By Adam Turteltaub

Executive presence isn’t simply walking in the room and having everyone instantly feel that that you are in charge.  It is something different explains Jay Greenberg, the recently retired Chief Compliance Officer at the FBI.  Instead, it is being powered by your core values and then making a maximum positive contribution to any situation by fully investing yourself to achieving that assigned mission.

Executive presence, he shares, is a skill acquired through the application of experience, coupled with a great deal of self-reflection that focuses on self-confidence, core values and the help of mentors.

Also of great value: preparation and confidence that is informed by past experiences, including failures.  Even star leaders didn’t magically emerge, he reminds us.  They learned from their failures, missteps and other learning experiences.

It doesn’t matter, he explains, if you are working with leadership or rank and file employees.  Know your core values, who you are, your positive character traits and focus ahead of time.  It will help you feel self-contained and confident.  He also advises keeping a bit of mental distance, being both a participant and an observer at the same time.  It will help you tailor your approach to the outcome you want.  Also, be sure you understand the perspective of your audience.

Listen in to learn more about how you can master the skills of executive presence.

By  Adam Turteltaub

Listen up people:  It’s all about the people.

That’s the key message from Gabor Sulyok, Global Head of Commercial and Healthcare Compliance at BioNTech and experienced senior compliance counsel Luciane Mallmann.

At its core, ethics and compliance is a human endeavor. While regulations and standards provide the structure, it’s the people within an organization who bring these principles to life. A people-centered approach to compliance programs enhances engagement, supports better decision-making, and fosters a culture of integrity. From design to execution, every aspect of the program should reflect a deep understanding of how people learn, behave, and interact.

This means rethinking how we educate, maintain awareness, and ensure accountability. Policies must be relatable and actionable. Training should be immersive and role-specific. And accountability should be balanced with support to avoid creating a risk-averse culture.

They explain in the podcast that there are three key elements of a people-centered framework:

Speak-Up Culture A healthy program starts with psychological safety. Employees must feel empowered to raise concerns without fear of retaliation.

Transparency and Accountability Transparency builds trust. Training should include real-life ethical dilemmas and storytelling that resonates with employees. Sharing actual cases from within the company helps humanize compliance and makes it more relatable. Accountability, meanwhile, must be visible and fair. Leaders should model ethical behavior and be the first to complete training, setting the tone from the top.

Ethical Decision-Making  Decision-making frameworks should incorporate diverse perspectives and encourage thoughtful deliberation. Employees need tools to navigate ambiguity, and those tools must be grounded in the organization’s values.

Listen in to learn more about how to put people front and center in your ethics and compliance program.

By Adam Turteltaub

The rise of generative AI has brought transformative potential to healthcare—from streamlining administrative tasks to supporting clinical decision-making. But alongside these benefits comes a growing concern: Shadow AI. Alex Tyrrell, Chief Technology Officer, Health at Wolters Kluwer explains in this podcast that this term refers to the use of unauthorized, unmonitored AI tools within organizations. In healthcare, where data privacy and patient safety are paramount, Shadow AI presents a unique and urgent challenge both now and in the future.

Healthcare professionals often turn to generative AI tools with good intentions—hoping to reduce documentation burdens, improve workflows, or gain insights from complex data. However, many of these tools are unproven large language models (LLMs) that operate as black boxes. They’re prone to hallucinations, lack transparency in decision-making, and may inadvertently expose Protected Health Information (PHI) to the open internet.

This isn’t just a theoretical risk. The use of public AI tools on personal devices or in clinical settings can lead to serious consequences, including:

Privacy violations

Legal and regulatory non-compliance

Patient harm due to inaccurate or misleading outputs

Despite these risks, many healthcare organizations lack visibility into how and when these tools are being used. According to recent data, only 18% of organizations have a formal policy governing the use of generative AI in the workplace, and just 20% require formal training for employees using these tools.

It’s important to recognize that most employees aren’t using Shadow AI to be reckless—they’re trying to solve real problems. The lack of clear guidance, approved tools, and education creates a vacuum that Shadow AI fills. Without a structured approach, organizations end up playing a game of whack-a-mole, reacting to issues rather than proactively managing them.

So, what can healthcare organizations do to address Shadow AI without stifling innovation?

