Gold Standard Leadership
BDO's Legal Tech Talk
BDO's Legal Tech Talk / Season 3

Modernizing Ethics, Compliance, & Legal Innovation

BDO's Legal Tech Talk · Season 3, Episode 30 · November 20, 2025 · 8,578-word transcript
Listen on Apple Podcasts Listen on Spotify BDO episode hub
Host: Daniel Gold, BDO
Co-host: Eric Derk, BDO
Guest: Matt Galvin

About this episode

Daniel Gold and Eric Derk talk with Matt Galvin, who helped build BrewRIGHT, AB InBev's data-driven compliance program, and later advised the Justice Department on compliance strategy. Matt explains how harmonizing data turned a false-positive compliance business into one that finds real risk, how compliance projects improved margins and logistics, how he measures culture, what a board-level compliance KPI should look like, and how AI changes who does the work.

Key takeaways

Full transcript

Transcript from BDO's published episode, edited for transcription errors. Speaker labels added by Gold Standard Leadership.

Show open

Welcome to BDO's Legal Tech Talk podcast. We're joined by judges and legal professionals to discuss emerging trends, regulatory updates, and the latest headlines. We'll provide tips to help your law firms and legal departments make the most out of legal technology.

I'm Daniel Gold, BDO principal and eDiscovery managed services leader.

And I'm Eric Derk, BDO's managing director of legal operations. Let's get started with this episode's exciting discussion.

Daniel Gold

And welcome back to another episode of BDO's Legal Tech Talk. We are really excited here because today, we're gonna be exploring topics such as compliance and data and AI and where that actually meets the practice. And to do that, our guest is Matt Galvin. He has helped build what is called BrewRIGHT and AB InBev.

He has brought in and helped improve data analytics at the DOJ, in the fraud section in particular. And he now advises global clients as a partner at Steptoe, the Steptoe law firm, how to utilize technology and manage risk. His career spans boardrooms, monitorships, frontline investigations, and I think that being able to have a guest here to talk about practical outcomes is really what is really wanted, really what is needed now more than ever. So, Matt, thanks so much for being in the virtual recording studio with Eric and myself.

It's great to be here. Well, perfect. So I gave just a very broad high level background as to who you are and what you've done, but why don't you go ahead and take a moment to go in-depth and talk to us a little bit more about the things that you have done and why you do what you do?

Matt Galvin

Yeah. It's funny. I think I was brought in for a lot of kind of, you know, different kind of as government speakers, you know, as one of the few kind of compliance officers to go to Davos to talk about technology and compliance because a lot of people are like, if this guy can do it, anybody can do it.

I was a poetry and Chinese major in college that worked at a beer company for a bunch of years. And I'm like, if that guy can do analytics, you know, we should have high expectations for others.

And I think, you know, the why I do it you know, I became a lawyer about twenty years ago, and I think I became a lawyer at the worst time in the history of humanity to be a lawyer because data was exploding, emails exploding. You heard, like, wake of kind of giant financial crisis cases of, like, Enron and WorldCom, things that really changed the landscape, but the ability to synthesize data was nowhere near the corporate capacity to generate data. And I was, you know, in the crosshairs of that kind of moment in time for the legal profession. And so as I grew more senior as a lawyer, I was in constant hunt for something as good at finding signal and noise as were the kind of, you know, seemingly endless human capacity to create noise.

And that led me, you know, after ten years in private practice through Asia, you know, back to the States where I was at AB InBev, you know, at the time, I was head of investigations and litigation globally for the company. And I was told I had to do two things. They wanted me to work more closely with IT, and I had to manage the small problem of how do you figure out, you know, compliance integration of a hundred billion dollar acquisition while we were resolving cases with the SEC and DOJ at the same time. That led me to say, we gotta do this differently.

And I learned a lot about data. I learned a lot about data structures.

I learned, you know, after a couple different iterations, you know, I designed and launched what was called BrewRIGHT, which was a kind of best thought of as a set of sixteen different interconnected compliance apps that was based upon the aggregate of about forty three different systems, some commercials, some compliance.

And we would be able to kinda streamline investigations and come up with predictive models and get our overall holistic global risk score. And that's when I went to the justice department both as a kind of compliance adviser and kind of data builder adviser and then moved on to Septo.

Eric Derk

Yeah. You know, one of the things that I read about your background in context of BrewRIGHT is I'm assuming that you probably came across a lot of false positives and struggled with the tuning exercises. Just talk a little bit about some design choices that had to be made when you're integrating those sixteen systems, and how did you kind of progressively iterate on getting those design choices to really get the highest degree of actual positives instead of false positives? Tell us a little bit about that rubric and that thinking.

