Humanizing Compliance: Data, Culture, & Innovation in Legal Tech

Dan, thanks for having me on the program.

Yeah. Thanks, Dan. You know, the CIA fulfilled for me just a personal mission to have a period of public service at the end of my law school career. I had committed that I wanted it to be practicing law. I had a lot of classmates who were going into investment banking or consulting and other things. I wanted to practice law. I wanted it to have an international component, and I wanted it to be that public service.

So I actually begun interviewing with a couple of government agencies, and one of them let me know the CIA was interested in talking to me and it really opened a door that I hadn't previously anticipated. I'm really glad that I had the CIA early in my career because I think it taught some really valuable lessons. I'll share two of them here. One is that the importance of the mission really helps to drive innovation in terms of thinking what are our options to achieve the mission.

The question doesn't become an easy thumbs up or down yes or no. Instead, it is how are we going to do it? And I think that lesson that I picked up early in my career at the agency has gone with me throughout the many things that you mentioned. The second thing I learned was really the importance of being immersed on the front line in order to understand how to make compliance or legal provisions relevant.

And that happened because really my first compliance training was on the use of force. And so I would go and train officers who are getting ready to deploy into theater in Afghanistan or Iraq. And at one point, the leader of the training program came to me and he said, you know, you're not bad for a lawyer. But he said, it's kind of obvious that you don't know a whole lot about guns.

He He said, I think it would be helpful if you came and did the entirety of the class because it would really make your training even better. And it was true. I mean, it's a great class to be part of. I enjoyed the experience, but it measurably improved, you know, the quality of my training.

And so throughout my career, those lessons keep going with me. Right? I wanna solve problems and I want them to be relevant to those who are really on the front line of the mission.

Jared, I love it that on a tech podcast you ask about human behavior because I think so often in both the legal profession as well as in tech, we sometimes think just very regimented and process oriented. But really, as we know, it's ultimately about does it work for human teams and human based organizations.

So, you know, one thing that's not in the list that Dan mentioned of my career is that I actually, before law school, had been involved in an international human rights organization. And when I made the decision to go from international human rights to CIA, colleagues said to me, hey. You're changing sides. And then when I went from the CIA to private law firm practice, colleagues at the CIA said, hey.

You're changing sides. And so it was always fascinating to me because I thought, I'm not sure what this thing is with sides. I learned from my own experience it has at least three sides. For me, it was never about one side or the other.

It was instead about a sense of vocation that I have to really try to cultivate cultures, motivate people to do the right thing and really achieve an objective that we're aligned on regardless of what organization we may be in. So I think, you know, one of the lessons in that is that there's a sense of tribalism. Even in very well meaning organizations, people tend to have a little pull toward a siloed sense of identity. And I that's not limited to, you know, commercial practice or to public service or to nonprofits.

It's really something that early on I was motivated to find the common threads that motivated us that we could work across and not be limited by.

Yeah. You know, it's interesting because, as I mentioned, we can sometimes segment ourselves and get a tribalist sense. But what was interesting to me across each of those areas of work is that sense of a belief in mission and a belief in wanting to get it right.

That regardless of where individuals are working, if they feel like they believe in what the organization is doing, it causes them to bring their best selves to the work. Right? And so from a compliance perspective, I don't want to be the hammer. And sometimes I hear compliance officers try to soften and call themselves a velvet hammer. Well, I'm neither of those. Right? I'm not looking to come down on any function.

My role instead is to say, let's cultivate a place, a culture where people are excited about what we're doing together. And if they have that, then they are more likely to want to do the right thing and to contribute to the organization accomplishing its mission. I think the way that data analytics comes into that is that sometimes in our mindset, we make assumptions, we have our biases about what an organization is doing and how many people are bought in, or we develop notions of how are things going. And data can help us to have a nice view, particularly as enterprises scale of, are our assumptions right? What do we need to do to make adjustments in order to both stay on focus for the mission as well as to be sure we're bringing people along?

Yeah. So it's really interesting, Jared, and it takes us back to maybe another CIA story. I still don't necessarily see myself as a data guy. Right? I have a humanities background. I began in college by looking at history and religion and eventually a little bit more to data through political science major. But in my early days at the CIA, and this may have happened to a lot of people who were in their twenties in the early two thousand, I had a manager come to my door and say, how much do you know about computers?