Audit and Monitor Usage

Start with what you can control. For organization-issued devices, conduct periodic audits to identify unauthorized AI usage. While personal devices are harder to monitor, you can still gather feedback from employees about where they see value in generative AI. This helps surface use cases that can be addressed through approved tools and structured programs.

Procure Trusted AI Tools

Use procurement processes to source AI tools from vetted vendors. Look for solutions with:

Transparent decision-making processes

Clear documentation of training data sources

No use of patient data or other confidential information for model training

Avoid tools that lack explainability or accountability—especially those that cannot guarantee data privacy.

Establish Structured Governance

Governance isn’t just about rules—it’s about clarity and oversight. Develop a well-articulated framework that includes:

Defined roles and responsibilities for AI oversight

Risk assessment protocols

Integration with existing compliance and IT governance structures

Make sure AI governance is not siloed. Those managing AI tools should be at the table during strategic planning and implementation.

Educate and Engage

Education is the cornerstone of responsible AI use. Employees need to understand not just the risks, but also the right way to use AI tools. Offer formal training, create open forums for discussion, and build a culture of transparency. When people feel informed and supported, they’re more likely to choose safe, approved tools.

Protect PHI with Precision

In clinical workflows, PHI is often unavoidable. That’s why it’s critical to:

Deidentify patient data whenever possible

Ensure only authorized systems, processes, and personnel have access to PHI

Maintain up-to-date business associate agreements and data processing contracts

By Adam Turteltaub

There are few parts of an investigation that are more stressful than the interview with the investigation’s subject.  Done right it can close all the loops.  Done wrong, everything can unravel.

To learn how to handle things best we turn in the second of our two podcasts on investigations to Wendy Evans, Senior Corporate Ethics Investigator, Lockheed Martin and Georgina Heasman, Senior Manager, Global Investigations at Booking Holdings.  The two of them are the co-authors of our new book Fundamentals of Investigations:  A Practical Guide  and lead our Fundamentals of Compliance Investigations Workshop.

In this podcast they offer a host of great insights including:

While it’s generally best to interview the subject last, there are times, such as in cases of alleged harassment or data theft, where you likely will need to sit down for a preliminary interview sooner

Be sure to get a read on the subject and be respectful of the stress that they are under, including giving them psychological space before asking tough questions

Clarify your role in the process as a collector of facts and that you have not already decided that they are guilty

Invite them to share their perspective both in the interview and, if other things come to mind, afterwards

Remind them of the confidentiality of the process and the need to focus on the allegation, not who made it

Listen in to learn more, and be sure to investigate their book Fundamentals of Investigations:  A Practical Guide  and the Fundamentals of Compliance Investigations Workshop.

By Adam Turteltaub

Few people know more about conducting a compliance investigation than Georgina Heasman, Senior Manager, Global Investigations at Booking Holdings and Wendy Evans, Senior Corporate Ethics Investigator, Lockheed Martin.  The two of them are the co-authors of our new book Fundamentals of Investigations:  A Practical Guide  and lead our Fundamentals of Compliance Investigations Workshop.

Not wanting to miss out on their expertise, we scheduled two podcasts with them.

In this, the first of the two, they share a broad overview of best practices for conducting investigations.  Those include ensuring that even compliance team members not responsible for investigations have at least a fundamental understanding of them.

As for the investigation itself, they explain, to go well it begins with the first report.  There has to be a clear line of communication and a culture that encourages employees to come forward.

Once you receive that initial contact, it’s important to remember that it tells the story only from one side. You need to ask questions to clarify what was seen and heard and start thinking about what other information you will also need to gather.  To keep the information flowing, they recommend telling the reporter and everyone else you interview to reach out to you again if additional information comes to mind.

While testimonial evidence is invaluable, don’t stop there.  As you gather the who, what, when and where, be sure to look for the documentary evidence that you need, which requires having strong relationships with departments that have it, such as HR and security.

And, throughout the process, stay focused to avoid going down rabbit holes or getting inundated with more information than you need.

Listen in to learn more, and be sure to check out Fundamentals of Investigations:  A Practical Guide  and the Fundamentals of Compliance Investigations Workshop.

