Dear Ryan,
I’ve been a chief compliance officer for 14 years. I know the rules and regulations. I know what a well-constructed compliance program is supposed to look like on paper, and ours looked good. Policies current. Training completed and documented. Exception reports running on schedule. Solid written supervisory procedures (WSPs) that would make even a seasoned SEC examiner nod approvingly.
Six months ago, FINRA came in for a routine examination. It wasn’t routine.
They found a pattern of communication violations in one of our branches that had been sitting in our data for 11 months. Eleven months. Our system generated the flags, they were right there, yet they just never traveled far enough to become anyone’s problem. That is, until it became everyone’s problem.
I want to be precise about what happened because I’ve spent a lot of time being honest with myself about it. Nobody covered anything up. Nobody made a deliberate choice to look away. What happened was quieter and more insidious than that. The flags got reviewed at the branch level, assessed as manageable and resolved locally. When viewed together, over time, across multiple advisors, a pattern had clearly formed. But that never got seen by anyone with the authority or the context to recognize what it actually was.
What happened was quieter and more insidious.
The examination cost us a formal finding, a fine I’d rather not put in writing and three months of my life I’ll never get back. More than that, it cost us something harder to quantify. Two institutional clients asked questions we didn’t have clean answers to. One of them left.
What keeps me up at night is we had the tools in place to surface this. The data was right there. What we didn’t have was a culture that treated escalation as a responsibility rather than an admission of failure. At every level between the branch and my desk, someone made a judgment call that this wasn’t worth sending upward.
They weren’t wrong by the standards we’d set, and that’s a problem.
I need to make the case internally for a fundamentally different approach to how we think about surveillance. It’s not the tech. It’s the culture. But I don’t have a strong leg to stand on. I’m walking into that conversation as the person who just presided over the worst regulatory finding in firm history. How do I make that case without it sounding like I’m rewriting history to protect my own seat?
— Technically Compliant, Culturally Complicit
Dear Technically Compliant, Culturally Complicit,
Let’s start with the hardest thing first: You already know what went wrong. You said it yourself, clearly and without flinching. Instead of the standard being the standard, it was the problem. That kind of honesty is rare in a boardroom and rarer still from someone sitting where you’re sitting right now. Don’t waste it.
Here’s how to reframe the internal conversation.
You’re armed with the truth. You’re walking in with 11 months of evidence that your firm has a gap between what it believes its compliance culture is and what it actually is. Those aren’t the same talk track. One is a postmortem while the other is a strategic finding. Lead with the finding. In other words, don’t walk in saying, “Our compliance culture failed, and here’s the evidence.” Instead say, “We’ve identified an 11-month pattern showing a gap between our intended compliance culture and the one we’re actually experiencing.”
The good news is your argument doesn’t come with a price tag. You’re not arguing “we need better surveillance technology.”
That’s the wrong fight and one you’ll almost certainly lose. Tech wasn’t the problem, and everyone in your firm knows it. The argument is this: Your firm has built a culture where escalation feels like failure, and that culture is now a documented regulatory liability.
This is bigger than a compliance-process failure. It is a leadership failure expressed through compliance. Reframing it this way is the only move that gets you out from under the finding and into a conversation where you have standing.
The most expensive compliance failure in a firm’s history almost always started as something someone decided not to escalate.
The most expensive compliance failure in a firm’s history almost always started as something someone decided not to escalate. Welcome to the club. Your leadership doesn’t need to focus on how to avoid the next fine; it needs to root out why nobody between the branch and your desk believed that flagging this upward was the right call. What does the answer say about the environment your firm’s been operating in?
Lucky for you that question doesn’t belong to you. It belongs to everyone in the room.
You all didn’t preside over a compliance failure. You all presided over a culture that was never built to surface one. Your mission is to get the leadership team to understand the difference and then, most importantly, get them to own it with you.
If you walk in the room and say “here’s what I missed” you lose the room, maybe your job. But if you walk in and say “here’s what we built that made this invisible” you’ll change the conversation entirely.
Go speak the truth.
— Ryan
Ryan George is the Chief of Staff of Docupace.
