Compliance Perspectives

By Adam Turteltaub If you’re looking for compliance direction only from the US Department of Justice, you’re missing the wider picture. There is a lot going on in Europe that companies operating in that geography need to be complying with. Dr. Tobias Kruis, Head of Corporate Compliance, Giesecke+Devrient, shares what is going on both in this podcast in his session “Dancing with the Acronyms: Jiving Through LkSG and CSDDDD in the European Compliance Ballroom” at the 2025 SCCE Annual Compliance & Ethics Institute. The German Supply Chain Due Diligence Act, also known under the acronym LkSG, is focused on human rights, occupational health and safety and environmental projects. It requires regular and systematic risk assessments as well as remediation and preventative measures if risks are found. Grievance procedures are also a mandate, as are annual effectiveness reports on the supplier due diligence process. Sanctions for non-compliance can be as high as 2% of annual turnover. The German regulator has alrea

By Adam Turteltaub There’s always a “but” when it comes to AI. It has great potential, but there’s always the risk of bad things happening. In the case of the False Claims Act and healthcare, that’s very much the case. In a recent article for Compliance Today – “AI and the False Claims Act: Navigating compliance in the age of automation” -- Phoebe Roth and Colton Kopcik of Day Pitney warn that the same “but” applies to medical coding. AI and coding seem to be a match made in heaven. There is enormous potential for ensuring that bills get processed quickly and all the proper charges are made.  But (of course) plenty of risks come with it. First and foremost, a lack of human oversight can lead small errors to quickly multiply, especially if the AI model was trained on biased historical data or follows patterns of mis-billing. False claims can then can quickly spiral out of control, leading to expensive refunds and settlements. Other areas of risk include telehealth and remote care fraud, especially at a ti

By Adam Turteltaub As important as gaining access to the board is, using that time properly is even more crucial. Becky Rohr, Chief Compliance Officer and head of Investigations at Ericsson, will be sharing her insights and advice on this topic in her session “Board Reporting, Not Bored Reporting: Presenting to Boards and Other Senior Stakeholders by Using Data and Storytelling” at the 2025 SCCE Annual Compliance & Ethics Institute in Nashville. In this podcast and preview of her session, she advises that, even before entering the boardroom it’s important to take the time to know your audience. Talking to the board, a board committee or senior executives is different since each has its own priorities. Be sure that what you say and show them speaks directly to their role. Remember, too, that the board is focused on the organization as a whole. She cautions that the board will feel obligated to read anything you send it. So, be sure to avoid overwhelming them and to focus on the larger issues that could mate

By Adam Turteltaub What you don’t know can hurt you. And what you do know can hurt you.  Such is the dilemma of background screening. Companies want to know who they are hiring, but, explains Al Firato, CEO & Founder of HireSafe, some information is off limits. The 1964 Civil Rights Act and Title VII prohibit examinations of race, religion, ethnicity and more. In addition, federal and state regulations set limits on what background check firms can look at. That’s not always a bad thing, Al points out. A conviction for a criminal offense from decades earlier should not be cause for immediate disqualification, especially if the person has since made amends. In addition, the conviction may not be relevant for the job at hand: a DUI for a prospective delivery driver is a lot different than one for someone who will be working at a desk all day. The EEOC has also made it clear that people are, in most cases, entitled to a second chance. With that said, background checks can be very useful for revealing exaggera

By Adam Turteltaub Dr. Hemma R. Lomax, Vice President, Deputy General Counsel and Global Head of Ethics and Compliance for DocuSign thinks a lot about leaving a legacy, not just for herself but in general. She’ll be addressing the topic Beyond the Rules: The Future of Compliance is Legacy-Driven Leadership at the SCCE 24th Annual Compliance & Ethics Institute, which takes place September 14-17, 2025 in Nashville. She is a strong advocate for thinking beyond quarterly goals and looking to operationalize best intentions to leave something behind that is more enduring. Getting there, she explains, requires first helping leaders understand that they know that a legacy is not out of reach, if they focus on doing the right thing and for the long run. Done correctly, the legacy they create can be an enduring strategic asset. For compliance teams it means recognizing that every human has a survivor and a sage brain. And, while we in compliance need to embrace that survivor brain and embrace bad scenarios, we canno

