Dear Leah,
I'm Chief Compliance Officer in a regulated company and I've just discovered that our Head of Sales has been systematically falsifying client compliance records to close deals faster.
When I confronted him, he said "everyone knows the regulators don't actually check these things" and suggested I was being "unnecessarily rigid." The worst part? Our CEO promoted him last month specifically for "streamlining processes."
I've documented everything, but I'm terrified that raising this will destroy my career - the CEO and Head of Sales have been friends for 20 years. Meanwhile, we're expecting a regulatory audit next quarter.
Do I report this internally and risk being scapegoated?
Or go straight to the regulator and potentially destroy the company?
Either way, I feel like I'm signing my own redundancy notice.
- Compliance in Crisis
Dear Compliance in Crisis,
You're not signing your redundancy notice - you're potentially saving the company from catastrophe. But I understand why it feels like career suicide when you're the only adult in a room full of people playing with fire.
DIAGNOSIS:
Your Head of Sales has confused "streamlining" with law-breaking, and your CEO has rewarded him for it. They're both gambling with the company's future because the regulator hasn't caught them yet. Classic corporate delusion where people convince themselves that rules don't apply to them until they do.
THE ROOT OF THE PROBLEM:
Commercial pressure has completely overridden regulatory and ethical obligations. Your CEO has inadvertently created a system where rule breaking is rewarded and everything else is problematic.
THE PATH TO RESOLVING IT:
Speak to Legal, then together escalate to the Chair of the Board. Frame it as protecting the company from existential risk, not attacking individuals.
If there's no independent governance route, you have a legal duty to report to the regulator who will be far more lenient if you self-report than if they discover it during a future audit.
YOUR ROLE GOING FORWARDS:
Protect yourself legally by ensuring all concerns are properly documented and escalated
Compliance officers who don't enforce compliance aren't compliance officers
Find an ally amongst the non-executive directors who can provide independent oversight
Sometimes the most dangerous thing you can do is stay quiet when you're paid to speak up.
