By: Natalie Johnson
Boards in regulated industries have never had more evidence that their compliance programs are working, and never less certainty that the evidence means anything. Training completion rates clear 95 percent. Audits pass. Policy libraries grow. Then a supply chain seizes up, a regulator moves on artificial intelligence (AI), or an issue half the organization knew about surfaces in a way nobody can control. Teri Cotton Santos, a compliance and governance leader who has spent her career inside highly regulated businesses, argues that the gap comes down to one word boards rarely use when questioning management: resilience. Not whether the program ran, but whether it can see what is coming and move first.
Compliance Resilience
Resilience, as Cotton Santos defines it, is the capacity to anticipate rather than report. Most compliance updates to boards look backward at last quarter’s activity. A resilient function adapts, learns from its industry and the enforcement environment, and uses data to improve rather than merely administer. Hotline reporting is a case in point: the useful question is not how many calls came in, but what the issues reveal about leadership, culture or training, and how to keep the same root cause from surfacing elsewhere.
Constructive Challenge: An Essential Element of Good Governance
Ask Cotton Santos what the most important question a board should ask about itself is, and she starts not with risk registers but with the social dynamics of the room. “Have we created an environment that supports asking difficult questions or raising opposing views? Constructive challenge is essential to good governance,” she says, before sharpening the point. The real danger is comfort. “You get into a cadence about being comfortable, and that can get you in a really dangerous place because you run the risk of making untested decisions and missing opportunities, and that is where governance can really break down.”
Her remedy is transparency, as an operating condition rather than a value statement. A board can only challenge what it has been told. “It is a culture where management is conditioned to deliver difficult information so that the board can have a full picture,” she says, “a culture where employees feel empowered to speak up without fear of retaliation or fear that their concerns will not be taken seriously.” That makes culture a governance matter, and a measurable one. Surveys, exit interviews and performance feedback tell directors what a controls dashboard cannot. Her test is blunt: do people believe leaders have high integrity, or that leaders do whatever they want and nobody is held accountable? “If it is the latter, it is going to be much harder to get compliance and adherence.”
The Difference Between Activity and Effectiveness
The most common failure Cotton Santos sees in regulated industries is not negligence. It is confusing proof of work with proof of effect. Documentation becomes the deliverable; passing the audit becomes the objective. “A lot of times there will be a focus on how many employees completed their training on time, and not enough of a focus on, well, how effective is that training,” she says. “Are they able to draw on that knowledge in real time?” Policy suffers the same way. Some organizations treat having a policy for everything as evidence of good governance, without asking whether employees can find, read or use it. She has seen 30-page policies written in legalese. Nobody wades through 30 pages to learn the value threshold for a vendor meal.
The gap widens in global organizations, where a policy written in English for head office quietly fails everyone working in another language. Having a policy is the baseline; a policy employees understand and turn to is the point. The deeper error is borrowing peer policies without right-sizing them to the company’s own business model and risk. “We think we are covered because we have done certain things, but we really have not right-sized them for our organization.” For directors, this turns a reporting habit into a test. When management presents a compliance metric, the follow-up is not whether the number improved, but what it is supposed to prevent, and whether it is preventing it.
Governance, Compliance Resilience and Emerging Risks
Emerging risks can present unique challenges for both governance and compliance programs. AI is a clear example of this because it is moving faster than the rules. Regulators are still working out how to govern it. In the meantime, the companies building and using AI are setting their own standards, which could become the foundation of future regulation. Cotton Santos treats this as regulatory intelligence rather than a vacuum. A resilient compliance function watches where those standards are heading and helps the business get ahead of the change, rather than waiting for rules to arrive. For boards, good oversight of an emerging risk does not require the board to master the technology, but to understand whether management has a system for governing it. Her questions are structural: how is the organization systematically ensuring responsible use, and how is it monitoring and mitigating the risks? Absent a systematic answer, she says, “that is an unmanaged risk.” For boards, that is the real measure of compliance resilience: not whether the organization has responded to today’s rules, but whether it has the systems to govern risks that tomorrow’s rules have not yet named.
Readers can find more insights on compliance resilience, board oversight, and governance in regulated industries on Teri Cotton Santos’s LinkedIn profile.