By Adam Turteltaub

Uh oh.  The Feds are in the front lobby with a search warrant.  Things are bad, and you don’t want anyone on site to make it worse.

The secret is preparation, shares Veronica Xu, SCCE & HCCA Board Member and Chief Compliance Officer, HIPAA Privacy Officer, ADA Administrator at Saber Healthcare Group.  That begins with establishing a cross-functional team that likely includes compliance, the general counsel, CEO, CTO and, depending on your industry, the chief medical officer and others.

Each should play a part in shaping the plan and be ready to play their part if a raid occurs.

In addition, onsite staff, right down to the receptionist, needs to understand their responsibilities, including whom to call for help.  Not only will that avoid very costly mistakes, it will help reduce errors, fear and stress at what will likely be an extremely difficult time.

What an individual gets trained on will vary by role.  Yet, there is one commonality to the training.  Everyone needs to know the importance of staying calm, being polite and respectful.

Be sure to also outline the do’s and don’ts.

There’s one other thing she strongly advises: remember to communicate with your workforce.  Be as transparent as possible and avoid conflicting messages.  That will keep the lines of communication open and help avoid the speculation that can make the disruption even worse.

Listen in to learn more, and then take a fresh look at your current plans for responding to a government raid.

By Adam Turteltaub

Employees may trust an AI chatbot more than they trust you, and that’s not necessarily a bad thing, if it leads to more reporting.

In this podcast, Debbie Sabatini Hennelly, Founder & President of Resiliti shares that  a recent survey conducted by CaseIQ reveals that nearly 70% of respondents expressed no concerns about AI being involved in the helpline process. This openness is driven by several key factors: increased anonymity, ease of use, and a perception that AI offers a fairer, more impartial experience than speaking directly with a human.

These findings underscore a broader theme that continues to emerge in conversations about helplines: trust. Employees are more likely to report concerns or misconduct when they trust the system—when they believe their information will be handled confidentially, their identity protected, and their report taken seriously.

Not surprisingly, they also want to understand how their information is being used and how their anonymity is being safeguarded. This is especially important when helplines are outsourced to third-party vendors. Communicating clearly that the helpline is external—and therefore more secure and impartial—can go a long way in building trust.

But transparency doesn’t stop there. Employees also want to know what happens after they make a report. What’s the process? What can they expect next? Setting clear expectations and following through with updates helps reinforce that the organization is responsive and serious about addressing concerns.

It’s not enough to share this information only once a year during compliance training, she warns. Employees are constantly bombarded with messages and unless helpline communication is consistent and visible, it risks being forgotten or ignored.

Still, even with those reminders, barriers remain, especially fear of retaliation.

Organizations must address this head-on. First, there must be a clear, well-communicated prohibition against retaliation. But more importantly, leaders need to understand that retaliation isn’t always overt. It can be subtle—being passed over for key assignments, being excluded from team activities, or receiving the cold shoulder from colleagues.

Creating a culture where employees feel safe to speak up starts with leadership. Managers and executives must model the right behaviors, reinforce anti-retaliation policies, and foster an environment where concerns are welcomed, not punished.

One of the most critical—and often overlooked—elements of a successful helpline program is training leaders on how to respond when a report is made. Too often, well-meaning managers try to “get to the bottom of it” themselves. But when they start asking who reported what or conducting their own informal investigations, they can unintentionally obstruct the formal process and make employees feel unsafe.

A favorite tactic of hers for addressing this is to ask persistent leaders: “Do you want to be a witness and be deposed?” It’s a powerful reminder that involvement in an investigation has consequences—and that the best way to support the process is to let it unfold professionally and confidentially.

Listen in to learn more, and, hopefully, get employees to trust and speak-up more.

By Adam Turteltaub

If all you’re worrying about is tone at the top, you’re missing a key portion of the choir.  With most people reporting to middle managers, they play in integral role in ensuring a culture of compliance and ethics truly permeates the organization.

Evie Wentink, Senior Compliance Consultant at Ethical Edge Experts observes that while many organizations invest in crafting comprehensive codes of conduct and articulate expectations for ethical leadership, they often fall short in equipping managers with the tools, training, and support necessary to fulfill those expectations. This gap can undermine the effectiveness of compliance efforts and leave companies vulnerable to ethical lapses.