And my answer was something along the lines, well, you know, I kind of have the latest four gigabyte laptop and I know how to use it.

And his view was great. You probably know more about computers than anybody else here, and he handed me responsibility for the file related to satellite intelligence.

So it was really a jumping in the deep end pretty early on of someone who had a short tangential nexus with digital capabilities and data twenty five years ago, and yet very quickly saw the challenge for how do we make sense and use of large scale data sets that might have importance to the mission again. Right? So I think that began a process of seeing some of the value in it. When I moved not long after to a law firm, again, I was kind of at that place in the industry development where my first assignments were document reviews that were hard copy reviews, printed pages in bankers boxes.

And so very quickly, again, found myself working with the likes of you and the eDiscovery folks to say, how can we do this in ways that are more efficient, more impactful, and a better result?

Yeah. Thank you for that, Dan. So there's a couple things in the concept of human integrity, which is, as you said, it's currently a website. It's an invitation for conversation with others who would like to think along these lines.

The word is an amalgamation of HUMINT, which the intelligence community uses to refer to human intelligence as opposed to, like like, the satellite intelligence, which we call SIGINT and so forth. HUMINT is the human element that really makes the story and draws together the narrative across various sources. And so it's an amalgamation of that HUMINT with integrity. It also is intended to highlight a bit the role of human intelligence and integrity in a world where we increasingly have the benefit of artificial intelligence.

So as I said, I come from that humanities background, but I'm intrigued by this nexus because on one hand, I'm an enthusiast for the capabilities that advanced analytics and AI will bring to our lives going forward. And at the same time, I'm a bit of a naysayer against those who say it's going to replace all of our professions the next five to ten years because I think that we are going to continue to need that human insight, human experience to make sense of the data and the information and the output of digital tools.

So one thing I'm very careful about in my programs, for example, is I don't like to speak about a data driven culture or a data driven compliance program, but instead to say I want to have a values driven culture or values driven compliance program, but I want it to be richly informed by great data, great analysis, and supported with the appropriate digital tools.

So I've had the benefit of some of the early lessons learned of attempting to advance the database capabilities of companies to find the shortcomings that come if we don't adequately take into account the human element. I'll give an example. This goes back, you know, probably a decade where a large company was looking for the first time to try to gain insights through data across multiple affiliates that had previously had manual processes or isolated, you know, spreadsheets. And so for the first time, we were trying to bring that data together.

A high risk area in the pharmaceutical and biotech industry is our fee for service relationships with our customers. So often referred to as HCPs, the health care providers who write the prescriptions for our therapies may also be the ones who are providing advisory services back to the company. And that opens up a risk of kickback, undue influence, conflicts of interest, and so this is an area of interest. At the same time, we learned that the finance team had a GL code for HCP engagement that had been in use for a number of years.

And so we thought, hey, great. It's kind of low hanging fruit, a great opportunity to take a pre existing streams of data and put them up against a risk area, and let's quickly generate some insights. What we did, and you can probably see where this is going, is we kind of skipped a couple of steps on data cleansing alignment before we did that. And what we found out is that across world regions, different teams had used the same GL code to accomplish different things.

So in one place, HCP engagement meant hospitality, taking HCPs out to dinner. In another place, HCP engagement meant what we thought it did for my team, which was the consulting arrangements with them giving us services. And in yet another place, it was all the marketing spend, right, had been categorized under that even though there were other GL codes available.

So it's just a small insight in the fact that data ultimately, in order to get good analytics from it, we have to have good data and the data has to be appropriately characterized and all of that depends in some way on humans. Right? The humans who use the data, made the judgments about where they will send the data, and what queries they want to make from it. So for me, that is an example of when a company wants to move into advanced analytics and wanna do more with artificial intelligence tools.

We have to have a conversation about what do you really want to get from it, what's reasonable to expect, what is this going to deliver for you. In the case that I mentioned, I still think we did the right thing. Right? After we got the insights from HP engagement, we saw a lot across multiple affiliates in the globe that we couldn't see from our desks in the US based headquarters, and it still advanced the objectives that we wanted to do outside the project. It just wasn't a perfect tool that was going to be able to then learn from itself and get better and execute and take over the organization. Right? It needed ultimately a perspective that says, why is this making some sense and not complete sense and how can we bring human intelligence and data intelligence together for the best value?

It's a great question, