Are ESG questionnaires making due diligence worse?
Longer questionnaires can make diligence look more complete while pushing teams away from the few questions that would actually change an investment decision.
Writing
Writing on integrity risk
Context, culture, controls and the difficult decisions behind integrity-risk work.
114 archive entries available.
Why do companies have anti-bribery policies but no useful fraud framework?
Fraud is often treated as either finance's problem or a legal category, when it should be managed as a practical operating risk across the business.
Why does investment change a company's integrity risk?
Investment does not just reveal risk. It can create new pressure, visibility, decisions and dependencies that change what investors need to check before close.
The inverse correlation between ethical volume and action
Why the loudest voice on ethics might be worth watching for all the wrong reasons (and what to do about it)
What Should Operating Partners Look for in a Post-Investment Integrity Review?
A practical first-100-days guide for operating partners who need to work out where integrity risk really sits after investment.
How Should Investors Assess Third-Party and Distributor Risk Before Investment?
A practical way to judge whether third parties, distributors and intermediaries create a real integrity risk before you invest.
Intentions vs. Perception: The Friction Sabotaging Founders and Leaders
Auditing your true priorities under pressure, how to stop avoiding uncomfortable conversations, and match behaviour to ambition.
Integrity Due Diligence Checklist for Impact Investors
A practical checklist for deciding where integrity risk is likely to sit before you invest, and which questions are worth asking next.
Integrity Red Flags in Founder-Led Businesses Before Investment
Founder-led businesses can be impressive, fast-moving and high-potential. They can also hide risk in plain sight. Here are the signs worth probing.
What the UK's Failure to Prevent Fraud Offence Means for Portfolio Companies
A plain-English guide to when the offence is likely to matter, what investors should ask, and why smaller businesses should not ignore it.
How bad guys 'get away with it' - shame edition
The fear of looking foolish may be one of the fraudster’s most effective protections
The pool fart lesson in investigations
A stomach-churning allegation during a swimming lesson for primary-schoolers serves up some lessons about truth-seeking in contexts where it's one person's word against another.
Should I get a cut for introducing you?
Referrals, networks, net worths, and when is a favour more than a favour - lessons from investors, connectors, and trial-and-error.
The three Cs
This week I read a fascinating white paper about the utility of behavioural analysis in the AI era. Right after, someone pitched me on LinkedIn about their software that apparently reads micro-expressions.
Why don't leaders want to save money?
Earlier this year, I asked why most firms (growth-stage and beyond) *have* bribery, corruption, and sometimes money laundering frameworks, but none for other types of fraud we know to be more common (see chart from the ACCA combatting fraud survey below).
Who to cultivate and who to weed out?
In various parts of our property, weeds take hold at this time of year.
Trust your gut
The best, and worst, advice, depending on context, experience, and insight. When should we rely on instincts?
Knowing How, Knowing Whether
How do you navigate that moment in a career when people stop asking what you know and start asking whether it makes sense?
Read the Land like a Farmer
What a 1950s farmer knew about risk that we can all still learn from. Keyline design meets the environment as it is, and we adapt. Risk management needs to do the same.
The Three Towns and The Frontier
There’s an island. It’s big enough to get lost in but small enough to be familiar. Here you’ll find three towns, each very different, and each with a jetty from where you can make “the crossing.
Grow what wants to survive
We have a smallholding near the south coast of England. The main challenge (contrary to popular belief) is not rain (we get less of that than Sydney), but wind.
Lying, deception, misleading, withholding, omitting... where do we draw the line on truthfulness?
This week, the UK's beleaguered prime minister faced a testy exchange with opposition members of parliament when defending his decision to hire trouser-phobic, Epstein buddy, and self-styled 'Prince of Darkness', Peter Mandelson.
Feedback fakery
It's not uncommon to see customer ratings and reviews in pitch decks. A tangible testimonial from a real person (i. e. , verifiable) is useful.
Governance and junior risk people
Governance is a word I'm hearing a lot more. Sometimes, in the technical (ISO) sense, but more when discussing power dynamics.
What We're Seeing: AI Red Teams and Sneaky Sleuths
Recent examples from integrity work, from insider trading signals to AI red-teaming and risk communication.