By Adam Turteltaub Joint ventures are created to capitalize on a business opportunity, but they come with challenges. Each partner may have a different experience with or attitude towards compliance. They may have distinctly different cultures, and, in the worst case, may each be expecting the other to be watching compliance when, in fact, no one is. Hassan Chaudry, a member of the SCCE & HCCA Board and Chief Compliance Officer of POSCO JV, a General Motors joint venture, recommends several keys to success in JVs. First, having meaningful conversations with leadership right at the start is important, especially if it is face-to-face. This helps establish rapport and makes top management more comfortable with the role of compliance. Look to commonalities between the partners, not just the difference. In his case, with one party being from North America and the other from South Korea, there were different approaches and laws, but both countries are members of the OECD, and its guidance for compliance program

By Adam Turteltaub Don’t take it personally if it’s taking you forever to find a new compliance job. According to Matt Kelly (LinkedIn), Editor and CEO at Radical Compliance, you’re far from alone. It’s not that there aren’t jobs out there, he explains. There is just a hesitancy to hire due to the macro-economic environment. With so much economic instability and unpredictability, organizations are slower to hire. Adding to the challenge is technology. A job posted on LinkedIn can generate hundreds or thousands of applications, making it more difficult for organizations to wade through them. So how do you make yourself stand out and become a must-hire? He recommends moving beyond showcasing your ability to manage regulatory issues and instead focus on how your skills can help the organization navigate the range of operational risks that they face. Be sure to also shift from focusing on what you can do to defend the company to how you can help the company grow. Finally, he advises showcasing your certifica

By Adam Turteltaub Professors Todd Haugh (LinkedIn) and Suneal Bedi (LinkedIn) of the Institute for Corporate Governance & Ethics at the Kelley School of Business at Indiana University recently published a paper: Retheorizing Corporate Compliance. In it they argued strongly that compliance needs to be seen not just as a defense against potential corporate legal liability. It also needs to be recognized as a proactive offensive tool for building market share and competitive advantage. On this podcast they explain that compliance creates numerous non-market strategies for helping the business. For example, organizations with stronger programs can demonstrate to regulators that they would be a good choice to acquire a troubled company. Leading compliance programs can also help to set the standard of practices for their industry, giving their organizations an advantage over those with lagging compliance practices. In sum, by thinking of how compliance can help the business, not just protect it, there are signi

By Adam Turteltaub In November 2024, the Office of Inspector General at Health and Human Services  released its Nursing Facility: Industry Segment-Specific Compliance Program Guidance. The document is part of an effort to modernize how HHS OIG is communicating to industry and providing information about risks, how to mitigate them and best practices for compliance programs. Jillian Willis (LinkedIn/Firm Page) and Melissa Scott (LinkedIn/Firm Page) of Nelson Mullins explain that the new guidance contains four main sections: quality of care and quality of life, Medicare and Medicaid billing requirements, Federal anti-kickback statute and other risk areas such as physician self-referral, HIPAA and related-party transactions. It shares best practices. Notably, the guidance, complements other guidance out there, including the Department of Justice’s. And, in addition to focusing compliance efforts, it can be helpful for promoting operational efficiency. Listen in and then spend some time reading the Nursing Fa

By Adam Turteltaub Professors Guido Palazzo and Ulrich Hoffrage are skeptical. When they hear that there was a bad apple at the core of a scandal, they are hesitant to accept that explanation. Instead, they argue in this podcast and in their new book, The Dark Pattern: The Hidden Dynamics of Corporate Scandals, that the problem is typically much deeper and wider. There are dark patterns, as they call them, that lead to bad behavior. Underlying the patterns are nine building blocks.  They explain: Rigid ideology is a shared belief system that narrows the view of decision-makers at the expense of other views, risking them losing sight of ethical dimensions. Toxic leadership can create fearful contexts when narcissistic, Machiavellian, or psychopathic leaders abuse their power and cause harm, be it through direct orders, leading by example, or a carrot- and- stick approach. Manipulative language restricts how things are perceived and evaluated, influencing people’s judgments, decisions, and behaviors in

