How Boards Can Use Compliance Consultants to Strengthen Governance Oversight
There's a scene that plays out in boardrooms across the country with remarkable regularity. The compliance update hits the agenda. A polished executive — usually the General Counsel or the Chief Compliance Officer — walks directors through a tidy presentation. Green dashboards. A few resolved exceptions. One regulatory change that legal is "monitoring closely." The board nods. The agenda moves on.
Nobody in that room stops to ask the obvious question: who checked the checker?
Every number in that presentation, every framing choice, every item quietly left off the slide — all of it came from the same management team the board is constitutionally obligated to oversee. The board hasn't received a compliance report. It's received management's preferred version of one. And in most cases, it has no way of knowing the difference.
This is the problem compliance consultants were built to solve. Not as a luxury. Not as a sign that something's already gone wrong. As basic governance infrastructure — the kind that separates boards that actually oversee from boards that merely appear to.
The Wells Fargo Problem Didn't Start With Fake Accounts
When the Wells Fargo fake accounts scandal broke in 2016, the headlines focused on the fraud itself — millions of unauthorized accounts opened without customer knowledge, a predatory sales culture that ran unchecked for years. What got less attention was the board question underneath all of it: how did directors not know?
The answer, as it typically is in these situations, wasn't that anyone lied outright to the board. It was that the information flowing to directors was curated, filtered, and framed by the very management structure that had allowed the problem to fester. The compliance function reported up through channels that had every institutional incentive to present things favorably. Independent oversight — the kind that might have caught the cultural rot earlier — simply wasn't there.
Wells Fargo is the extreme version. But the structural vulnerability it exposed isn't extreme at all. It's sitting quietly inside a large number of otherwise well-run companies right now. The board gets what management gives it, and management — consciously or not — gives the board what makes management look good.
Compliance consultants, engaged directly by the board and reporting to the audit committee rather than to the CEO's office, break that chain. Their entire value proposition is that they have no stake in the answer. They're not protecting a department, defending a career, or managing up. They're telling directors what's actually true about how the compliance program works — and sometimes more importantly, where it doesn't.
What "Independent" Actually Means Here
The word independent gets thrown around a lot in governance. Independent directors. Independent auditors. Independent counsel. After a while it starts to feel like window dressing.
But in the context of compliance consulting, independence has a specific and consequential meaning. It's not just about whether the consultant has a conflict of interest on paper. It's about the reporting line, the scope-setting, and who controls the findings.
Here's where a lot of boards get this subtly wrong. They decide they want an outside compliance review — good instinct — and then they ask the General Counsel to scope it and manage the engagement. The GC calls a firm they've worked with before, briefs them on what the board is looking for, and the review proceeds. The report comes back to the GC first, gets discussed with the CEO, and then a summary goes to the audit committee.
That is not an independent compliance review. That's management commissioning a report about itself and deciding what the board gets to see. The form looks right. The substance is completely compromised.
Real independence means the audit committee sets the scope. The audit committee selects the consultant — ideally through a process that doesn't run through management. The consultant has unrestricted access: to documents, to personnel at every level, to sites without advance notice if necessary. And the findings go to the board first, unfiltered, before management has had a chance to draft its response narrative.
That sequencing isn't bureaucratic formality. It's the entire point.
Three Places Compliance Consultants Actually Change the Game
When a company is growing faster than its controls.
Fast growth is one of the most reliable predictors of compliance failure. Companies that double in size over three years — through acquisition, geographic expansion, or rapid hiring — almost never scale their compliance infrastructure at the same pace. The policies written for a 500-person company don't automatically work for a 2,000-person one. The third-party risk management process that worked when you had 40 vendors doesn't hold when you have 400.
Boards of fast-growing companies should be commissioning independent compliance assessments not because they think something is wrong, but because growth creates gaps faster than internal teams can see them. An external consultant coming in with fresh eyes and a structured methodology will find things that have been invisible simply because everyone inside the organization has been too busy running to notice.
Before a major transaction closes.
M&A due diligence has gotten sophisticated on the financial side. Most deal teams will forensically examine the target's revenue recognition, working capital dynamics, and debt structure. What gets less rigorous attention — consistently, across the industry — is compliance.
That's a serious problem, because compliance liabilities don't stay with the seller after the deal closes. They transfer. An acquired company's FCPA violations, data privacy failures, or unresolved regulatory investigations become the acquirer's problem the moment the ink dries. Boards that allow transactions to close without independent compliance due diligence are accepting liability they haven't priced and may not fully understand.
The fix isn't complicated. It's commissioning a compliance-specific review of the target, scoped and overseen by the board's independent counsel, before signing. The findings either get priced into the deal, addressed through representations and warranties, or in some cases, become a reason to walk away. All three outcomes are better than discovering the problem eighteen months post-close.
After something goes wrong.
This one should be obvious but it's consistently underdone. When a compliance failure surfaces — a regulatory enforcement action, a significant internal investigation finding, a material control breakdown — the instinct is to fix the specific problem and communicate that it's been addressed. New policy. Retraining. Disciplinary action. Done.
The harder and more important question is whether the specific failure was a symptom of something broader. Was this a one-off mistake, or does it point to a structural weakness in how the compliance program is designed? Are there three more problems sitting adjacent to the one that surfaced?
A compliance consultant brought in post-incident, reporting directly to independent board counsel rather than to management, can answer that question honestly. And the answer to that question determines whether the fix actually fixes anything — or whether the board is simply waiting for the next version of the same problem.
The Question Boards Aren't Asking
There's a deeper issue underneath all of this. Most boards evaluate their compliance programs by asking: are we in compliance? Meaning — do we have the policies, the training programs, the documented procedures?
That's the wrong question. The right question is: does our compliance program actually work? Meaning — if someone at this company saw something wrong tomorrow morning, would they know how to report it? Would they trust that reporting it wouldn't end their career? Would that report make it to people with the authority to act on it, quickly enough to matter?
Those questions don't get answered by looking at a policy manual. They get answered by talking to people at every level of the organization — frankly, under conditions where they feel safe being honest — and by testing the actual escalation paths rather than just documenting that they exist.
That's the work compliance consultants do when they're deployed well. It's uncomfortable. It produces findings that don't fit neatly on a green dashboard. And it's exactly what serious board oversight looks like in practice.
The boards that will face the hardest questions in the next regulatory cycle — from the SEC, from institutional shareholders, from plaintiff's attorneys — are the ones that treated compliance oversight as a presentation they received rather than a function they independently verified.
The ones that won't? They stopped asking management how well management was doing its job. They brought in someone whose only obligation was to tell them the truth.
That's not a revolutionary governance insight. It's just what oversight actually means.
Comments