Why a well-documented programme is necessary but never sufficient — and what it takes to build the culture that makes it work.

The people who have never appeared on a watchlist are the ones most worth investing in — before pressure changes the equation.

Understanding the mechanism behind ethical failure — and how organisations can interrupt it before the moment of decision.

How middle managers become the invisible front line of compliance culture — and why supporting them changes everything.

The metrics that matter, the signals that do not, and the questions worth asking before the next audit tells you what you already knew.

The eight measures of Article 17 are not a checklist. Understanding the difference between having them and implementing them is the difference between compliance and exposure.

The third-party obligation is among the most demanding Sapin II imposes — and among the most commonly implemented in ways that would not survive an AFA investigation.

Every Sapin II measure should be calibrated to the company's actual risk exposure. Without a credible, living risk map, that calibration is impossible.

Non-US companies have discovered the Foreign Corrupt Practices Act's extraterritorial scope through enforcement rather than compliance. The pattern is consistent enough to serve as a clear warning.

The accounting provisions of the FCPA are broader, carry a lower intent threshold, and receive less compliance attention than the anti-bribery provisions. That imbalance creates exposure.

Senior commitment to compliance is the necessary starting point. Understanding why it is never the finishing point is what separates organisations that build culture from those that only communicate it.

Oversight is the minimum the governance framework requires. Accountability is what actually moves the culture. The difference is visible in the questions a board is willing to ask.

Most senior leaders who are told their compliance culture has a problem are genuinely surprised. Three misunderstandings account for much of the gap between their confidence and the reality their people experience.

Compliance programmes are built to manage risk that flows downward. The risk that sits at the top of the authority structure is the one they are least designed to reach.

The quality of the conversation a compliance function has with its executive committee determines almost everything else. Most of those conversations are not working as well as they should.

When compliance training is classified as a learning activity rather than a control activity, it loses the properties that make it effective — and produces the kind of evidence that satisfies no one in an enforcement inquiry.

Most compliance training programmes leave behind records. Very few leave behind evidence. The difference determines whether training can be presented as proof that internal controls are functioning.

Completion rates and average scores measure activity. The metrics that tell you whether your training is functioning as a control measure something more precise — and require more from the compliance function to produce.

A compliance training programme that produces the same results year after year is not functioning as a strategy. Continuous monitoring, benchmarking, and structured improvement are not optional features.

Every scenario-based question in a digital compliance training module is a data point. Organisations that analyse those data points at scale gain real-time field intelligence on the integrity risk environment.

Germany's supply chain due diligence law has been in force since 2023. Its reach extends well beyond German companies — and its enforcement authority is real.

The Corporate Sustainability Due Diligence Directive goes further than any previous supply chain framework — with civil liability, a climate plan obligation, and duties on directors.

Most in-scope organisations have now built the formal infrastructure the Directive requires. Significantly fewer have built the operational substance that makes it work.

The EU AI Act is a risk management law as much as a technology law. For compliance functions, it creates obligations as deployers, responsibilities as overseers, and a new category of integrity risk.

CSRD, IFRS S1/S2, and the SEC climate rule have transformed sustainability reporting from a voluntary exercise into a mandatory compliance obligation with substantial implications for compliance functions.

The majority of major corporate integrity failures originate not inside the organisation but in the relationships it keeps. Understanding why — and what that demands of the compliance programme.

Most third-party due diligence programmes fail in predictable ways. Understanding those failure modes — and the architecture that avoids them — is what separates a programme that manages risk from one that creates the appearance of doing so.

Applying the same due diligence to every third party is neither efficient nor rigorous. Risk tiering directs the most intensive scrutiny to the relationships that carry the greatest exposure.

Due diligence tells you what the risk is. The contract determines what you can do about it. Most third-party contracts do not contain the compliance provisions needed to manage the relationship.

A third-party relationship does not stay still after it is approved. Ownership changes. Risk profiles evolve. The programme that treats clearance at onboarding as a permanent status is managing yesterday's risk.

ISO 37001 and ISO 37301 are frequently misunderstood as alternatives or equivalents. They are neither. Understanding how they relate — and why holding both matters.

ISO 37001 specifies the management system an organisation must build to prevent, detect, and respond to bribery. What the standard actually requires — and how auditors assess it.

ISO 37301 is the first certifiable international standard for compliance management systems. Its requirements go further than most compliance programmes have built.

The gap analysis is the process that makes the decision to certify credible from the start. Without it, certification programmes over-invest where systems already exist and under-invest where gaps are most significant.

The organisations that struggle most with ISO certification are the ones that treated it as a project with an end date. What certification requires after the certificate is issued.

Most organisations have a channel. Very few have a culture. The distinction is not technical — it is human. Understanding it is the starting point for building something that actually works.

Silence in organisations is rarely the result of having nothing to say. Understanding the five barriers that prevent people from raising concerns — and what specifically addresses each one.

A reporting system designed for compliance purposes and one designed for human use are not automatically the same thing. The design decisions that make the difference.

The response to a concern is the organisation's most powerful act of communication about its speak-up culture. Acknowledgement, investigation quality, and closing the feedback loop are the culture in action.

Case volume and closure rates measure speak-up activity. They do not measure speak-up culture. The indicators that reveal whether the culture is genuinely working require a different measurement approach.

Financial interest is one dimension of conflict of interest. Relational, reputational, and positional conflicts are equally significant — and largely invisible to programmes built around the narrow definition.

The organisation cannot manage what it does not know about. Building a disclosure architecture that employees actually use requires as much design attention as the management framework that follows it.

Senior-level conflicts carry consequences disproportionate to the interest involved. The authority attached to senior roles amplifies every dimension of the risk — and the standard disclosure process is not adequate.

The procurement process is the organisation's most conflict-exposed operational function. Personal interests in supplier relationships create integrity risks that develop gradually and require careful management.

Disclosure is the beginning of conflict management, not its conclusion. Assessment, management measures, monitoring, and documentation determine whether the framework actually protects the organisation.

The compliance officer is responsible for outcomes they do not have the authority to produce. Understanding this structural tension — and how to work within it.

The compliance officer seen as an enforcement agent will be avoided. The one seen as a trusted advisor will be sought out. The difference is not in the role — it is in how it is performed.

The moments when commercial pressure and compliance requirements pull in different directions define the function. How to distinguish legitimate revision from inappropriate capitulation.

The compliance officer who cannot evaluate the effectiveness of their own programme is not managing it — they are maintaining it. Four questions that generate the analytical content governance needs.

The compliance function is under transformation — in scope, in tools, and in what it will be expected to deliver. What changes, and what will remain irreducibly human at the core.