Crypto was initially built on the promise of permissionless finance, a system with no gatekeepers, no intermediaries and no paperwork. However, as the adoption of digital assets has grown, that original vision has collided with the strict realities of the traditional financial system, writes crypto intelligence writer Finn Grant. With regulators cracking down globally, crypto compliance has evolved from an abstract concern into a central operational requirement for survival.

For more than 15 years, the regulatory stance towards digital assets was somewhat ambiguous, but the rules are finally firming up. The Financial Action Task Force (FATF) reported in a June 2025 update that travel rule frameworks are already adopted or in progress across 99 different jurisdictions. With approximately $51 billion in on-chain activity linked to illicit actors in 2024 alone, regulators are pushing aggressively for industry-wide compliance.

Today, businesses involved in crypto must navigate a complex web of obligations:

• KYC (Know Your Customer) and AML (anti-money laundering): Businesses must verify customer identities at onboarding and implement ongoing policies to detect and prevent money laundering.
• The travel rule: Virtual Asset Service Providers (VASPs) are required to collect, verify and share identifying information about transaction originators and beneficiaries when transferring crypto.
• Sanctions screening & transaction monitoring: Companies must continuously analyze customer behavior for financial crime and check wallet addresses against government-published lists of sanctioned individuals and entities.

The billion-dollar cost of noncompliance

The consequences of ignoring these regulations can destroy a business. Regulators have made it clear that they will aggressively pursue platforms operating with inadequate AML and KYC programs.

Enforcement actions in 2025 alone saw crypto exchanges bear $927.5M in AML/CFT penalties. Historical precedents are even steeper: Binance famously pleaded guilty in the US and paid over $4 billion to resolve its criminal liability, while BitMEX faced a $100 million enforcement action for failing to file suspicious activity reports (SARs) and institute proper AML programs. In Europe, more than 50 crypto firms had their licenses revoked under MiCA as of November 2025 for failing to meet compliance standards.

Why blockchain intelligence is the solution

To survive in this environment, companies require a functional, risk-based compliance program, and traditional finance tools simply do not work on-chain. The public nature of blockchain ledgers creates a unique advantage: every transaction is recorded permanently and is fully auditable.

This is where blockchain intelligence steps in to bridge the gap. By using advanced analytics platforms like Arkham, compliance teams can link raw cryptocurrency activity to real-world entities. Arkham deanonymizes blockchain transactions, transforming alphanumeric noise into actionable intelligence for compliance and investigative purposes.

A customer may pass initial KYC checks at onboarding but later receive funds from a compromised source. Pure KYC cannot catch this, but continuous transaction monitoring powered by blockchain intelligence can. By integrating the Arkham API into your internal systems, you gain access to Ultra, Arkham’s proprietary crypto address-matching engine. This allows enterprise compliance teams to customize data flows, monitor transactions in near real-time and screen incoming deposits against known illicit sources before funds are ever accepted.

As regional frameworks like MiCA reach full enforcement and institutional capital demands robust compliance counterparties, having the right tech stack is no longer optional.

The post How Blockchain Intelligence Became Essential To Corporate Compliance appeared first on Corporate Compliance Insights.

The compliance job interview hasn’t kept pace with the profession. Hiring managers still rely on questions that reveal little about whether a candidate can actually navigate gray areas, influence resistant stakeholders or build a defensible program under pressure. And candidates often walk in underprepared — or worse, unprepared to evaluate whether the organization deserves them.

This toolkit, developed with guest editor Mary Shirley, is built to fix both problems. Organized by experience level, it explains not just what hiring managers are asking today but what they’re actually trying to learn and how candidates can respond with substance rather than just performance.

It also includes something most interview guides leave out: a robust set of reverse-interview questions candidates can use to assess an organization’s genuine commitment to compliance. Here’s a look at what you’ll get:

• Interview questions and preparation guidance for junior (1-3 years), intermediate (4-11 years) and senior (12+ years) compliance professionals.
• Frank discussion of what hiring managers are actually evaluating and what candidates sometimes miss.
• Strategic questions for candidates to probe organizational culture, leadership tone and program maturity.
• A CCO-specific framework for assessing board access, reporting structures, resources and risk appetite.