Matt Galvin

Yeah. I mean, there's a lot to unpack there because you're right. In two thousand sixteen, when we started, it was a hugely challenging exercise because you had to first identify what kind of data you wanted to do and then figure out what data you're gonna pull, then figure out what data you're gonna harmonize.

Then you're gonna figure out how to test it, and then you gotta figure out how to process the testing, and then you gotta figure out the feedback loop to build your model. Now when you're doing that, any number of things can go wrong. Right? You can pull the wrong data.

You can harmonize it wrong. You integrate it wrong. The system couldn't work. You don't know if your tests work.

You don't know if people are reviewing it the right way, and you don't quite know if your feedback loops right. So there's, like, any number of junctures where that process can go wrong. And we kind of had to change our ways of working. I learned a lot of agile and scrum kind of working because he had a sprint to identify kind of you know, when you have such a complicated set of interconnected issues, working in agile is the only way you can manage identifying kind of problems as you go through.

But over time, you get insight. And it's funny to me because, like, when you look at this, you're right. With any sort of fraud exercise, it's heavily asymmetric. Right? The vast majority of what anyone looks like is okay.

And only the minority of things are not, so it's kind of difficult to train models in that kind of asymmetric data environment.

But as you kind of get better at integrating data systems, and we got down to you know, at first, was, like, about five, six hundred thousand dollars to integrate a system for all the reasons that I talked about. At AB InBev, we got that down to about fifty or so thousand dollars, and now there's providers that do it for, like, fifteen, twenty thousand. And then with LLM or large language model capability and data clean, that's kind of cheaper, faster, better. So that stuff is a lot better than it was, you know, nine years ago when I was kind of doing this with, the equivalent of compliance Legos.

But what you find, if you start thinking of compliance as an exercise to create transparency and you start thinking of compliance as an exercise with data, you realize a couple of different things. One, compliance is kind of a false positive business. You know, the vast majority of compliance doesn't work for whatever reason. You're not necessarily, you know, finding a bad guy every day.

People might call in and raise it up. You might find anomalies. You might do whatever you do. But if you're proactive monitoring or your diligence seen or a lot of compliance processes, you know, not every investigation ends with a smoking gun.

A lot of times you find nothing. And you start measuring that. And what I found is in traditional way, as I talked about a second ago, like, growing up as a lawyer when we're bad at data, the kind of state of the art ten years ago was to do random sampling. And I actually got rid of my first lawyer team because they're like, let's come up with a risk matrix, and we'll randomly sample up to twenty four SAP countries.

Eight of them, you know, will then come up with change of rules, do some investigations. What does year two look like? Well, we'll look at four of those, and we'll look at four others. What was your three look at?

Well, we'll at two or three of those, look at four others. I'm like, this is a recipe for, like, endless external adviser work.

Heavily inefficient, low data. Why? Because you're random sampling. And having looked at you know, once you got to about ten thousand activities, what I found was mathematically random sampling found something one in every thirty five hundred times. So, like, three. Right? Hugely false positive business.

But then you start to get creative, and you're like, well, I can start to train models and regress. Now you can't really train models with three true things in that kind of field of asymmetric data. So then you could start working with computer modeling to say, computer, how would you commit fraud, or how would you do evasion of control, or how would you pay abroad? And then you come up with some kind of synthetic patterns of behavior.

And that got us, you know, together with more advanced modeling to, like, one and two fifty. But then we did it again. And the better you get, the better you can get. Right? So you have a virtuous cycle, and you hit a tipping point where once you start getting in one and ten or one and eight, and eventually they'd be in bev with internal data, we get to two and five.

Because you start generating a true positive pool that tips over and makes the models all work better, which then you generate some more true positives and you get them a lot better.

And then what we did, and this is really cool, we launched a consortium project with MIT, and we worked with kind of the same data schema across six different companies, had them repeat a BrewRIGHT process for one of the better highest performing algorithms, and then we trade the algorithms on an exchange. And that got two and five to one and two.

And so to me, that's the future in this space. Right? You don't need to start where we were in two thousand sixteen, and it's extraordinary to me how many people try and do that where there's so much available to companies now to be much more efficient and the synthesis extrapolation workflow modeling because you can build off this kind of work that is already done. It's so much more efficient to operate ahead. Plus, you have this large language model capability.

Whereas, like, I was dealing with models of, like, eighty hundred differential equations in neural networks, how with LLMs, you have, like, eighty million. So the capability to kind of perform a lot of the incremental tasks, whether it's cleaning data, whether it's writing code, whether it's coming up with broader sets of kind of pools of data you can bring in to inform your models, to me, there should be, like, a radical acceleration in this space that I haven't quite seen yet outside of very small pockets.

