Progressively, compliance mechanisms are seen as critical to responsible business conduct with increasing regulatory demands and expectations of ethical corporate behaviour. David Hess’s Advanced Introduction to Corporate Compliance offers a rigorous examination of corporate compliance mechanisms, situating them within broader debates about ethical business conduct, regulatory enforcement and organisational culture. This work arrives amidst escalating divides on the role and value of Environmental, Social and Governance (ESG) frameworks to demonstrate how compliance is critical to a corporation’s survival, as, for instance, the Enron examples remind us (78, 91).
Hess’s work bridges the gap between high-level principles and operational implementation. His seven elements of an effective compliance programme (leadership and governance, risk assessments, policies and procedures, training and communications, incentivising compliance, identifying misconduct and continuous improvement) offer a blueprint for educators and practitioners alike, while case studies like the Milgram experiments and Boeing’s safety failures provide concrete contexts for discussing ethical leadership failures. The centrepiece of the book is its seamless transition between many disciplines like law, management and behavioural ethics.
I. Chapters
Chapter 1 begins with compliance’s origins in law. Here, Hess traces compliance programs from criminal law and anti-trust law to their mainstream adoption driven by the 1991 US Organizational Sentencing Guidelines and the Delaware Caremark decision outlining directors’ oversight duties, which focused on a ‘carrot-and-stick’ approach to incentivise ethical conduct. The 2004 amendments to the Sentencing Guidelines marked a shift by explicitly integrating ‘ethics’ into compliance, moving beyond a legal tick-the-box exercise to encouraging a culture of ethics within the organisation. Hess reminds us that ‘paper compliance’ programmes overlook the business case for compliance, including avoiding legal penalties, reputational harm and occupational fraud.
Chapter 2 outlines Hess’s seven core elements mentioned above (24). He stresses the need for risk-based approaches, due diligence beyond the corporation (e.g., anti-bribery and in mergers) and alignment with ISO standards and the US Department of Justice (DOJ) guidance. His critiques of ‘check-the-box’ compliance programmes underscore the importance of integrity as central to corporate culture throughout the seven core elements at various stages of the continuous process of compliance.
In Chapter 3, Hess analyses how compliance programs intersect with enforcement, including the DOJ’s Principles of Federal Prosecution, deferred prosecution agreements and the debate over strict vs. duty-based liability models. However, he flags that regulatory design is critical to avoid ‘cosmetic compliance’. Hess reminds us that regulation should ensure that its basket of incentives and penalties does not encourage bad faith efforts on the part of corporations who may hope that the government would be unable to distinguish good compliance from bad compliance programmes. As such, Hess reminds his readers that focusing on expenditures of compliance programmes over their actual workings produces bad data points to determine the effectiveness of compliance programmes (57–9).
In Chapter 4, Hess seamlessly switches to behavioural ethics, explaining why ‘good people do bad things’ through the 10-80-10 principle (10% people are always ethical, 10% always unethical and 80% of people’s ethics are situation based) (62). Hess mounts a direct challenge to a deterrence-based model focusing on the 10% of bad actors. He rather calls for behavioural ethics-based interventions against possible normalisation of unethical behaviour for the 80%. He dissects cognitive biases like rationalisation, i.e., where employees violate norms but believe they are acting ethically since they can justify post facto why their conduct would fall within an exception to the norm (67). Similarly, Hess uncovers organisational dynamics leading to unethical conduct by giving us the example of GM (General Motors)—the largest US car company—where ‘diffusion of responsibility’ meant that even lethal car safety problems remained unaddressed for several years owing to everybody pointing the problem as someone else’s responsibility and nobody eventually acting (81).
Hess contrasts ‘coercive-based’ punitive approaches with proactive ‘integrity-based’ or shared values-based approaches in Chapter 5, emphasising speak-up cultures and designing compliance programmes to deal with real people who have intrinsic drives to do the right thing instead of abstract legal subjects who are looking to violate norms (105–6). He critiques misaligned incentives, citing Wells Fargo’s sales scandal which led to rampant fraud within the company when employees were rewarded for individual and aggressive sales efforts (100). Hess rather advocates for aligning compensation strategies with compliance goals, understanding the interplay between formal policies and informal norms in corporate culture and fostering a culture of speaking up. Importantly though, leaders must be willing to actively listen to foster a speaking-up culture (97).