Instant Download: Read it Now

Can’t see the download form? Disable your ad blocker.

The post The Compliance Job Interview 2026 appeared first on Corporate Compliance Insights.

Against a backdrop of job insecurity, general instability and fear of retaliation, increased anonymous reporting will continue, Gregory Keating of Littler predicts. That is unless corporate leaders and compliance professionals make meaningful strides in their programs. 

A trend has emerged that should cause tremors throughout the compliance community. Recent benchmarking and survey data indicate that anonymous reporting on whistleblower hotlines has increased or remained elevated in recent years, reversing an earlier trend toward named reporting. 

NAVEX Global, which canvassed more than 2 million reports across over 4,000 organizations, reported in its 2025 benchmark report that about 52% of reports in the US were made anonymously. In a 2026 report, Ethico found a 5% drop in the number of self-identified reporters from the previous year, the largest single-year reversal in its dataset.

Seasoned compliance professionals should recognize that this is a dangerous development. While the availability of anonymous reporting is a widespread and even required feature of reporting policies and procedures, a trend toward an increased incidence of anonymous rather than named reporting introduces challenges to an organization’s efforts to identify and remedy misconduct. Complaints by anonymous reporters are significantly more challenging to investigate and often suffer from significantly lower substantiation rates. The point is not to close the door to anonymous reporting but rather to create a workplace culture in which employees with concerns feel comfortable and even welcome to come forward, knowing they will be met with serious interest and steadfast protection from retaliation.

Those familiar with organizational risk understand that the efficacy of an organization’s compliance program can be seen in the overall level and quality of reporting. On one end of the spectrum is crickets — little to no reports or communications emanating from employees up to the organization. On the other end is a steady volume of reporting where individuals come forward in person. In the middle lies continued reporting from those in the organization but in a manner whereby the reporters are more inclined to choose anonymity.  

What reporting reveals about workplace culture

A healthy organization should experience a steady volume of compliance reports with reporters willing to identify themselves as they come forward. Professor Kyle Welch at George Washington University accessed and analyzed enormous amounts of data from hotline reporting channels. He concluded in 2020 that organizations with robust internal reporting have stronger cultures and better business outcomes, including higher profitability and return on assets, reduced litigation costs and fewer external reports to regulators.

By contrast, a culture of silence and rare reporting in the workplace is widely viewed as a leading indicator of compliance risk. A 2022 study published in MIT Sloan Management Review found that silence among workers and an unwillingness to report is directly tied to a feeling of being psychologically unsafe.

Until as recently as 2023, empirical data indicated a trend toward an increased willingness among employees to report suspected misconduct — likely the effect of increased focus on robust compliance programs and effective training. In a 2023 survey, ECI found that 72% of employees reported misconduct when they observed it. This reflected a then-record-high reporting rate.

But this upward trajectory has taken a sharp and troubling detour in the past three years. In what has been described as a trend toward “scared reporting,” an increasing number of employees have indicated that while they are generally inclined to report misconduct when they observe it, many of those same employees in fact chose not to do so when they witnessed it. Ethisphere’s 2024 ethical cultural report, based on 2 million responses from around the world, found that while 93% of employees said that they were inclined to report misconduct only 50% actually did so. 

What has caused this trend? Fear. Recent developments, including geopolitical uncertainty and the rapid rise of AI in the workplace and attendant concerns about job security, have increased anxiety and uncertainty in the workplace. A 2025 Pew Research Center survey of over 5,000 employees found that 52% are worried about the future of AI in the workplace and nearly a third believed AI will lead to fewer job opportunities for them in the future. In that environment, employees may be more likely to worry that raising concerns will mark them as difficult, disloyal or expendable.