Daniel Gold

We're gonna get into AI and the applicability of AI in the context of compliance. Before we get into that, you know, I think in general in a business, when the compliance teams come knocking or the legal teams come knocking, they they think it's an obligation. You know, it's, oh gosh. You're gonna comply with this rule.

And tell us a little bit about your ability to evangelize the benefits of compliance in the way that it can help people compete better. So I've always found that there's seems like this binary difference between this competitive angle versus this compliance angle, and a lot of times those two things don't align. Tell us a little bit about how you've thought through that compete versus comply. So compliance is actually a business enabler as opposed to a barrier for success.

Matt Galvin

Look. I think anyone who's successful in compliance is gotta be one of the best salespeople in the company because it's hard to sell sometimes. And but when you're selling ice cream, sometimes you're selling it because it's sweet. Sometimes you're selling it because it's cold.

But you have to know who you're talking to. And there's a lot of upsides to managing kind of transparency. There's a lot of upsides into creating kind of measurability across the company because a lot of your stakeholders across your c suite are trying to figure out how to manage and measure a little bit better to increase performance. And if you can figure out how you're managing and measuring to improve, you know, compliance or ethics fits with the commercial team's desire to manage and measure well, you found a friend.

Let me give you an example. We had a project in India where we were concerned in kind of downstream sales practices.

And in any market where you have kind of resellers or commission based folks, if you give them free rein, well, it's kinda hard to measure because they can cut up discounts and, you know, and even in this kind of something relatively, you know, non complex as the beverage industry, you start packaging, like, Pepsi and beer and you get different discounts, and there's different ways kind of people create, like, kickback schemes at funds if you're, you know, so inclined.

So we did a project, but by and we standardized the kind of discount structures that we could do so then we could actually monitor similarly situated and you can roll it for volume, you can roll it for market, and kind of get indicators across the sales interactions, the sales kind of numbers of the folks. And the sales team initially was like, oh, man. This is gonna be terrible. It's gonna kill sales.

And for month one, it did. Sales plummeted, and I was terrified. But guess what happened? Month two, month three, the volume was back to what it would have been for that quarter, and the margins were better.

So once the kind of beast had digested the medicine, we had better traceability. We had better visibility. We actually knew where our dollars were going a little bit better, and we increased profitability with a compliance project.

And so if you could find those sorts of incentives to align, I have lots of kind of case studies and use cases like this, You can really manage your risk better. I'll give you another really cool one. We had another project also in India because that was, like, a site of a lot of investigations for us. And in some provinces in India, there were about a hundred and ten separate licenses that you needed to go from, like, grain to someone drinking a beer.

Like, there's states in India you need, like, a specific alcohol ID to drink. And so, jeez, there's a lot that can go wrong from a hundred and ten licenses to get to, like, a bottle of beer. Now one of them was we saw certain shipments of product, right, were getting held up and kind of creating friction with the powers that be. And what we learned after we kind of studied it, we saw, that state, they had higher tax revenue if from beer that was gonna be consumed in that state versus exported.

There were certain monthly or forget it was, like, every it was, like, six to ten weeks or something. The official had a quota on how much tax revenue he was supposed to generate for the state, which meant that if you were trying to export beer around quota time, he didn't want that to happen. And it's usually a heat. So that's when, you know, he might be like, well, you gotta offset me. You gotta do something for me to do this.

So we actually recalibrated our logistics delivery settle, so we hopped up domestic distribution at quota time. So his incentives were aligned on our incentives, he didn't have any reason to put his hand up.

That increased kind of production capacity and delivery by twenty percent because they weren't paying bribes. They were just holding it up basically at the court, right, and reduced compliance friction. So that required a lot of integration of supply, logistics, delivery, sales. But that sort of kind of compliance driven joint interdisciplinary product that drove value.

And similarly, when you start solving kinda globally, when you start looking at corruption from, like, an accounting of slush fund creation, I mean, from you guys are the accounting firm, but my experience is that quite often, money that goes to corruption and fraud, often the same money, draft. You start bribing. People are stealing. It's very contagious.

You start going off book. People do all sorts of shenanigans with funds.

And so from an accounting perspective, they look kind of one in the same. And so if you're driving transparency, you're kind of tightening up the system. You're reducing opportunity to bribe. You're also reducing opportunity to steal, and you're helping kind of, you know, bottom line growth.

And, again, we found all sorts of ways to align incentives across different stakeholders.

And, again, sometimes it's sweet, sometimes it's cold. Right? What I would talk about with sales was different than what I would talk about with finance and might vary by market. In different markets and their own dynamic problems, but all of which were solved better by having a command over the data, and all of which were better by having kind of this gruelite system that was nimble enough and had different workflows to, you know, operate an army of a hundred and thirty compliance people.

