will provide a too-clean chronology.

Main event pushed to the end of the story, no epilogue

Most compliance issues revolve around a particular event of concern. If the story is told with the main event pushed to the end without an emotional remark to close it, ask a few more questions. “I can’t believe I left the door unlocked. I feel terrible that it was stolen” would be a typical closing epilogue that includes emotion.

Inappropriate amount of detail 

Do you have a teenager? “I missed curfew because the bus broke, then I had to walk 5 blocks, look at the holes in my shoes from it.” We include unnecessary details to bolster our accounts in an attempt to seem credible, yet that backfires and undermines the story. Check for the right amount of detail throughout.

Distancing language

Notice where the account loses ownership or resolution. That point may indicate fear of retaliation, uncertainty about what was observed or embarrassment about one’s own role. “The invoice was approved,” “There may have been some issues,” “People started asking questions” all remove the actor. The meaningful moment comes when someone who typically names people stops doing so around one event.

Shift in behavioral baseline 

A useful baseline comes from the speaker’s ordinary communication pattern. Note their cadence, tone, laugh and posture. Some people pause often, qualify everything or speak in broad summaries. Those habits become informative only when they change around the discussion of a particular person, period, event or decision. If you don’t know the subject’s typical baseline, then ask a few questions at the beginning of the interview to get a reliable reference point for measuring changes later. “What are you doing this weekend?” or “How was lunch?” can put the subject at ease, letting you see how they usually communicate when they’re not under pressure.

Featured

Once You’ve Decided to Self-Disclose, Here’s How to Do It Right

by Sean M. Farrell and Thomas F. Rybarczyk

July 29, 2026

Read moreDetails

What to do when the story changes

Always start with open-ended questions. Ask, “Take me through what happened” not, “Where were you at 7 p.m.?” Let your subject talk and develop rapport before narrowing your focus.

Do not confront behavioral shifts. Anxiety can reflect fear, shame, divided loyalty or simple cognitive strain. Naming the hesitation or saying, “You seem nervous” only makes your subject self-conscious and shows where your concern lies. Note the change privately and keep asking neutral questions.

Freeze the moment where the account loses detail. Ask for the 60 seconds before and after the story becomes vague: Who spoke first? What words were used? What did the person do next? People often compress the part of an account that carries the greatest psychological cost.

Hold back the evidence. Get the complete account before introducing emails, calendar entries or access records. Then present one item at a time and ask the person to reconcile it with what they already said. Showing the evidence too early gives them the facts needed to repair the story.

Signs power is distorting the decision

Commercial concerns can influence how evidence is judged, so a few areas to watch here include:

• Consensus that appears before discussion. If a senior leader says, “I think we all agree this was poor judgment, not misconduct,” before others have spoken, request that each person state an independent view.
• The allegation is softened. When retaliation becomes a “performance issue” or falsification becomes a “process breakdown,” restate the original conduct without interpretation before the softer label becomes part of the lexicon.
• The discussion turns to calculating the cost of discipline. If lost clients, missed targets or succession problems become prominent elements of the conversation before the compliance analysis is complete, pause and restate what happened first.
• Rank changes the likely outcome. Replace the executive’s name with “regional manager” and ask what action the same facts would produce if the employee had less status and fewer protectors.

Also, the order of discussion matters. Establish the conduct and the standard before considering commercial consequences. Otherwise, business impact becomes an unofficial test of whether the rules apply. 

The leader who carefully tracks language patterns and follows up at the right time with a better question has a greater chance of identifying problems before their organization is forced to explain why it did not prevent a crisis.

The post Telling Moments Compliance Leaders May Overlook in Investigations appeared first on Corporate Compliance Insights.

Enterprise risk oversight anchored primarily in audit was once sufficient, but today, it is a blind spot, writes Adley John Fisher, risk management professional. Boards that continue relying predominantly on assurance-based visibility may remain formally compliant while becoming strategically blind to emerging enterprise exposure.