Recent data reflects that fear of retaliation is a significant factor causing workers not to report. The most recent global surveys are all consistent in finding a noticeable increase in employees reporting that they fear retaliation should they speak up about workplace misconduct. According to the Equal Employment Opportunity Commission’s enforcement and litigation statistics, retaliation is the No. 1 employment law claim in the US, making up roughly 48% of all claims.

Ethics

Are Your Anonymous Reporting Channels Hiding a Bigger Problem?

by Vera Cherepanova

March 18, 2026

When a friend is the target of a report, resist the urge to disrupt established processes

Read moreDetails

What compliance professionals can do

The time is now for compliance professionals and the organizations they support to invest in concrete measures that will encourage a return to self-identified reporting and help avoid the potential spiral into a workplace culture of fear, silence and avoidance.

Four recommendations should be considered. 

First, research overwhelmingly demonstrates that the optimal starting point for any workplace concern is with an employee’s manager. Organizations must engage in training of managers so that they understand the pivotal role they play, are able to recognize nuanced concepts like what is “protected activity” and an “adverse action” and understand their obligation to communicate effectively with compliance, HR and legal. 

Second, organizations should consider holding managers accountable by measuring and ranking their commitment to compliance annually as a metric in their performance evaluations. 

Third, organizations should also audit and modify their investigation protocols to ensure that they have communication channels in place to respond to anonymous complaints. These can be challenging to investigate, but numerous vendors have established protocols that allow the organization to communicate back to anonymous reporters, who should be given the opportunity to remain anonymous yet cooperate by either providing more specific information or meeting face-to-face with an independent third-party investigator retained by the organization. 

Finally, organizations should endeavor to create a culture in which good-faith reporting is modeled, encouraged and met with a prompt and effective response. An organization must articulate and commit to a strong anti-retaliation policy, protecting and encouraging employees who come forward and continuously demonstrating that others can come forward without fear of retaliation.

The post Increased Anonymous Reporting is a Signal Compliance Leaders Cannot Ignore appeared first on Corporate Compliance Insights.

Rules are made for AI to follow, but exceptions to rules come from human experience. Neil Sahota, AI strategist and board director, discusses the balance of rules, experience, precision and exceptions needed to balance AI automation. Get that mix wrong and AI could commit a major foul.

The referee makes the call. Seconds later, play stops.

It happens across nearly all sports, where a video assistant referee (VAR), video reviews and instant replays have become ubiquitous in enforcing rules. Different angles expose details the human eye could miss, technology provides the evidence, and officials apply the rule. The decision is made … and people still argue about the call.

Our instinct is to blame VAR, but nothing malfunctioned. The technology accurately captured what happened. The officials correctly applied the rule. The system worked exactly as designed.

But what if the problem was the rule itself?

This question goes beyond sports. As companies embed AI into fraud detection, lending, hiring, pricing, procurement and other decisions, they excel in consistency. This is not always good news.

Rules vs. experience

People are inconsistent rule followers. We overlook things, we make exceptions. AI eliminates much of this variation. Give a machine a rule, and it will apply it to the first decision and the millionth with remarkable consistency. But put this in the context of a poorly written or ineffective rule: People may apply a bad rule inconsistently, but AI won’t. AI will apply the bad rule a million times.

AI’s greatest governance risk is consistency at scale. Worse, what companies call human inconsistency isn’t always an error. Sometimes, it is experience.

Imagine veteran fraud investigators who repeatedly override the same category of AI-generated alert. Management sees exceptions. Compliance sees deviation. The AI team sees users who aren’t trusting the model. But what do the investigators see?

Perhaps they learned through thousands of cases that a particular customer behavior looks suspicious according to policy but is usually legitimate. This judgment call won’t appear in the procedure manual because it springs from years of human experience.

Historically, this is how organizations operated. The official process says one thing while experienced employees make thousands of tiny adjustments that allow the process to work in the real world. Then, AI arrives. Management says: “Automate the process.” But which process?

Typically, we encode the process we can see: the documented rules, decision trees, thresholds and procedures. Yet, the thousands of judgment calls employees make between those steps are much harder to capture.

The company believes it automated the operating model. Unfortunately, more often, it automated the function of how its operating model actually works.

Compliance

In Healthcare, an AI Mistake Can Cost a License or a Life

by Christine Chasse

August 3, 2026

AI scales safety risks in healthcare to unprecedented levels

Read moreDetails

Precision vs. exceptions

This is where the VAR offers a lesson. While better technology tells us with better precision what happened and if a rule was followed, it cannot determine whether the assumptions behind our rules still make sense.

In fact, greater precision may expose weaknesses that human inconsistency previously concealed. This should change how executives think about AI governance. Yet, we rarely ask: What human judgment makes this process work that is not documented? The answer hides in the exceptions.

Before AI eliminates your exceptions, find out why the exceptions are there and what knowledge they may signal. Consider what people interpret and establish as guidelines. Once embedded into an AI-enabled workflow, the same policy becomes executable infrastructure and operates continuously at enormous scale. This creates a different question for executive teams and boards: What assumptions do people turn into infrastructure?

During almost any sporting match, millions of people watch VAR or video replays and still question the call. Inside a company, there is no stadium watching as AI converts yesterday’s assumptions into tomorrow’s decisions.

Ironically, the true danger is that AI may understand them perfectly.

The post AI Is a Stickler for the Rules, but Rules Don’t See Everything appeared first on Corporate Compliance Insights.

We need to rethink patching going forward, Apu Pavithran, CEO and founder of Hexnode argues. It’s just not possible to immediately address every vulnerability, so risk prioritization becomes a defensible, evidence-based posture. 

In June, the Cybersecurity and Infrastructure Security Agency (CISA) gave compliance teams an unexpected gift: permission not to patch most of their vulnerabilities, provided they can defend the decision.

The new directive seeks to redefine urgency against a rising tide of automated vulnerabilities. Federal agencies are therefore moving away from updating software based on a calendar or severity score and toward assessing risk and fast-tracking fixes for the most dangerous within three days.

This is a unique posture that businesses should consider mirroring for this moment. Bad actors are probing networks more aggressively and reducing the time between vulnerability disclosure and exploitation. Matching their speed is near-impossible, so determining what’s a priority and what’s deferrable is the next best course of action.

Crucially, chief compliance officers (CCOs) receive much-needed ammunition to explain to auditors or insurers what’s left unpatched and why. As a result, patch prioritization is becoming both a compliance essential and security foundation.

This shift acknowledges the reality of the AI age. Last year, around 50,000 common vulnerabilities and exposures (CVEs) were announced, up two-thirds from 2023. The notion to “patch everything” as soon as a new vulnerability arrives is no longer feasible in this landscape.

It’s telling that this perspective is gaining traction at a federal level: The nation’s cyber-defense agency is formally instructing teams to stop treating all vulnerabilities as equal and instead triage by risk. Under the directive, a vulnerability is assessed across several factors — public exposure, automatable exploitation, whether exploitation hands an attacker full system control and evidence of real-world exploitation — with only the highest-risk few fast-tracked. Enterprises should sit up and pay attention to this because, in effect, the standard-setter is conceding that risk-based patching is the preferable posture.

Consider this alongside NIST’s recent decision to enrich fewer vulnerability records with severity scores and affected product details. It, too, is struggling with the scale of new vulnerabilities and deciding to focus on threats that appear in the known exploited vulnerabilities (KEV) catalog, affect software used within the federal government or apply to “critical software”.

The onus is increasingly on internal teams not only to decide what to patch first but to log the reasoning behind it. This represents a major change because prompt patching has long been a cornerstone for keeping auditors and insurers onside. But in a triage model, a clear record of what you didn’t patch and why matters just as much.

Cybersecurity

NIST Database Change Rebalances Burden of Risk

by Nichole Windholz

July 13, 2026

Register of common vulnerabilities and exposures will have less federal context, leaving organizations to decide if a vulnerability warrants quick remediation

Read moreDetails

A compliance decision that creates formal risk acceptance

By taking a page from CISA, corporate compliance can become stronger by plugging the most serious holes and documenting the what and the why of every deferral. This is a beneficial technical and cultural evolution for a few reasons.

First, deferral creates formal risk acceptance. Targeting the worst-of-the-worst vulnerabilities creates a new decision-making chain that takes some of the pressure off IT and loops in the CCO. This way, companies can intentionally defer less serious vulnerabilities and connect patching to governance with an owner, rationale and record.

Second, we already know that very few enterprises remediate every known vulnerability. Last year, only one-quarter (26%) of critical vulnerabilities on CISA’s KEV catalog were fully remediated by organizations, down from 38% the previous year. Given the context of both more sophisticated and numerous threats, the stronger position in front of a regulator is a reasoned, criteria-based decision. Incorporating and enforcing a consistent risk-based stance separates a decision from an excuse, turning “we didn’t get to it” into “we assessed it and deferred it on these grounds.”

This kind of audit trail (what was deferred, against which criteria, signed off by whom and reviewed when) is valuable internally and externally. Most security and regulatory frameworks already require that vulnerability management be evidenced, not merely performed. And cyber-insurers increasingly want to see your thought process at renewal. Being able to align vulnerability management standards with a recognized third-party benchmark puts you in a far stronger position in an exam or breach post-mortem.

Remember, there’s an important difference between ignoring and deferring patches, and this posture gives teams the flexibility to focus on the most dangerous gaps as they emerge.

Moving patch prioritization from theory to practice

Putting this into practice (and making deferral less dangerous) starts with establishing a named owner and approval path. Define who signs, at what risk threshold and how escalations are handled. Having this record ready now, and in the format that an auditor or insurer will ask for, makes things much smoother if and when a breach occurs.

Also connect risk-based patching with your current reporting. For example, SOC 2 — the independent audit of whether a company’s data-security controls actually work as stated — already requires evidence of vulnerability management. However, the framework doesn’t set a rule. Instead, it requires the company itself to establish a defensible, documented and consistently applied process and prove it. This is where teams can incorporate the risk criteria and response timelines defined by CISA, providing a much stronger process than a homegrown one that must be justified from scratch.

Finally, ensure that security and compliance co-own the patch call. The deferral decision needs the former’s risk read and the latter’s documentation discipline. Siloed, it fails both sides of the enterprise. Further, the risk framework only holds if the decision can actually be executed and demonstrated across the ecosystem.

The post Deferred, Not Ignored: Explaining Unpatched Vulnerabilities to Your Auditor appeared first on Corporate Compliance Insights.

Recent regulatory activity illustrates why companies should take AI-washing seriously, Andrew Lustigman and Barry Greenbaum of Olshan explain. Remember: Your vendors’ marketing materials should not become your substantiation record. 

Companies increasingly describe their products and services as AI-related. They promote “AI-powered” personalization, “AI-driven” recommendations, automated customer service, predictive analytics and other features across websites, sales decks, RFP responses, customer contracts, vendor disclosures and executive interviews. 

The claims are everywhere, but in many cases the technology plays only a minor role or none at all. This gap between marketing language and technical reality has become known as “AI washing,” taking a page from overstated sustainability claims and resulting greenwashing, and can result in Federal Trade Commission (FTC) enforcement actions and advertising industry regulator challenges.

Advertising substantiation is not new. Regulators have long required companies to have a reasonable basis for objective claims before those claims are disseminated. What is new is the complexity of AI claims and the difficulty of evaluating the underlying technology. The standard, however, has not changed. Companies still need a reasonable basis for their objective claims. The challenge is that AI can make that basis harder to establish, evaluate and maintain.