Fraud, Roadworks, and Investing
On my way to the dentist today, what should have been a 15-minute drive took nearly 30. Not a biggy, but by the third set of temporary traffic lights, it was a little tedious.
Proudly sport those peacock feathers
From Herd Mentality to Peacock Power: Rethinking Risk
Anthropomorphizing Risk
Anthropomorphism is a term that refers to attributing human characteristics to non-human entities, such as objects, animals, or deities.
Power Partners
Over the years, we have collaborated on various projects with multiple partners. Some are long-term strategic partnerships, characterised by trust, experience and respect.
System of a Down
How much of what you learned in school (or university) do you use? How much of what our kids learn now will they use?
Changing content for changed times
From TikTok to Talent Code: Rethinking How We Learn and Lead # Changing content for changed times
TI BI Tool
Shameless cross-posting from my LinkedIn article yesterday, because this is important and we're very proud of it!
Time to Think Like a Criminal Profiler?
From Mindhunter to Risk Hunter: Profiling for Compliance Professionals # Time to Think Like a Criminal Profiler?
Dull and Dutiful Due Diligence
"We invest in people who know their markets, that reduces the risk. But we also do KYC [know your customer] checks. "
Your Organisation Needs You
Earlier this week, I was on a panel at the Association of Certified Fraud Examiners Europe event. My role (on the panel) was to discuss risk assessment and the behavioural side of cybersecurity.
Sustainability, that'll never catch on
You've probably seen articles discussing how organisations fail to report on impact (fully or accurately). That's not a topic we can address in a newsletter.
Personal shopping... for risk support
Last week, I met with a friend who left a very high-profile role in-house (head of risk, compliance, sustainability at an S&P 500) to start a company that helps other in-house folks get the right tech providers.
Risk Assessment, Gap Analysis, or Benchmark?
On 12 March, I'll run an SCCE session around conducting practical risk assessments. Last week, I had to develop the dreaded blurb about why people should attend.
Bribe, Bribe, Bribe, Baby!
So, corruption is cool again. Not so fast!
Why do we need that again?
This time last year, I finished writing "20 Risk & Sustainability Tactics That Halve Risks, Improve Impact, & Deliver Value. " What on earth prompted me to write yet another detail-packed paper?
Declaring & Diagnosis
Two things usually happen when doing the diligence before investing in, appointing, or otherwise engaging a third-party.
Shikake (Not a Type of Mushroom)
Shikake (not a mushroom I once saw inadvisably put in a sandwich) is a Japanese word that literally means a device or system but describes using design to shape behaviours subtly.
How to Spot Biases that Undermine Assessments
We've been testing a co-authored tool (and accompanying guidance) to help organisations conduct risk assessments and due diligence. One challenge in smaller or mid-cap organisations is "where to start?
Year in Review
Over Christmas, I took some time off. It was a necessary break. My wife also runs a business, and we've not taken time off since March 2020.
Boxing Day Bargains
In 1996-97, I worked odd jobs to save money for university. On this day (Boxing Day) in 1996, I was ordered to be in the clothing store I was temping at by 6am.
Crime & Punishment
What better topic as Christmas nears (for many of us) than the vengeful Santa? I was contemplating introducing the spectre of Old Testament Santa when No.
Journeys & Avatars
In some organisations, risk is a journey; in others, it's constant. There is no "best practice" risk (or compliance) framework in this context.
Prevent, Detect, Respond
Some of you may remember former US Secretary of Defense Donald Rumsfeld's speech about "known unknowns and unknown unknowns. " It was widely parodied but stuck with me.
Asking difficult questions
Back in the 2000s, "discreet enquiries" were all the rage. Due diligence was a festival of smokes & mirrors. Providers would "tap into our source network.
Can't get passed the 'ick'
"The ick" is a common phrase in our household. The almost fourteen-year-old uses it regularly: "Eww, that gives me the ick.
Broadcasting on different frequencies
How do we reach people who receive information differently?
Short conversations avoid costly harm
Since leaving Control Risks (in Feb 2019), where I worked extensively on political risks, I've not spoken much about political risk. That was a mistake.
Lessons in policing from tragedy
Last week, I wrote about the Grenfell Tower tragedy in London, which caused the deaths of 72 people.
Are any of our rules stupid?
I live in a country with a passionately unhelpful bureaucracy.
