News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Third-Party Risk ManagementFinCEN s August 2020 guidance on politically exposed persons (PEPs) confirms what compliance officers already know: there s no checklist. You re expected to design a risk-based due diligence framework
Regulatory Obligations ManagementGermany s Law to Strengthen Business Integrity introduces criminal liability for companies and allows sanctions up to 10% of worldwide annual revenue for organizations exceeding EUR 100 million in tur
Third-Party Risk ManagementIf your company imports tin, tantalum, tungsten, or gold into the EU, you ve probably heard assumptions about what the EU Conflict Minerals Regulation requires. Some of these assumptions are incorrect
Internal Controls & AuditThe Challenge In spring 2021, compliance and legal teams at numerous companies received anonymous reports alleging serious financial misconduct, including accounting fraud and kickbacks. These reports
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory Obligations ManagementThe Decision You re Facing Your organization screens third parties against sanctions lists . The question isn t whether to screen, it s how. Do you continue manual checks using publicly available list
Regulatory Obligations ManagementYou ve probably noticed your external auditors asking different questions lately. They re spending more time on your whistleblower hotline metrics. They want to know how many employees completed ethic
Ethics & ConductJapan s Retaliation Protection Act expanded to include small and medium-sized businesses on June 1, 2022. This wasn t a new law; it extended existing requirements for large organizations. Compliance t
Privacy & Data ProtectionThe California Individual Rights Act (CPRA) took effect on January 1, 2023, with enforcement starting July 1, 2023. Unlike the California Consumer Privacy Act (CCPA) it replaced, the CPRA expands cons
Privacy & Data ProtectionYou re staring at a spreadsheet with five tabs, one for each state privacy law your company needs to comply with. California wants data protection assessments. Utah doesn t. Connecticut requires unive
Third-Party Risk ManagementSanctions compliance has become a boardroom priority, yet many third-party risk programs still operate on outdated assumptions. These assumptions were formed before the Russian Federation s invasion o
Third-Party Risk ManagementIf you re aiming to comply with the EU Corporate Sustainability Due Diligence Directive (CSDD), you might think rigorous supplier audits are the solution. Conduct site visits, review policies, and che
Regulatory Obligations ManagementGermany s Supply Chain Due Diligence Act is now in full effect. The Federal Office of Economic Affairs and Export Control (BAFA) can impose fines up to eight million euros or 2% of annual global turno
Regulatory Obligations ManagementThe EU s Corporate Sustainability Due Diligence Directive (CSDDD) isn t a one-size-fits-all mandate. Your compliance path depends on three variables: where you operate, how much revenue you generate i
Privacy & Data ProtectionThe U.K. has updated its data protection rules with a new law aimed at simplifying compliance with existing privacy legislation, including GDPR . For compliance officers managing data processing regis
Business Continuity & ResilienceManchester Airports Group (MAG) managed to keep its airports operational during a ICT-Related Incident in August 2026, while attackers stole data on 8.7 million customers. Both outcomes are significan
Regulatory Obligations ManagementThe Justice Department s Criminal Division released updated compliance program guidance this week, focusing on practical questions that impact cooperation credit negotiations, declination decisions, a
Internal Controls & AuditThe Decision You re Facing Your general counsel just called. An anonymous tip alleges financial misconduct in procurement. The audit committee wants an external investigation. Someone suggests you get
Third-Party Risk ManagementWhen your Third-Party Risk Management (TPRM) program treats every vendor the same, you re either over-investing in low-risk relationships or under-managing critical ones. You need a structured way to
Ethics & ConductThe SEC received 18,354 whistleblower tips in FY2023, a 49% increase from the previous year. This isn t just a number; it s a warning that your internal reporting mechanisms might be failing. When emp
Regulatory Obligations ManagementThe U.S. Department of Health and Human Services Office of the Inspector General (OIG) has made a clear statement: compliance officers shouldn t report to legal or finance. They should report directly