Define the claim

The first challenge is often the claim itself. “AI‑powered,” “AI‑driven,” “intelligent” and “automated” can all mean different things depending on context. A customer may reasonably believe “AI‑powered customer service” to mean that an AI system handles interactions with little or no human involvement. The underlying product, however, may use AI only to suggest responses and require human reviews prior to sending. For example, Samsung faced a challenge from the industry’s self-regulatory body, NAD, regarding advertising for its Bespoke refrigerators, resulting in the discontinuance of claims that “smart” connectivity was AI-driven.

Before attempting to substantiate an AI claim, legal and compliance teams should ask: What would a reasonable customer understand this statement to mean? That question forces the organization to articulate what the technology actually does, whether it makes decisions, assists a human decision-maker or performs a narrow function within a larger rules‑based system. Defining the claim is the first step toward identifying the evidence required to support it.

Evidence must match the promise

After defining the claim, the next questions become whether the company has evidence to support it and whether that evidence matches what the claim promises.

If a company says its AI system is “95% accurate,” that should prompt questions about how accuracy was measured, what data was used, what the system was tested against and under what conditions. A claim that the system is “more accurate than human reviewers” involves different considerations. It requires identifying who the reviewers were, what tasks they performed and whether the comparison was statistically meaningful. If a product is described as “fully automated” but employees routinely review or correct its output, the company should consider whether that human involvement changes what customers are likely to understand from the claim.

Regulators have not ignored these types of claims. In the case of FTC v. Workado, LLC, the FTC challenged a company’s AI content detector as being “98% accurate” when independent testing revealed the number was closer to 53%. The company settled with the agency, agreeing to prohibitions on representations about the effectiveness of its AI products unless it had competent and reliable evidence to support the claim. 

More recently, the FTC brought a trio of enforcement actions against Cox Media Group and two small marketing agencies challenging claims that their “Active Listening” branded marketing service deployed a special algorithm to listen in on consumers’ conversations overheard by smart devices. The algorithm would then facilitate the delivery of targeted advertising in the advertisers’ desired locations. The FTC contended that the listening service did not actually listen in on consumers’ conversations or use voice data. Furthermore, the FTC contended that consumers had not opted in for this service. Cox Media Group and the marketing agencies settled the actions, paying nearly $1 million and agreeing to prohibitions on the qualities or features of its advertising or marketing services; the collection and use of voice data and whether consumers have provided their consent to collect, use or disclose their voice data; and the geographic targeting capabilities of its advertising or marketing services.

In the self-regulatory context, Horizon Brands faced an NAD challenge regarding advertising claims for its Tiny Traveler “AI-powered Smart Baby Monitor Solution.” While the presence of an AI chip supported claims that the baby monitor did employ AI technology, NAD recommended that AI “emotion detection” and “motion detection” claims note their limitations and discontinue claims that the monitor can ensure infant safety. The challenge demonstrates that companies should be careful to limit claims that a feature is available if it is not yet live and be sure to disclose any limitations on performance and operating conditions.

Cybersecurity

NIST Is Offering a New AI Evaluation Framework, Not Another Compliance Checklist

by Larry Marks

August 21, 2026

Draft framework TEVV-Athlon is designed for organizational flexibility

Read moreDetails

Substantiating the vendor

Substantiation becomes more complicated when a company relies on third‑party AI technology. Retailers, financial institutions, software companies and other businesses increasingly incorporate AI tools supplied by vendors. A vendor may describe its technology as highly accurate, autonomous, secure or capable of producing a particular business outcome. Those representations often find their way into the customer’s own website, sales materials or RFP responses. But a vendor’s marketing materials should not automatically become the customer’s substantiation record.

Companies should understand what their vendors are providing and what evidence supports material claims about the technology. Vendor claims should be verified before they are incorporated into the company’s own marketing or customer communications. Contracts can help facilitate that process by requiring vendors to provide technical documentation, testing reports and notice of material changes. But contractual protections are not a substitute for understanding the product. If a company tells its customers that its own service provides a particular AI-enabled benefit, pointing to a vendor’s website after the fact is unlikely to establish whether the company’s statement was adequately supported.