At the heart of the issue is a lack of intentional communication. Middle managers are frequently expected to embody and promote ethical leadership, yet they are rarely given a clear understanding of what that entails. To bridge this gap, organizations must develop structured plans that define ethical leadership in practical terms. These plans should include specific deliverables, resources, and expectations tailored to the manager’s role. By doing so, companies can ensure that managers are not only aware of their responsibilities but also empowered to carry them out effectively.

Authentic, ongoing conversations led by these managers are a cornerstone of a successful compliance culture. These discussions should not be limited to formal training sessions or annual reviews. Instead, they must be woven into the fabric of everyday operations. Managers should be encouraged—and required—to initiate “ethics or integrity minutes” at the start of team meetings. These brief segments provide a consistent opportunity to address ethical topics, reinforce values, and normalize open dialogue about compliance issues.

To support these conversations, organizations should provide managers with practical tools. These might include:

Ethics spotlight cards that highlight key compliance themes.

News articles that can be used to spark discussion around real-world ethical dilemmas.

Access to updated policies and codes of conduct, with notifications when changes occur.

Tracking and analyzing these conversations is equally important. Compliance teams should maintain records of who is engaging in discussions, what topics are being covered, and which issues are generating the most questions. This data can be invaluable in identifying risk areas, refining training programs, and tailoring future communications. Often, the most common questions arise immediately after a training session, indicating that such moments are prime opportunities for deeper engagement.

Moreover, it’s essential to recognize the broader impact of middle management on organizational integrity. Prosecutors and regulators increasingly view middle managers as pivotal figures in corporate misconduct cases. Their actions—or inactions—can significantly influence whether a company succeeds or fails in maintaining ethical standards. Consequently, fostering a culture of accountability and proactive communication at this level is not just beneficial—it’s critical.

Ultimately, the goal is to create an environment where ethical conversations are natural, frequent, and valued. When managers consistently lead by example and facilitate open dialogue, employees become more comfortable raising concerns and asking questions. This cultural shift enhances transparency, reduces risk, and strengthens the overall integrity of the organization.

In summary, bridging the compliance gap at the middle management level requires a multifaceted approach: clear expectations, practical tools, authentic conversations, and ongoing tracking. By investing in these areas, organizations can transform their compliance programs from static documents into dynamic, living systems that truly support ethical behavior at every level from the top on down.

By Adam Turteltaub

Why did the AI do that?

It’s a simple and common question, but the answer is often opaque, with people referring to black boxes, algorithms and other words that only those in the know tend to understand.

Allesia Falsone, a non-executive director of Innovate UK, says that’s a problem.  In cases where AI has run amok, the fallout is often worse because the company is unable to explain why the AI made the decision it made and what data it was relying on.

AI, she argues, needs to be explainable to regulators and the public.  That way all sides can understand what the AI is doing (or has done) and why.

To create more explainable AI, she recommends the creation of a dashboard showing the factors that influence the decisions made.  In addition, teams need to track changes made to the model over time.

By doing so, when the regulator or public asks why something happened, the organization can respond quickly and clearly.

In addition, by embracing a more transparent process, and involving compliance early, organizations can head off potential AI issues early in the process.

Listen is to hear her explain the virtues of explainability.

By Adam Turteltaub

Despite being a Civil War era statute, the False Claims Act (FCA) always has something new going on.  To find out what’s hot these days, we spoke with Joshua Drew (LinkedIn), a former federal prosecutor and chief compliance officer and currently a Member at Miller & Chevalier.

Lately, he explains, there has been a steady stream of activity.

May:  The Civil Rights Fraud Initiative was announced by the administration and proposes to use the FCA against any federal funding recipient that it believes are operating DEI initiatives that violate antidiscrimination laws.

July:  A new working group was created between the DOJ and HHS to focus on healthcare and life sciences.  It encouraged whistleblowers to file action in areas such as Medicare Advantage, drug device and biologics pricing and barriers to patient access, amongst others.

A trade task force was created to encourage whistleblowing against tariff violators.

All of this occurs against a backdrop of activity by the Administration to identify and fight waste, fraud and abuse.

Listen in to learn more about where the Administration is focusing and what compliance teams can learn from recent actions.