Over the past two decades, boards have formally expanded their responsibility for enterprise risk oversight. In practice, however, the governance structures through which most boards oversee risk remain deeply anchored in audit and financial reporting paradigms. While this design was historically appropriate, it has become increasingly misaligned with the sources of today’s most consequential corporate failures.

Audit-dominated risk oversight has transitioned from a historical standard to a modern governance liability. Current board-level risk architectures tend to systematically privilege financial assurance over proactive risk intelligence, can suppress weak operational and technical signals and leave boards exposed to failures that are foreseeable in retrospect but invisible in advance.

The structural legacy of audit-anchored risk oversight

Board-level risk oversight did not evolve by accident. Modern governance frameworks grew out of a period in which financial integrity, regulatory compliance and internal controls represented the dominant sources of corporate risk. In that context, anchoring risk oversight within audit committees was rational, efficient and widely considered the proper governance standard.

But risk has evolved. Today, the threats most likely to destabilize organizations increasingly originate outside traditional financial reporting domains. They arise across cyber, operations, supply chains, technology, culture and strategy. As complexity has increased, so has the strain on governance structures. 

As highlighted in the 2009 Walker Review, governance reforms after the financial crisis explicitly recognized the need to reduce overload on audit committees and introduced the concept of separate board risk committees to improve forward-looking risk oversight. Empirical evidence reinforces this structural pattern. As of 2026, nearly 80% of S&P 500 companies assign cybersecurity risk oversight to the audit committee with fewer than 10% assigning it to a dedicated risk committee.

This structural legacy creates a pull toward audit-centric thinking, and the methodology heavily favors risks that are easy to quantify, audit and map to existing internal controls but may under-emphasize emerging systemic threats that lack historical precedent or measurable assurance indicators. The limitation is not audit itself but its design, which is to assess whether controls work, not whether underlying assumptions about risk still hold.

At its core, this reveals a tension between retrospective assurance and proactive risk intelligence. Audit is necessarily backward-looking in its primary function, validating that controls function as intended. Risk oversight, by contrast, must be forward-looking, assess emerging exposure and anticipate how complex systems may fail under stress before control failures become visible.

When risk is governed primarily through an audit lens, boards may inadvertently receive lagging indicators presented as forward-looking assurance. This creates a dangerous paradox where strong assurance over existing controls grows exposure to risks those controls were never designed to address. Major failures like Wirecard and Carillion illustrate this pattern as partial contributing factors rather than sole causes. Boards were not short of data, but the data was filtered through an audit paradigm that prioritized compliance while obscuring deeper operational, cultural and technological fragilities. 

The filtering of weak signals

Today, the earliest indicators of significant failure rarely appear first in financial statements. More often than not, they emerge as weak operational or technical signals. It starts with a subtle deterioration in safety culture or recurring technology workarounds. It looks like near-miss incidents, data governance weaknesses, supply chain dependencies, talent capability gaps or abnormal operational behaviors. Individually, these issues appear manageable. Collectively, they are systemic.

In audit-dominated structures, these signals often require translation into financial, compliance or control-based language before escalation to the board. This translation process acts as a corporate filter.

The systemic blind spots caused by these filters are reflected in governance case studies like Boeing’s 737 MAX, where cultural, engineering and escalation failures prevented early warning signals from reaching the board effectively. Signals that are operationally significant but not yet financially measurable are often deprioritized, softened or absorbed within management reporting layers before reaching directors. As a result, boards may maintain strong visibility over control compliance while possessing limited visibility over the organization’s true exposure landscape.

Recent governance failures demonstrate that boards often struggle not because information was entirely absent but because the information reaching them had already been filtered through assurance-oriented reporting pathways. These pathways naturally prioritize control effectiveness, policy adherence and measurable compliance metrics over unresolved ambiguity, technical complexity or systemic vulnerability. Governance visibility becomes strongest where uncertainty is lowest, while the organization’s most consequential emerging risks frequently remain outside the board’s direct field of vision until failure hits.