Consistency across the organization

AI claims often span multiple departments, which increases the risk of inconsistency. Marketing may approve language for a website. Product developers may describe the same feature differently in a sales presentation. A salesperson may make a broader representation. An executive may characterize the technology in a different way during an interview. Each statement may seem harmless on its own, but together, they can create a picture of the product that is considerably more expansive than what the technology actually does.

A coordinated review process involving legal or compliance, product or engineering and the business or marketing team responsible for communicating with customers can help ensure that everyone is working from the same understanding of the technology; it can also outline the evidence supporting the claim. The goal is not to require every communication to use identical language but to ensure that variations in messaging do not convey materially different impressions of what the technology can do.

Ongoing substantiation

Finally, companies should maintain a record for material AI claims and keep it current. The record should identify:

• The precise claim.
• Where it is being used.
• The product or feature involved.
• The evidence supporting it.
• Any material limitations.
• The designated individual responsible.
• The date it was last reviewed.

Maintaining a live, periodically updated record ensures ongoing accuracy.

Companies should also have final checks. Before approving an AI claim, companies should thoroughly review what they are saying, what a reasonable customer would understand and what evidence they have today. The companies that can answer these questions each time a claim is made will be the ones that build lasting trust, avoid regulatory risk and maintain credibility across the market. 

The post Substantiate Your AI Claims Before They Become AI-Washing Challenges appeared first on Corporate Compliance Insights.

Gauge the maturity of your TPRM program

Benchmarking study

Third-Party Risk Management

What’s in this report from Rethink Compliance:

Third-party relationships are essential to modern business, but they can also introduce significant ethics and compliance risks. Rethink Compliance’s 2026 benchmarking study examines how organizations are identifying, screening and managing those risks, drawing on responses from nearly 130 E&C practitioners across more than 20 industries. The detailed findings focus on 83 organizations with existing TPRM programs and explore the practices, controls and technologies they use.

The study examines:

• Which E&C risks organizations address through their TPRM programs and where emerging risks like AI, data privacy and cybersecurity remain less commonly covered.
• Which types of third parties are screened, from service providers and suppliers to agents, distributors, M&A targets and fourth parties.
• How organizations use due diligence, third-party codes of conduct, contractual audit rights, training and ongoing monitoring to manage risk.

The post Benchmarking Study: Third-Party Risk Management appeared first on Corporate Compliance Insights.

What is the state of ethics & compliance training?

Benchmarking study

Training & Communications Report

What’s in this report from Rethink Compliance:

Rethink Compliance’s four compliance and ethics benchmarking study, developed by compliance practitioners with decades of experience, offers insights designed to help companies enhance their organization’s compliance training approach.

Some key findings of the survey of more than 200 practitioners:

• A majority of respondents (83%) say all employees received ethics & compliance training during the survey period of 2025, roughly equivalent to what the survey found in 2021.
• In just over one-third of organizations (34%), all employees received ethics & compliance training that was specific to their risk profile.
• Only 20% of respondents said their board directors receive no ethics & compliance training, a decline from 35% in 2021.

The post Benchmarking Study: Training & Communications appeared first on Corporate Compliance Insights.

Making your compliance training matter

Whitepaper

Raising the Bar: A New Standard for Compliance Training

What’s in this whitepaper from Rethink Compliance:

Most compliance training libraries look similar on a demo call. The differences show up later — when you’re three years into a training program and realize the content isn’t keeping pace, your client support has quietly eroded and the customization options you were promised never materialized.

Many providers can imitate the visible layer: a library with apparent depth, some modern-looking courses, broad claims about customization and global reach. Fewer can deliver what a serious program actually requires over time.