The final chapter (Chapter 6) debates compliance’s organisational placement: whether it should be independent vs. situated in the legal department, highlighting the compliance officers’ need for authority, resources and board access. Hess examines evolving director liability law in the US and emerging challenges like AI governance, remote work’s risks of toxicity, and ESG integration. He argues that compliance officers must be independent and report directly to the board for them to be trustworthy and legitimate in corporate functions, avoiding any misconception that a compliance programme and team are designed to protect management from legal liability.
Each chapter builds on the last, weaving historical foundations, behavioural insights and governance strategies into a narrative that positions compliance as both a shield against misconduct and a catalyst for ethical organisational transformation.
II. Directions
Anyone reading the book will be immediately struck by its interweaving of law, corporate governance and behavioural ethics arguments into a coherent whole in order to position compliance not as an addition to business operations but a core feature of it. Through numerous examples, the book reminds us to take compliance and ethics seriously, or businesses risk significant financial and reputation damage. Specifically for business and human rights scholars and professionals, this book is an excellent testament to how human rights due diligence can fit within existing compliance mechanisms. Compliance is an ongoing process involving continuous risk identification, mitigation and evaluation (26)—so is human rights due diligence (UN Guiding Principles, principle 17(c)). Compliance programmes should be situated at the top-level of the enterprise (117–20)—and so must human rights due diligence programmes and policies (UN Guiding Principles, principle 16(a) and 19(a)(i)).
That said, the book’s marginal engagement with human rights may feel like a missed opportunity. This is more so when human rights due diligence is becoming the expectation rather than the exception with increased legislative requirements. This is true, for example, on both sides of the Atlantic. In the European Union owing to the Corporate Sustainability Due Diligence Directive (the CS3D), despite its impending dilution. And in the US by possibly applying as a Caremark duty of directors which could mean potential lawsuits based on directors’ duties in Delaware law for failure to comply with the CS3D.Footnote 1
Caremark is an oversight liability which arises for directors when either: there is a lack of a risk-monitoring system in the company or the directors impair their ability to be informed of the risks generated by the risk-monitoring system. Given that the CS3D would apply to many American companies in its current form, possibilities of a Caremark claim based on the failure to account for risks emerging from the CS3D would be premature to completely rule out.Footnote 2 Human rights due diligence thus may end up being an important part of corporate compliance generally.
This absence risks leaving the (incorrect) impression that corporate compliance may be distinct and separate from human rights due diligence obligations, even though both are secondary processual obligations aimed at ensuring compliance with some primary obligation in the law, e.g., prohibition of bribery, environmental norms, anti-discrimination obligations, etc. However, a reader must be cognizant of the fact that this is a book on how compliance is constructed—not on what substantive provisions are to be complied with—which explains the razor-sharp focus on the ins and outs of fostering ethical culture while being substance-agnostic. Indeed, the book observes that
[t]he compliance function’s authority comes at least partially from government agencies and their enforcement practices, as opposed to the legal function, whose authority comes from its responsibility to the corporation and the corporation’s shareholders. This source of authority requires that the legal department determines company policy with respect to what ethics demand and what the law requires before the compliance function determines the “how.” (114)
Rather, the book provides lessons for business and human rights scholarship to start thinking of human rights due diligence as an ‘organisational culture’ rather than impersonal ‘processes’. Compliance as ethical culture, as is the conceptualisation in the book, brings to the fore that corporations are run by people—their employees—who are often overlooked but are crucial to humanising business rather than visualising a faceless corporation doing a legal tick-the-box exercise. As such, human rights due diligence requires much more than a top-to-bottom risk-finding or risk-mitigating exercise. This is particularly true when the risk in question is the corporation’s business practices, which are carried out and operationalised by the company’s employees. Human rights due diligence would not only be easy for a corporation with ethical organisational culture but meaningful. Hess would make the average Business and Human Rights Journal reader ponder whether human rights due diligence is possible at all without the proper organisational culture.
In moving beyond ‘the law’, the book provides a pause to also re-think how corporations are conceptualised as regulatory targets. Regulation must be based on mutual trust between the government and corporations (56). For if the government’s regulatory approach and enforcement are based on distrust, it may end up treating genuine compliance efforts on par with cosmetic ones. This would push genuine efforts out and only those who can game the system would remain.
Importantly, the book successfully convinces the reader that compliance is not synonymous with ‘complying with the law’ but rather signifies something broader, akin to ‘being ethical’. Compliance with the law is but one of the objectives, albeit a primary one, of ethical corporations. The book’s engagement with multiple examples and case studies, combined with theoretical depth, makes it a refreshing experience for a book to do exactly as its title claims: to provide introduction to corporate compliance that is of advanced nature. This quality makes it suitable for classrooms and boardrooms alike—a feat not many texts are able to achieve.