It's hard to find the help these days
This is more of a personal email, as I am taking a break with the family.
Not everything is a crisis
In many of your roles, you may meet people on (one of) the worst days of their lives. The person who will be fired for fraud. The person who got their device hacked.
Unfair market value
I don't like pricing projects.
Can you identify risks without assessment?
It's not a stretch to see how bribery, conflicts of interest, money laundering, and other separately legislated compliance areas might also be defined as "fraud.
Podcast preparation lessons
Yesterday morning, I was interviewed on a podcast for a risk management publication. The host supplied some talking points in advance. I usually write a few bullet points under each and have that on the second window.
Fraud prevention assessment
Fraud is dull. There, I said it. At least, that's the consensus in my family, who associate fraud with scamming texts, older people duped out of savings, and distant Wall St types fiddling numbers on spreadsheets.
Making non-retaliation realistic
Unfortunately, many of those who speak up face retaliation. One study suggested two-thirds of whistleblowers had experienced the following forms of retaliation.
How can I commit fraud, please?
How would AI commit fraud? I asked it.
80/20 principle of assessments
This week, I've been building three assessment tools (two more are in the works). The first of which is about fraud. Why this topic, and why now?
Recipe for success
Consider this: have you ever found yourself in a situation where you had to choose from a multitude of recipes, all seemingly similar? How would you decide (assuming the reviews are comparable)?
Details Matter
This week, I started on a project where investors are looking to fund renewable energy projects across four Southern African countries.
Bye-bye, best practice?
If there's one term (beyond the benighted "zero tolerance") that is holding us (risk, compliance, sustainability, etc. practioners) back, it's "best practice.
AI, ethics and another ISO
ISO standards, including those related to AI and ethics, play a significant role in risk management. In some areas (like risk management, ISO 30001 and the infosec heavy ISO 27001), these standards are widely adopted.
Feedback loopy?
Do you get feedback from your *customers* (colleagues, stakeholders, or clients if you work on the advisory side)? When? How? How does it make you feel?
How much?
When you ask for feedback (as I discussed last week), sometimes what comes back surprises you. Or it does me, at least. We all hope we're good at our core job, but that's the baseline.
Who's in charge of you?
How do you decide what to focus on? Sometimes, the decision is made for us—an issue explodes, a crisis occurs, or a regulator comes knocking.
When to say no
As the 2022 football (soccer) World Cup in Qatar loomed, a UK mid-cap beer manufacturer went on the offensive. Confused? So was I.
When you know you no
I'm sure many of you have heard of the concept (and book) espousing the virtues of saying "no" more. Why should we say no more? Many people I work with are overburdened.
Pessimism may sell news, but it sucks for what we do
I'm currently working on an assessment for a healthcare disruptor in India. As they scale, they face some quite significant risks.
ESG as easy as $*&%@
ABC, as easy as 123, so goes the song. That is not true for this acronym.
Compliance booted to the back office?
Is it time to take compliance "out into the snow and put a bullet in the back of its head? " That lovely phrase was beloved of a former boss, who'd use it for any idea or strategy that hadn't worked.
Sustainably, yours
I trialled a webinar at the end of last year. It didn't feel right. So why try again?
Sustaining sustainability
With increased focus on sustainability - partly regulation (like the pithily titled EU Corporate Sustainability Due Diligence Directive) and partly stakeholder-driven (ESG to consumer demand) - where does risk sit?
Investigations - where to start
It's easy to overcomplicate and assume knowledge. For most of your colleagues, an investigation will be a rarity. They can be forgiven for being a bit confused.
Nothing compares to you?
Do you see value in being compared to other organisations? If so, what other organisations?
ESG - Evasive, Shadowy, and Garbled
Over the holidays, I got stuck into some further studies - ESG.
"Santa won't fit"
Our six-year-old is a creature of logic. We don't have a chimney. We have a wood-burning stove where the flume is about the circumference of a medium-sized cooking pot.
Year not in review
I imagine your inbox is peppered with annual wrap-ups around now.
Should we gamify learning?
Pre-Covid, I delivered a lot of training. During Covid, as the in-person work (reliant on travel) went off a cliff, I moved to developing training and delivering remotely.
(Almost) Year End Reflections
I recently read some excellent questions to reflect on work (professional life). I'll try to answer them. If you do likewise, see if they help you as much as it did me.