By Adam Turteltaub So you’ve got a case of AI fever and want to put the technology to work for your compliance team. What should you do? Jordan Domash, Founder of Rersponsiv, urges you to first take a deep breath and think through the process starting with defining your goals. Interestingly, he shares, the goals can be affected by the solution you choose, whether you go with a solution that is homegrown or out of the box. Either way, once the goal is set, expect an iterative process and regular testing to ensure that the solution is delivering what you were looking for, free from hallucinations and other problems. To make that process work it’s essential to have an evaluation plan in place, which includes identifying all the potential failure points. Make a part of it conducting some manual tests to see if the AI is delivering the results it should. In sum, AI can be invaluable to your program, but only if you put in the work to ensure that it is well designed and truly performing as it should. Listen n

By Adam Turteltaub On May 12, 2025 the head of the Criminal Division at the US Department of Justice issued a memo to all Criminal Division personnel with the subject: Focus, Fairness and Efficiency in the Fight Against White Collar Crime. To understand what the document means for compliance programs, we spoke with Amy Matsuo, leader for both Regulatory Insights and Compliance Transformation at KPMG. Overall, she sees the document as being good news for compliance programs.  It reiterates the importance and value of quickly finding and remediating violations. The DOJ also outlines some very favorable terms for organizations that self-disclose. These can include a declination with no requirement to enter into a criminal resolution, a non-prosecution agreement and a 75% reduction in potential fines. The Department of Justice will also be reviewing settlements that are already in place and may provide relief if the organization is found to have made substantial progress, has a reduced risk profile and self-r

By Adam Turteltaub Andres Cuevas, Compliance Director LATAM for EmergentCold explains from Chile that for compliance officers to be successful in Latin America they need to stop thinking about Latin America as a whole and start thinking much more about each country and its culture. And, of course, we must be mindful that each company also has a culture of its own. To navigate the differences and build consistency, he advocates for having a strong set of baselines rules that are common across your enterprise and the region. Establish what is non-negotiable. But, at the same time, it’s important to work with local leaders to have an understanding of what the local realities are, work with them and respond accordingly when variations are necessary. Compliance leaders also need to be mindful of the legal requirements of each country. In Chile, for example, he reports that there are more than 250 crimes that the company can be found liable for. Listen in to learn more about how to navigate your compliance eff

By Adam Turteltaub Mark Diamond wants you to stop thinking of records retention as a chore and start thinking of it as a driver of compliance. In this podcast the President & CEO of Contoural shares that retention schedules have grown in importance with increased requirements for privacy and safeguarding personal data. That, in turn, is having an enormous impact on the risks and costs of ediscovery. Proper retention schedules also have significant impact on employee productivity and collaboration, as well as using AI in less risky ways. Organizations are now increasingly treating records based on their business value and are developing retention schedules that reflect their worth. One of the greatest challenges they face, though, is the tendency of employees to want to hold onto everything just in case. While it’s understandable, it adversely affects efficiency, as employees are forced to wade their way through obsolete records. Part of the solution, he suggests, is to develop a “super schedule” for docu

By Adam Turteltaub In a recent issue of Compliance & Ethics Professional ®, Nick Gallo, Chief Servant and Co-CEO of Ethico addressed the control paradox, a situation in which the controls designed to prevent misconduct, actually encourage it. Think of it like the person whose car has so many airbags that they no longer fear an accident and drive quicker. So what’s the solution? He argues it’s creating an environment where we have faith in controls, but not too much, and focus on helping those on the front line make the right decisions. That includes, he says, teaching not just what you should do but why. It also means encouraging ownership of ethical issues, not outsourcing it. Listen in to learn more about how to get better control on your controls. Listen now Sponsored by Case IQ, a global provider of whistleblowing, case management, and compliance solutions.

