Courage – Every Virtue at the Testing Point

When I was conducting perhaps my fifth compliance program assessment ever, more than twenty years ago, a compliance officer told me a story that has stayed with me ever since. I will try to retell it in a way that does justice to that CCO:

Sometime ago, the company’s audit team had discovered an underpayment of hourly workers to the tune of millions of dollars. The legal department brought in outside counsel to conduct an investigation.

Outside counsel advised the company to do nothing and allow the statute of limitations, which was about to expire, to run. That would have saved the company a substantial amount of money. The General Counsel, to whom the CCO reported, agreed with outside counsel, and the company decided on that course of action.

The CCO disagreed. She argued that not telling employees about the underpayments would violate the company’s code of conduct and be inconsistent with its values. When she could not persuade her boss, she told him that she would raise the issue with the board of directors, and she did exactly that. The company then changed course.

When I met her, this CCO was still employed at that company, still had the same boss, and was, by all accounts, beloved. And, oh my goodness, did that woman have the courage of her convictions. Her story brings to mind a wonderful line from C.S. Lewis’s The Screwtape Letters: “Courage is not simply one of the virtues but the form of every virtue at the testing point, which means, at the point of highest reality.” Yes, integrity matters. And fairness, and judgment, and curiosity, and humility, and kindness. But without courage, the CCO will falter when the program needs her most, whatever her integrity, judgment, or other virtues. Courage is what turns those virtues into action when they are tested.

A few years ago, during an assessment, I came across another compelling story. The CCO in that company sat several levels further down in the organization than he should have. The company was dealing with a sensitive investigation involving senior leaders. Outside investigations counsel, reporting to the board, reached a conclusion the CCO disagreed with. He took his concerns back to outside counsel, leadership, and the board. Leadership was dug in, and the advice of outside investigations counsel carried considerable weight. Still, he kept pressing, respectfully and with admirable finesse, for an outcome consistent with the company’s values and code of conduct. That took so much courage. The CCO didn’t prevail, but he earned the admiration of the leadership team, the board, and, most definitely, the company’s compliance lawyer.

I have seen similar tenacity in CCOs who maintain appropriate levels of third-party due diligence and other anti-bribery controls despite headwinds against those efforts. This work can mean explaining repeatedly why a safeguard remains necessary or resisting pressure to turn a meaningful review into a formality. These leaders look for ways to make controls practical and proportionate while insisting that they continue to address the risks they were designed to manage. Their commitment is evident in their willingness to make that case again and again, when it would be so much easier to acquiesce.

The consequences can be personal. Compliance officers work alongside the people whose conduct they may need to question. They rely on those relationships to do their jobs. They also have careers and families, and understandable concerns about how they will be perceived. Feeling that pressure is not a failure of courage; courage is staying true to your values in spite of it.

For chief compliance officers, C.S. Lewis’s observation has particular resonance. We talk a great deal about the importance of integrity and candor in leading a compliance program. Courage is what allows us to act on those commitments when doing so becomes difficult. An honest assessment of a program is relatively easy to deliver when the findings are welcome. The test comes when a significant finding contradicts the reassuring account management would prefer to give the board.

It takes judgment to know when courage is called for. A CCO needs to understand the facts, listen carefully to competing explanations, and distinguish a material concern from a disagreement over how best to implement a control. Knowing the business helps the CCO find workable solutions and explain why the issue matters. A private conversation may give a leader room to reconsider. Sometimes, though, waiting risks leaving a serious concern unaddressed, and the CCO needs to escalate promptly.

In both of my examples above, the CCOs had the courage to act with integrity under pressure. It can also take courage to reconsider our own position. That calls for the curiosity to ask what we might have missed and the humility to admit when we got it wrong. A CCO may need to revise an initial assessment or rethink a control that imposes burdens without meaningfully reducing risk. That openness helps preserve credibility for the occasions when we do need to hold firm.

Some of the hard work can be done before a testing point arrives. Clear escalation procedures and regular opportunities for candid discussion with the board can make it easier to bring forward a difficult issue. Relationships with colleagues in other functions can help the CCO understand a concern and secure support for addressing it. Discussing expectations in advance reduces the need to negotiate the CCO’s authority in the middle of a disagreement.

The organization has responsibilities here as well. Boards and senior leaders should give the CCO meaningful access and authority, welcome good-faith disagreement, and support employees who raise concerns. They should also be prepared to act on unwelcome information. A program that depends on the CCO repeatedly risking her career to get a serious issue heard has a governance problem that greater personal courage alone will not resolve.

I often think of that CCO from all those years ago. She remains a personal hero of mine. And I think about the employees whose wages were at stake, who will likely never know what she did on their behalf. When honoring the company’s values carried a substantial cost, she insisted that those values guide the decision. I see that same resolve in CCOs today, in their willingness to keep pressing with judgment and tenacity when others would prefer to move on. That is courage at the testing point: insisting that the company’s values govern its choices precisely when doing so is hardest.