But the way the system worked, you found ubiquity across very different businesses. So then you're kind of driving better models. You're driving better performance. And the work of a compliance person in South Africa helped to work with the compliance person in Peru, and that was really cool.

All of which drove efficiency. Right? And that's kind of thinking of compliance as a value generator and a company asset rather than a legal process and kind of documentation. To me, was very empowering for the VimBev function at that time.

Daniel Gold

Matt, I wanna unpack that a little bit more. There's a lot that you just uncovered that I think for our listeners, you could really drive some more practical value. So I think about some of the things you've shared so far. One of them, namely being that you have a very unconventional background for data analytics.

And you're clearly very good at data analytics. You're very good at data structures and understanding the nuances with data. That's incredibly clear. But you studied poetry and Chinese.

Eric Derk

Yeah. And when you were at InBev, what you said was is that you realized you needed to work closely with IT. But when you did that, you were able to do that in such a fashion where you learned things like, I heard you say scrum, and I heard you say embraced agile methodologies. Those are things that they don't teach us in law school.

They taught us in law school how to think like a lawyer, but they never taught us, especially when we went to law school, roughly around the same period of time, they didn't teach us about data structures. Right? And so it takes somebody who is entrepreneurial enough, I will say, to really get it.

Right? To really get it and understand that if I follow the data in a way that I can really, really get the nuances, I can get to a place where I can actually build out a program.

And there's not a lot of lawyers that do that, that take that hop. They might see it like I see it also, like, from a data compliance perspective or a data monitoring perspective, or I'm gonna follow the data to see where the fraud is. Those are all things that people get, they understand they've been doing this for a long time. But to take the leap, Matt, to take the leap to be able to say, I went from studying poetry in Chinese, and I went to law school, but now I'm gonna follow and understand agile scrum and data structures.

That's very, very different. And so considering your nontechnical background, what are some of the practical steps or resources that help you bridge the gap into data driven compliance? And what advice would you give to our fellow lawyers that are out there that wanna build out some similar skills?

Matt Galvin

Yeah. I mean, I suppose from, like, a life skill, studying Chinese and spending, you know, seven years in Asia, you learn to be kind of comfortable with being uncomfortable and comfortable in environments you don't totally understand. And you're constantly making social mistakes. You develop kind of a level of humility together with a bit of thick skin in terms of walking into places that you don't need to know all the answers.

And, you know, I think law school suited me well in terms of it taught me how to learn. Now you can easily kind of fall victim in a trap. You know? A lot of law firms are really good at training associates, me among them, on how do you execute with perfection and how do you stay within scope for services.

Neither of which are very good for someone to create because to create, you have to be willing to be wrong. You have to be willing to be stupid. Not every idea I have for Bruurette was a good one. The first version of Bruurette was a spectacular failure.

And I cut it off and moved on to a new version, Got rid of the first provider and moved on to a second one. Neither were BDO.

Trying to stay within balance of kind of, you know, warnings.

It's tricky. I'm at a law firm, so I have to operate with my clients without a willingness to fail. And I but I still am trying to experiment, and I'm still trying to learn. And it's a really amazing time. You know? I think all of us have to recognize that our profession's changing.

I listened to something eight years ago or something where they were like, I'm in digital marketing. And they're like, if you have digital in your title, you have the right job in the wrong company.

And I think to the extent that I'm a digital lawyer, that would mean I have the right job in the law law firm.

I am a lawyer that's learning AI and trying to keep pace because that's what our profession demands. I don't would ever say I'm an AI or digital lawyer because that would mean I'm in the wrong place.

So I lived in Taichung, Taiwan. Learned some English. Was a garden variety waiguoren. And, you know, the living in the culture, a different culture, particularly one that's so wildly different, like the Chinese culture, you really had to lose the sense of self.

Right? Like, it was really hard for me to be an American. Even though I was a tall, you know, Caucasian guy, you know, I was teaching English in a high school, and it really took me a long time to truly understand the culture. Right?

Eric Derk

You've written a little bit about how you measure culture, and just my experience was not necessarily quantifiable. It's a lot of, like, hard learnings through failure and doing the wrong things, not following the right normative behaviors. So I learned. Right?

It took me, like, two years to learn it. But you talk about how you frame culture in terms of what the organization will accept in the way of the worst behavior. How did you figure out what are the maybe some of the indicators across cultures? Because you mentioned different countries here that you've actually deployed your right hand.

How did you figure out, like, what are the minimum viable acceptable things that we're gonna let people get away with? And how did you kind of draw corollaries across cultures seeming like different normative behaviors, different laws, different regs? How did you align that master framework to say, okay. This is a good behavior.