By Adam Turteltaub Recently, Gartner released very intriguing research into third party risk. Chris Audet, Vice President and Chief of Research in the Gartner Assurance Practice tell us that they found business has it’s spending all wrong. Too much is invested in due diligence, and not enough time and effort is spent on monitoring. There research found that the business unit knows the risks third parties pose and is seeing it firsthand. When relationship managers were surveyed, 84% had seen changes to the risk profile and 76% found a third party had provided materially inaccurate information.  In fact, 95% had seen something troubling in the past year. So why aren’t they reporting this information to the compliance team and what would get them to share more? There were three main answers, Chris reports: Creating more relationship ownership objectivity. Too many feel too strong a tie to the third party. Confidence in identifying red flags. Encouraging objectivity and providing reassurance that compli

By Adam Turteltaub Risk assessments are not new in healthcare, and in specific regulatory areas are required. But, that doesn’t mean things aren’t changing.  More and more organizations are embracing enterprise risk assessments (ERM) as a way to assess the range of risks that they face, including  legal and regulatory concerns. Getting the risk assessment right is particularly challenging for healthcare organizations, explains Robert Stratton, Executive Director – Enterprise Risk and Security; Corporate Compliance Official and Senior Counsel for Northwest Permanente. Robert is also the author of the chapter “Enterprise Risk Management in Healthcare” in the latest edition of the Complete Healthcare Compliance Manual. The mix of insurance, patient care professionals, large sums of money and complex structures makes the risk map challenging. On the positive side, electronic health records can provide a wealth of information to inform your ERM efforts, as can frontline employees who can provide insights into w

By Adam Turteltaub As if ransomware and phishing attacks weren’t enough to keep us up at night, now AI is enabling a whole new range of cyber threats. Ryan Redman, Product Manager, Marketing and Brett Sommers, Director of GRC Products at Onspring warn that the nature of attacks is evolving.  Vishing, in which criminals use technology to imitate the voices of colleagues and organization leaders, is being used to trick people into revealing passwords, share data or send money. Employees need to learn to be wary and even confirm requests, even from trusted voices, via email or other means. Healthcare and manufacturing are two industries that have been singled out by bad actors for this kind of attack. Aside from training, what else can compliance teams do? They recommend: Focusing your resources on high value risk areas Ensuring your cyber defenses are as strong as they need to be Reviewing your third parties to ensure that a compromise won’t come from someone hacking into their systems Understandin

By Adam Turteltaub These are fractious times, and it’s often difficult to figure out what to do, what comes next and keep people with divergent views working together. Despite these challenges, Anna Romberg, Executive Vice President, Sustainability, Legal and Compliance for Getinge,  doesn’t believe that things are hopeless. In an article she co-authored with Richard Bistrong for Harvard Business Review, they  laid out several strategies for successfully navigating the current era. In this podcast, she reminds us that ethics and compliance programs are about more than following the law. They are also about encouraging good behavior, which includes following the company’s values, no matter how the political winds are blowing. With that said, now is a good time to do what organizations need to do, which is assess their values periodically to ensure that they are relevant, and the organization is living up to them. At the same time, she encourages the compliance team to embrace friction. It is inevitable wh

By Adam Turteltaub Do you ever wish you were made of rubber, especially nowadays with so much change? Do you wish that you could be flexible enough to handle every new legal regulatory change or every business demand without breaking? It’s not likely to happen, but compliance industry veteran Lisa Beth Lentini Walker believes that we can become more resilient. Resilience, she observes, is a mindset. We can work to become more adaptable and open to change by framing it in the right way. If you look at it with dread, you are less likely to succeed. But, if you recognize that nothing is permanent, change is inevitable and focus on what needs to be done, the chances of success are much greater. Look at change as an opportunity to shine and show leadership. Become the person who management trusts to look to the future and find the path forward for the organization. The workforce, too, wants to know that they can count on you to keep them safe and the company operating strongly. Listen in to learn more about beco