That’s because doing this well requires mastering a long list of separate, difficult domains like:

• Broad and current topic coverage
• Strong instructional design
• Compelling media
• Meaningful customization options and supportive processes
• Reliable technology
• Analytics that turn completion data into program intelligence

Get practical insight into what actually works: inside real programs, with real budgets, real competing priorities and real pressure to show results

About Rethink Compliance

At Rethink, we built our business around a different vision: that compliance leaders deserve a partner that can sustain a serious compliance training program, not just launch one.

The post Raising the Bar: A New Standard for Compliance Training appeared first on Corporate Compliance Insights.

Social engineering tops more than 75% of security experts concerns

Cyber crooks tricking employees into handing over access to company information is the top human risk for more than three-fourths of cybersecurity personnel, a survey by SANS Institute concluded. 

The global survey of more than 1,700 cybersecurity practitioners found that 77% say social engineering is their organization’s top human risk, while phishing remained the primary attack method. But fake texts and voice scams are on the rise, the survey said.

AI has made it easier for hackers to research victims and launch social engineering attacks, the survey reported, and, reflecting this reality, AI jumped from the fourth spot two years ago to second place this year in cybersecurity experts’ ranking of human risks. More than two in five (42%) respondents said AI was a top risk as they’re particularly concerned with organizations not having policies in place to govern AI and not knowing how employees are using unauthorized AI, a practice known as shadow AI.

With 39% of respondents naming incorrect handling of sensitive data as a human risk, the issue ranked third, while password and authentication risk ranked fourth with 22% saying cyber attackers getting ahold of these credentials is a major concern. Password and authentication risk have dropped two spots over the past two years in the rankings. 

More finance functions turning to AI

Companies have increasingly turned to AI to make money predictions. with a nearly 20-percentage-point jump over the past year in leaders using the technology to forecast financials, according to a new survey by Protiviti. Over the past year, the percentage of leaders using AI for financial forecasts increased from 58% to 76%, the survey of 902 worldwide executives found.

Despite the rise in usage, how much cash AI brings in is still hard for companies to measure, Protiviti said. Only 35% of finance functions say they are highly or moderately effective at measuring AI return on investment. That may be due to a lack of an AI plan. Just 14% deploy AI with a defined strategy, the survey found.

Finance leaders are also concerned about security as AI adoption increases and the technology’s access to data ramps up, according to the survey. Data privacy and security ranked as the top finance priority for a third year in a row.

“Finance leaders have moved beyond asking whether to adopt AI. Today’s challenge is to use AI to make more informed business decisions and prove that it is delivering measurable value,” Christopher Wright, global leader of Protiviti’s CFO solutions and business performance improvement practice, said in a statement. “Organizations that pair strong data governance with clear business objectives are better positioned to navigate economic uncertainty, shifting market conditions and rising expectations for finance transformation.”

Other key findings include:

• 77% of finance organizations now use AI.
• 67% use AI for risk assessment and management.
• 56% use the technology for process automation.

Ransomware attacks reached year high in July

Hackers had a prolific summer as ransomware activity spiked in July to its highest point since February 2025, according to a report by NCC Group, representing a 22% increase from June. 

The ransomware activity remains concentrated in North America, where 41% of cyber attacks occurred, and Europe, which accounted for 29%. Industrials were the most targeted sector, with 250 attacks (28%), followed by consumer discretionary with 165 (18%) and information technology with 103 (12%) attacks. 

The report also highlighted what cybersecurity group Sysdig in early July called the first documented case of agentic ransomware, giving the AI agent the name JADEPUFFER and describing the attack as “a complete extortion operation driven end-to-end by a large language model.” 

“AI is changing the speed and scale of cyber attacks,” Matt Hull, NCC Group vice president of cyber intelligence and response, said in a statement. “It’s allowing attackers to automate more of what they do, operate at greater scale and create increasingly convincing phishing, social engineering and other malicious content. That can make threats harder for both organizations and individuals to identify.”

The post Cybersecurity Pros Name Social Engineering as Top Human Risk appeared first on Corporate Compliance Insights.