This is a minimum viable behavior. Can't allow that. That goes below the threshold. Maybe tell us a little about how you how you thought through that rubric.

Matt Galvin

I mean, you're right. What is kind of ethical has some degree of can vary, but company policy matched with company ethics, that can be a set of baseline. And I wasn't the one that came up with the line that culture is worst behavior that a company is supposed to tolerate. That was the former surgeon general of the United States, but I heard him say that and have applied it, you know, across.

And if you think of the tools that a compliance officer has, quite often, they have access to kind of helpline data investigations data. If you don't, you need to kind of work on getting that. And you can survey, typically. And you can typically train, and then you can get metrics off of training, and you can get metrics off of survey, and you get metrics off of your investigations data, and you get metrics off of your investigator performance data, which I think is an underutilized kind of piece.

And then if you normalize that against your HR systems, you can start to say, I can see that the same type of kind of severity of misconduct at certain levels of an organization is punished this way here and that way there. I can see that across, you know, a sales team in Oklahoma, they're behaving very differently than the sales team in Texas. There's not a lot of good reason for that. Or I could see, you know, the sales team in Taichung different from Kaohsiung versus Taipei.

You know? And you can see relatively the corporate credit card use in Seoul is different than different part of Korea. And you can kind of normalize certain types of behavior through it, but the kind of policy violations, you can be taking more of a kinda universalist view together.

At the end of the day, that is not gonna give you the entire answer to everything. That is just making you efficient in terms of where you're gonna look and get further context.

I didn't kind of come up purely from a data perspective without doing eighteen trips to India, the kind of sales and factory stuff, but I knew to go there because data told me to go there.

And so if you think of part of your job as a chief compliance officer of a global organization of two hundred thousand people is to where do you effectively use your time to have the maximum impact in the culture. Well, data can then be very useful proxies for you to figure out where you should put resources in your time. And b, once you go there, what sort of questions you should be asking. And then c, if you do some sort of corrective measure, or can you measure change throughout the data? And if so, why not? Because all of this, you establish baselines, and then the data is a river.

And you're kind of trying to influence and manage, and then you can kind of see effectiveness. And that goes to another area that I think AI and analytics and kind of data driven compliance strategies allow you to really do. You're not just gonna live in that realm of false positive processes that we were talking about thirty minutes ago, but then you can kind of come up with reasons to believe that you're actually having an impact, that you're being effective. And who doesn't want that?

Eric Derk

So if you were going to design a board level KPI based upon the data and compliance analytics, what would you suggest would be the three metrics that you would prioritize to drive transparency and provide measurable improvement? And then I'm gonna ask you a compound question. I apologize. But how frequently should they end up being reviewed to ensure that you have ongoing effectiveness?

Because after all, the data is constantly changing. It's coming to you faster. And it's not like you used to be. Right?

So you used to be, maybe you could do this once a year.

Maybe you could do it like every half year or whatever. But does the cycle become any faster?

Sponsor message

Legal teams are struggling to manage resources, maintain compliance, and adopt new technologies. BDO's legal operations team can help. We enhance efficiency, reduce costs, and support compliance so you can run your legal department like a business. Schedule a meeting with us today at bdo.com.

Matt Galvin

Well, you know, one of the things I walk clients through, just to answer the second part of your question first, one of the things I walked them through is kind of the evolution of what a data mature compliance environment looks like. And one of the key features of that is not only do you have the data, but then you kinda move from, like, retrospective kind of sampling to more continuous monitoring with the goal of getting to more predictive into a more advanced kind of data mature companies. You're right. You're working more in real time or you're working to actually prevent or identify things when they're small is a very good kind of outcome. And so in terms of, like, core metrics for a board, identifying things where they're small is pretty big. Right? Because you look at, like, a general and I remember talking to my board about this.

Like, a general compliance kind of trajectory. When you have no compliance, you have no problems. Everyone's fat, dumb, and happy. Right? You're great. Then what happens? You've one big crisis.

And then you start looking and you start to see a few things just below the surface that are pretty giant.

And if you need let's get new people in, and then you bring in the compliance team. Right? And then what do you do?

It's never that you get rid of problems. Right? We live with humans. You're working with humans. Right? Even if you're working with robots, the robots are programmed by humans.

And so your goal is never that you're gonna have no problems. Your goal is that you're gonna see a drop in the magnitude of problems and a cruising altitude of problems that you're identifying relatively early.

And that to me is a key metric. Are you kind of following that curve? And then, you know, you ask me for other other two. That's tricky because BrewRIGHT, sixteen different dashboards, forty five different systems, all of which are different metrics that depending on the issue, could show my board and coming up with the weighted algorithms mattered.

