Third-party risk management is undergoing a fundamental shift. For years, companies built their programs around familiar categories—corruption risk, sanctions exposure, data privacy, financial stability, legal compliance, and reputational concerns. Those risks still matter. But they are no longer enough. Today, any serious third-party risk management program has to integrate artificial intelligence risk, cybersecurity risk, and broader technology risk into its core framework. This is no...

For years, I have consistently pushed organizations and compliance professionals to embrace technology and automated solutions as a core component of an effective ethics and compliance program. That message is even more urgent today. Let me put it bluntly: if your compliance program is not automated in key areas, you do not have an effective compliance program—by definition. The compliance environment has changed dramatically. Companies...

The U.S. government has issued significant new guidance clarifying how sanctions and export controls apply to certain oil-related transactions involving Cuba. In coordinated actions, the Office of Foreign Assets Control (OFAC) announced a new “favorable licensing policy” for specific resales of Venezuelan oil to Cuba, while the Bureau of Industry and Security (BIS) issued interpretive guidance regarding the availability of license exceptions under the Export...

As 2026 unfolds, the global cyber threat landscape is rapidly evolving — driven by accelerating attacker sophistication, geopolitical pressures, and, above all, the rise of artificial intelligence as both a tool and a target. The recently released 2026 CrowdStrike Global Threat Report highlights a stark shift: adversaries are no longer only exploiting technical vulnerabilities. They are leveraging AI to supercharge attacks, compress response windows, and...

The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) recently imposed a $1 million civil penalty against Teledyne FLIR, a U.S. manufacturer of thermal imaging cameras, for multiple violations of the Export Administration Regulations (EAR) involving exports to China and Hong Kong. The enforcement action highlights a recurring compliance challenge for multinational exporters: the complex application of the EAR’s de minimis rules, as...

Recent enforcement actions by the SEC have reinforced a message that boards and senior leadership have heard before—but too often underestimate in practice: financial reporting risk is a governance risk. When internal controls fail, disclosure judgments are compromised, or performance pressures override discipline, regulators do not view the breakdown as a technical accounting issue. They view it as an oversight failure. The lessons from recent...

In late 2025, the Securities and Exchange Commission (SEC) charged Archer-Daniels-Midland Company (ADM) and three of its former executives with accounting and disclosure fraud, in what has become one of the most significant financial reporting enforcement actions of 2026. The case underscores a fundamental compliance truth: strong internal controls and transparent disclosures are not optional — they are core risk controls that protect investors, markets,...

A real estate executive reached a $3.77 million settlement with the Office of Foreign Assets Control after OFAC accused them of violating U.S. sanctions against Syria. The person — who committed the alleged violations years before the U.S. repealed a host of Syria restrictions in 2025 — provided “managerial services” in their position as a senior official and board member of four Syrian real estate...

The Treasury Department’s Office of Foreign Assets Control (OFAC) has delivered a pointed reminder that sanctions risk is not confined to banks, multinational manufacturers, or energy traders. It extends to schools — even elite athletic boarding schools operating primarily within the United States. In a recent enforcement action, OFAC imposed a civil penalty against IMG Academy, a Florida-based athletic preparatory boarding school, after the school...

For boards and audit committees, culture should be viewed not as an abstract value but as a core internal control—often the most effective one. Traditional controls are necessary but limited. Policies cannot anticipate every scenario. Monitoring systems detect only what they are designed to see. Audits are retrospective. Culture, by contrast, governs behavior when controls are weakest: in gray areas, under pressure, and in decentralized...