Swings and roundabout ways of problem-solving
It's tricky to know when you'll need help. What form should this assistance take, and where to go (or who to ask).
Self assessmentality [sic]
Have you ever taken a personality assessment? Did you answer COMPLETELY truthfully? You caught the self-deception before clicking submit and altered a few responses.
Jetwashing
I had a helpful call with an anti-money laundering specialist a few weeks back. He explained how peers cooperate to share intelligence about emerging criminal/terrorist tactics.
Building risk capacity
An obvious solution to overwhelmed and overburdened risk, compliance, and sustainability practitioners is to get help! Some might suggest ethics, risk, or whatever else we call them "ambassadors" or "champions.
Indecision-making frameworks
You're a new joiner to ABC Corp and diligently read the Code of Conduct as you wait for IT to finish setting up your laptop (even though they've had three months to prepare).
Why does making risk relevant matter?
If you've been around kids for any extended period, the temptation to say, "Because I said so," can become strong!
Red-teaming using AI
Red-teaming is where we put ourselves in the position of an adversary - in our case, someone trying to subvert our security, values and rules - to test the robustness of our preventative framework.
Sometimes, we CAN say, "I did my best."
A few weeks back, I had a call with the board of an impact fund trying to get the heads around "financial crime. " They'd been managing anti-money laundering (AML) risks for a while.
ChatGPT is not AI
How should we use AI? I'm baffled as to why this question takes up so much time. We've been here before.
Why do we break the rules?
You've probably seen the Ethical Excuses Bingo, crowdsourced on LinkedIn, below. My anecdotal experience of rule-breaking is that it's overwhelmingly done "for the organisation.
Bootstrapping Ethics, beginnings
The Ethical Excuses Bingo, crowdsourced here 3-4 years ago, was a turning point. I'd long had a hunch - borne from anecdotal data - that building endless controls wasn't the solution to reducing integrity risks.
Server or surgeon?
Depending on where you are in the world, you can tell a server how you'd like your food. There are some vagaries.
Culture (survey) wars
Many companies have employee surveys titled "engagement, culture, feedback, etc. " HR often controls this process.
I feel like a fraud
My first foray into fraud bored me senseless. I was sure I'd never work in that area again.
Resistance strategies
In a podcast last week, I was asked how *actually* to manage corruption.
Excel & third-parties, the nadir of compliance
How do you collate all the various bits of risk data you gather from third-parties? How's that working for you?
Box-ticking & strategic risk
Have you heard the one about.
Ford and risk data
In a recent article in The Washington Post, Terrence McCoy detailed Henry Ford's disastrous rubber plantation foray into Brazil in 1927.
How we think/feel when lying
Getting to the truth is essential. The use-case in investigations is self-evident. In assessments, training, strategy-setting, and developing content (or anything else), it helps to know what people actually think.
Reasoning rationalisation
When studying behavioural analysis and deception detection techniques, I often heard the instructors say, "Focus on the act, not the person.
Utterly Forgettable
Let's unpack why people forget training. First, a few training myths.
The dark arts of "source enquiries"
In 2006, as I started in investigations, a happy client said their deal team colleague was so astonished by the findings in the due diligence (DD) report that they'd proclaimed, "Are you with the FBI?
Everybody hurts
When did you last say "No" or "I'm not accepting that"?
ESG - don't talk about the tradeoffs
E, S, and G can't always peacefully coexist. Reporting on the downsides in a regulated world probably doesn't seem sensible.
Due diligence 2.0
Due diligence in its current form is a bit like commissioning a report before buying or leasing a second-hand machine. It makes sense if you're purchasing or renting something massive.
Startup lesson
Knowing what to choose is hard, especially when you have little (or no positive) experience. I see this frequently, including:
Trust but verify
The trust paradox is a disjoint that straddles organisational size and global cultures.
"A little bit of violence"
Crisis simulation workshops have been amongst the most effective ways to get leadership teams to take risks (including ethics & compliance) seriously.
A moving story
Ten days ago, we moved into a new home. We'd been looking for 18 months, providing plenty of opportunities (and failed bids) to learn.
Killing with kindness
Twenty years ago, I contributed to a deathtrap playground in the name of charity.
No archive entries match that search yet.