Also coming up with you know, towards the end of my tenure, we got pretty confident with kind of some of lot of the models the way they're I mean, you could look at the impact and incentives. You look at how comp is going. That's kind of a board level discussion. Are you rewarding the behavior you really want?

That's a good kind of discussion number two. And discussion number three is how are you adapting to change when you either have, you know, change to the business, change to the business model, or external change? These things can be kind of drivers of unethical behavior. And so another good place to put your attention is, like, has case studies or, you know, where we go, how you're adapting.

And so we would alternate when I think about how when I really hit my stride in terms of managing kind of audit committee reporting, which we did quarterly, two of them were kind of broad level stats, and then two of them were what's focused on an area. And I like that balance. And as I got going, we would also be like, what are the external factors that are gonna impact us? Because now we've kinda mass we're getting good at internal, but what's next?

What's the threat?

Eric Derk

Now we haven't really started to talk about compliance automation. But with the world of agentic AI, you've mentioned large language models and rags.

But let's just assume that automation is going to kind of eventually take over a lot of the work that we do in legal and compliance in not all contexts, certainly not in critical thinking.

But one of the things that I'm really challenged with, and Daniel and I talk about this a lot, is the ability to actually make the right decision off of good clean data. You know, a lot of times people have this assumption that, oh, we'll just actually throw this into a tool, we'll build the rules, and then we'll present the findings, and everybody will know what to do. And a lot of that ability to make decisions is just kind of part of the story. It's also the other part of the story is the ability to allow decisions to be made.

And so one of the problems inside legal departments and even law firms is that the authority to operate, the authority to make a decision is usually held within kind of AGC, DGC, GC realm. Right? So how have you experienced this ability to provide data in kind of an objective manner, but then also show people the right decisions? Because I've always found that decision making is really hard.

That's kind of the hardest part. It's not it's not aggregating the information and surfacing it. That's almost the easy part. It's like, the hardest part is to say, now you have this information, what do you think you need to do with it?

So tell us about some of those traps and scenarios that you've thought through about how you can enable better decision making.

Matt Galvin

Yeah. I mean, let's kinda start where you started, and let's talk about data quality. One of the Debris sixteen dashboards was a data quality metric. And so we were constantly adjudicating each one of the businesses on the quality of data that they were putting into the system.

And then in terms of incentive and decision making, the compensation for the senior IT people responsible for that area was tied to high quality metrics into the system.

And so AB InBev was really cool. Right? Like, everyone had, like, five different things they'd accomplish in a given year, and each one would be about twenty percent of your bonus. And my goal ultimately was to get the right scores to be the equivalent or on par, like, of those five things for, like, a business unit leader that my composite ethics score would be tied to their compensation. That was the dream. Never got there, but it created a huge amount of discipline.

Because once you start thinking of, k, if you're actually gonna have a composite ethics score, then you're gonna try to incorporate to their bonus. And you're, like, you're going right up against the parts of the board that talk about, like, executive comp at senior levels.

Those are different typically people that are sitting to your audit committee meeting.

And so you have to be damn right in terms of your models. So it created a lot of discipline, which then led us to be like, jeez, the data's gotta be right. Then the model's gotta be good, and the metrics have to be good. So how do you get the data right?

You gotta bring IT on, you gotta make sure their comp is tied too. Otherwise, the whole thing's gonna fail. So that was kind of listening one and one b. Then, you know, you think about it.

It wasn't always about kind of what compliance did at a certain point, but the transparency itself drove better behavior in a lot of places, which makes sense. Right? Like, a lot of the largest kind of schemes happen because there's, like, an off book here or, you know, like, one of the biggest kind of Brazilian kind of cases you had, like, a special unit that was operating separately funded.

You know? And if you start funding operations to your business as if you're, like, part of, like, an off book IC operator, man, stuff's gonna happen that your ethics and threat. Right? That's the counter kind of factual to having a transparent organization.

I remember a time I would go visit. We had, like, global compliance committees at six different zones, and I would kind of ride circuit once a year to each of them and sit in a global one and in Africa one. There was an awesome moment where there was, like, a debate about kind of a procurement risk that was creating a compliance risk, and add the data. You can bring it up, and you could resolve the debate between the legal officer and the chief procurement officer.

And they're like, oh, you're right. That's happening. And then we could immediately get to decision because the data was there. It was reliable.

It was transparent.

You had an insight, and then you could kind of correct change.

