The Questions Directors Forget to Ask Until the Subpoena Arrives

Directors of regulated companies almost universally believe they take compliance seriously, and most of them do. Yet post-mortems following enforcement actions routinely reveal boards that were surprised by conduct their own committee structures were supposed to catch. The failure is rarely a failure of intent. It is a failure of information design: management controls the flow, the format, and the framing of what reaches the boardroom, and prepared presentations are very good at making a program look healthier than it is.

The remedy is not more dashboards. It is better questions — the kind that do not appear on a pre-circulated agenda because they cannot be answered with a slide deck.

1. What Bad News Reached You Last Quarter, and How Did It Get Here?

A board that cannot recall a single unwelcome compliance finding is not running a clean operation; it is running a filtered one. Healthy programs generate friction — escalations, near misses, internal investigations that end quietly.

A bad answer sounds like: Nothing significant came up. Or a recitation of closed matters with no description of how they surfaced.

Request afterward: The escalation log, unredacted, for the trailing four quarters, plus a list of matters closed without corrective action.

2. Who in the Company Can Say No to the CEO, and Has Anyone Tested It?

Tone at the top is easy to assert and hard to verify. One useful proxy: ask whether any senior executive has overruled compliance in the past year, what the issue was, and how it was resolved. The answer reveals whether the escalation structure is architecture or decoration.

A bad answer sounds like: We have a strong culture; that has never been an issue. Absence of conflict often signals absence of candor.

Request afterward: Any written risk memoranda involving executive-level decisions, and the charter showing where the compliance function reports.

3. If Our Chief Compliance Officer Resigned Tomorrow, What Would We Lose?

Many regulated companies concentrate institutional knowledge in one or two compliance professionals. Directors should understand what would happen to key licenses, filings, and regulator relationships during a transition — and whether a successor could find the roadmap.

A bad answer sounds like: Confidence without specifics. If no one on the board can describe the succession plan in a sentence, there is not one.

Request afterward: The documented succession plan, a knowledge inventory, and recent turnover data for the compliance function.

4. What Would an Outsider Conclude From Our Own Records?

Boards review summaries; regulators review raw materials. Ask counsel to describe, in general terms, what an enforcement attorney would find in the company's emails, training records, and audit files. The gap between the summary and the source material is where most board surprises live.

A bad answer sounds like: Our records are in good order — offered without any recent independent assessment.

Request afterward: The most recent internal audit or outside-counsel assessment of the compliance program, including findings management chose not to act on.

5. Which Regulation Are We Closest To Getting Wrong?

Management tends to present compliance as a portfolio of completed tasks. A sharper framing asks where the enterprise is most exposed right now — the rule in flux, the license nearing lapse, the product line that outran the controls. Directors who hear a specific, candid answer are getting real information. Directors who hear a list of everything the company does well are getting a brochure.

A bad answer sounds like: We are compliant across all our obligations. No regulated enterprise of meaningful scale is fully current on everything.

Request afterward: A prioritized risk register with named owners and dates, refreshed quarterly, not annually.

From Questions to Oversight

None of these questions requires technical expertise, and that is the point. Directors do not need to audit the program themselves; they need to test whether management's account of the program survives contact with specifics. Boards that build these five inquiries into their routine — rotating them across committees, requesting source documents, and noting the answers in minutes — convert compliance oversight from a ritual into a control. The companies that avoid the subpoena are usually the ones whose directors asked uncomfortable questions while the asking was still cheap.