Governance

Out of Your Technological Depth? It’s Your Duty to Say So.

by Vera Cherepanova

June 17, 2026

If a director can admit to not knowing enough to make a decision, it’s a sign the board has built and reinforced honesty

Read moreDetails

Structural misalignment at board level

Realistically, incremental enhancements to risk registers or reporting templates will not fix this. If the underlying oversight architecture remains unchanged, the structural misalignment stays. Instead, boards must fundamentally re-examine several foundational assumptions:

• Mandate: Is enterprise risk oversight concentrated within committees whose expertise and historical orientation remain primarily financial?
• Focus: Does board reporting primarily emphasise control effectiveness and assurance outcomes, or does it also provide visibility into emerging exposure, operational uncertainty and systemic fragility?
• Escalation pathways: Are non-financial risks elevated only after they become measurable in financial or compliance terms?
• Expertise: Does the board consistently engage sufficient operational, technological, cyber, safety or systems-level expertise when overseeing complex enterprise risks?
• Information architecture: Are directors receiving sufficiently unfiltered operational perspectives, or only management-curated assurance summaries designed around existing reporting structures?

Research increasingly supports a clearer separation between audit assurance and enterprise risk oversight functions, particularly within large or operationally complex organizations. Such separation is not intended to diminish audit’s importance but to recognize that assurance and strategic risk oversight are distinct governance disciplines requiring different orientations, information flows and expertise.

But let’s be realistic — simply splitting into two entities may backfire. One wrong step and we end up creating information silos, turf wars over who owns what and a mountain of duplicated paperwork that bombards management while critical risks slip right through the cracks between committees.

How to actually build a modern risk structure

To make this work in the real world, a board should consider three practical changes:

Separate the work, but connect the people

The audit committee needs to keep its eyes firmly on the rear-view mirror, focusing on financial integrity, accounting controls, overall operational controls and legal compliance. At the same time, a dedicated risk committee needs to look through the windshield, focusing entirely on forward-looking vulnerabilities and systemic operational threats.

To prevent an oil-and-water situation between committees, the board should mandate that the chair of each committee sits as a member of the other, the old “in my shoes” method. Even better, bring both committees together twice a year for joint sessions to look at the overlap, like how a massive cyber breach would impact financial liability or the hidden compliance risks of deploying new AI tools.

Create a direct line to the chief risk officer

We have to stop looking at risk through a filter. The chief risk officer needs a direct, independent reporting line straight to the risk committee that is completely separate from the CFO’s office and parallel to how internal audit talks to the audit committee.

To ensure this line carries real value rather than polished corporate speak, board reporting should include explicit sections for unresolved operational anomalies and emerging risk themes, enabling directors to observe early warning signals rather than only formalized risk summaries.

Put ‘systems-native’ directors in the room

A new committee structure loses its effectiveness if the people sitting at the table don’t change. The traditional board matrix, usually packed with retired CEOs, CFOs and corporate lawyers, needs an injection of different real-world experience. If a company operates in a complex environment, the board must recruit at least one operationally native director.

These are people who have spent their careers running cybersecurity operations, managing messy supply chains, leading engineering teams in high-stakes industries, traveling from one workplace to another and understanding a screw press like it’s the back of their hand. When management presents a risk report, these directors know how to push past the talking points and stress-test the actual assumptions.

Conclusion

The issue is not the value of audit but its structural dominance within modern risk governance architectures. Governance systems designed around financial integrity and control assurance are increasingly ill-equipped to oversee risks that emerge from operational complexity, technological interdependence, organizational culture and systemic fragility. 

Boards that recognize this structural gap and adapt by incorporating broader domain expertise, diversified reporting pathways and more direct exposure-focused intelligence, will likely be better positioned to fulfil their fiduciary responsibilities in substance rather than merely in form.

The post Audit‑Dominated Risk Oversight Leaves Boards Blind to Modern Risks appeared first on Corporate Compliance Insights.