That wouldn't have happened with a zillion different kind of compliance memos and that that was getting the right data with the right narrative to the right decision makers at the right time that they could make a decision. And it took a management team with a commitment to making decisions that were good. One of the bravest things that I think you know, and that's a very different management team at ABimboth, But the team that I worked with is that they allowed me to do this.

Right? Like, Felipe Tucher, Carlos Brito, Sabine Chalmers, they were amazing at what they did, and they embraced the idea of kind of base corporate financial transparency through an organization. Not every organization is going to do that. But from behavioral mechanics standpoint, it's pretty powerful to put behavior in the right direction.

Daniel Gold

Speaking of which, three years ago, The Wall Street Journal had an article, as you know, about your move from AB InBev over to the Justice Department. The title of the article was Justice Department recruits AB InBev data expert to white collar crime force. And what I thought was interesting when I was reading this article and thinking about our time here together today, Matt, when they'd highlighted this move, it talked about it being unusual for the justice department, right, to be able to hire somebody who's an executive at a b in BEV or an executive, right, in the corporate world, somebody who didn't have government experience. And, of course, I love this because I think that one of the most powerful aspects of someone's career is reinvention, right, and resilience, and I love that. And that's immediately my first thought when I read this article about you.

And I'm wondering, you know, they brought you over to help strengthen data analytics in white collar crime enforcement. But based on your experience, what were the biggest challenges and opportunities you encountered in translating this corporate compliance analytics approach to big government enforcement context? And how did your work at AB InBev shape your strategy at the DOJ?

Matt Galvin

It's a really well framed question, and I think certain things quite directly. Right? In some ways, figuring out different ways to incent people to kind of go in a corporate setting, that applied very readily to government, figuring budgets, figuring out motivations, figuring out drivers. In some respects, you know, translated, like, in a one to one ratio.

You know, in terms of the part of my job that was the combined evaluations, I tried to have just a lot of empathy with CCOs and legal teams and in house teams, understanding very much where they come. Because if you're kind of last ten years or spent kind of winning really hard trials with really complicated things, that's what your last ten years were doing. My ten years going to government were like, how do you kind of work through kind of complex corporate issues to get to the best outcome possible? Those two things don't always mix.

But what I would do when I would evaluate, you know, quite often when I looked at kind of the analytic structures or the kind of maturation of compliance programs and we'll just talk for a second about sophisticated companies, then we'll talk about kind of the whole world. You're always trying to see usually, there's one of four reasons why someone didn't have kind of a data driven compliance program. One is that they thought it was really expensive.

And I was like, the costs have gone way down. We've trailblazed a lot, and you can be very kind of efficient in operating that. I mean, yes, the overall Brite system over years cost nine million dollars, but my operating budget for Brite was less than a million dollars, which a lot of people don't believe that it was true.

And I had different ways to kind of structure and pay forward and really and we'd kind of find fraud, and that would kind of offset costs and things like that in really cool different ways.

But the costs aren't tremendous. And usually when someone was before me at the justice department, they were spending a lot more than a million dollars a year on their problems. So I was like, that was frustrating. Then they would be like, it wouldn't work.

Well, I'm like, that's kind of funny because most of compliance doesn't really work. And data kind of offers the opportunity to measure and see better and improve. And in what world does any legally trained person think that less access to information will help them do their job worse or better? Sorry.

You need more data, better at your job. And a lot of this didn't make sense to me. And then a lot of them didn't understand it. And I was like, well, you know, you get people that understand it.

You know? Like, this is out there. This is kind of the where it's going. Again, the idea that, like, you're, you know, not a digital lawyer.

You're just a lawyer in the wrong place. But at the end of the day, what I was really trying to go at in the companies that this kind of evaluation went the worst for were the ones that they didn't do it because they knew it would work, and they like compliance not working. And I think there's definitely places that like that. And so I think my experience in house helped me kind of sort those companies in different places and understand the ones that we're trying to do better versus the ones that weren't, understand the ones that saw the business value of it versus this, no.

Our business model is better off kind of breaking the law for whatever reason as they thought so. And that can be true in certain business in certain times. And, you know, you have to kind of meet your clients where they are and help them think about, you know, the wins they're gonna need and what's kind of in their interest at a certain time. And I can understand, you know, how companies come out and reach different conclusions, but, you know, some of them got caught and ended up before the fraud section.

Now that didn't mean it was the same standard for everyone. One of the kind of, you know, proudest things I saw that I kind of pushed for and got in the ECCP, the evaluation corporate compliance programs, was this concept of proportionality. Now I always found it's, like, one of the least understood things that entered into the e ECCP in the last change.

