Johnny Cash was a singer for the ages — little did we know one of his great songs — Walk the Line was meant for Chief Compliance Officers.

Every CCO has (or should have) the authority to report directly to the board without informing senior management. In political parlance, this is the so-called “nuclear option.” The question is when does the CCO need to pull the trigger and go directly to the board.

I know this may sound like a cop-out but the answer is – it depends.

For a CCO, walking the dotted line to the board is a once in a career event. It better be for something important. A CCO that cries wolf and runs to the board for less than significant reasons will quickly lose credibility in the eyes of the board. In other words, the nuclear option should only be used for a nuclear problem.

What are some examples of when the CCO has to go directly to the board?

First, if senior management is directly implicated in misconduct, the CCO has to go directly to the board to respond to the situation. A recent criminal healthcare case provides an example: the CEO, CFO, GC, and other senior managers were involved in a fraud scheme and ultimately were indicted and convicted of carrying out an elaborate fraud scheme involving Medicaid funds.

If a CCO learns of the scheme, this is not a hard issue – the CCO has to walk the dotted line and report the matter quickly to the board.

Second, what if the CCO learns about a serious violation of law and knows that senior management is ignoring the problem. I call this scenario the GM problem.

Under this scenario, a CCO may learn about a serious safety hazard, like the ignition switch problem that GM experienced, and knows that the GC and other senior managers are not adequately addressing the problem, thereby exposing the company to serious risks and allowing a public danger resulting in death to innocent civilians. The question in this situation, which is a difficult one – should the CCO, first report to the CEO (who is not necessarily aware of the full scope of the problem) or should the CCO go directly to the board?

This is a difficult issue but most CCOs, I suspect, would report directly to the board given the potential harm to innocent civilians. On the other hand, some may first stop at the CEO’s office to gain the CEO’s support and then report the matter to the board with the CEO.

As you can tell from my discussion, the question of walking the dotted line should be reserved for serious issues. That does not mean the CCO should not interact with the board unless there is a serious issue. I am only talking about a serious situation where the CCO decides to circumvent senior management and an existing hard-line reporting responsibility.

In many companies, the CCO has informal discussions and communications with board members, including the audit chair. Some board members explicitly tell the CCO to come to them if the CCO has an issue. That invitation has to be respected and may be necessary to use in non-serious situations as part of an ongoing relationship between the board and the CCO. Informal communications between a CCO and the board are invaluable, just like the communications between the internal auditor and the Audit Committee.