But it basically means that if you have a company with twenty people, you don't need a huge data analytics program because you just go ask, like, Bob or Jane, and Jane tells you what's going on. But when you have a global enterprise that you're investing, you know, millions of dollars in a sales system, some fraction of those millions of dollars should be put into the risk system for that sales system. If you're come up with a really elaborate algorithms to, you know, sell trade stock or sell toothpaste, you should have some degree of sophistication of those algorithms to manage the risk of your toothpaste and stock center.

Eric Derk

The thing that I wanna ask you is so, Daniel, I'll get a client that asks us, tell me about my three year roadmap.

Tell me about, you know, what what should I do with, you know, Gentix or or Rags or large language models or matter management software in the next three years? I think we have to change the idea because three years is eons and eons away from us right now considering the pace of change with AI. So maybe you could kind of tell us a little bit about what you think is the promising the more promising immediate use of GenAI through LLMs? And what things would you say?

Matt Galvin

Yeah. You just gotta do that right away. No brainer. Greenlight that. Versus where would you think about, like, maybe we need to be a little more cautious about this because we hear lots of things about noise and, you know, people using GNI and large language models to create false case law or just a lot of false case citations.

So what were the things that you would say, gotta do this right now, and maybe the other things that you'd say, put a hold on that until we actually learn more about how this AI stuff really works?

I mean, at first, I would talk about when I talk to my clients about their three, five year plans, I wouldn't talk about in terms of, like, the process and tactics of the technology they want in play. Rather would be, can I make compliance cost neutral in four years? Meaning, can I find enough value through technology and ways of working that there's no additional cost, you know, to the company for operating compliance, or can we be cost positive? Could we actually be generating money for the company?

Can we be identifying, you know, all instances of a certain type of behavior at this level of magnitude, Or can we have very low tolerance for, you know, high magnitude? Or can we ensure that certain people like my kind of vision where their comp is gonna be tired to some sort of, like, ethics oriented mission some way? These are, to me, goals that technology is going. And if you have goals like that, then you'll be adapting to the technology as it goes. Now part of the challenge of technology, it's not so much that it's gonna get better in three years. Some of it will, but it probably will get cheaper.

And so you're kind of, you know, you have tipping points and things because it gets ubiquitous enough that the cost goes down and then everyone more can afford it than you get, like, a flood. And I think right now for a lot of people, they're in kind of a period of, like, technological dissolution where they were kind of inundated, there's a lot of products that are poorly designed. It's tricky with a crystal ball, particularly when you're in an environment where some of the greatest advances in the AI in the last three months is encoding.

And so you're coding so much better, which means the tools that you can create are so much faster and so much great, and the teams you need to build them.

I no longer think of the team that I would need to build really cool stuff for clients in the same way that I did even six months ago. You know? Like, think thoughts about who I want, where do you outsource, how much data crunching, how much can analysts, engineers, science, quant. When you put those kind of kind of four parts of your team together, jeez, the speed and ability of those different muscles in that kind of skeletal data ecosystem no longer work the same way all of a sudden.

And so I favor small team. I favor kind of incremental sprint like changes with big shot, moonshot, three year plans in terms of effectiveness.

And I think that's a cool balance. And folks are coming to me because they wanna design. Either they wanna kind of look at a whole map and say, like, where do I go? They're like, jeez.

I have this giant investigation. How am I gonna do it more nimbly? Or we have a specific problem with, like, supply chain risk. What's the best tech?

And there's worlds of kind of providers in those space that I think are under threat with those radical changes of AI.

And tools that were once very expensive are now relatively bespoke and programmable for much less.

Daniel Gold

Matt, during our time here together today, I think what has definitely come across for at least me is that it's so important to be agile as an attorney. It's very important to be able to adapt to new technologies and embrace the age old idea of continuous learning. But I think maybe now more than ever, and I think that your insights on data driven compliance, agile method, and the evolving role that we are playing now again more than ever in technology has really been very, very helpful. Matt, thank you so much for sharing your insights today. We really appreciate your time and, obviously, your expertise.

Matt Galvin

I enjoyed the discussions. Look forward to finding ways to collaborate in the future.

Show close

Thanks for joining us on BDO's Legal Tech Talk podcast.

If you're enjoying our podcast, don't forget to rate, review, and subscribe for more episodes.

On www.bdo.com, you'll find all of our episodes, transcripts, and ways to continue the conversation.

Until next time, this has been another episode of BDO's Legal Tech Talk.

Daniel Gold
About your host

Daniel Gold is an attorney and a Principal at BDO USA, where he leads eDiscovery managed services. He hosts BDO's Legal Tech Talk, co-hosts the NeLI Pod and founded Gold Standard Leadership.

More about Daniel

Get the next one in your inbox

Daniel Gold writes weekly on leadership, legal technology and eDiscovery.

Subscribe on Substack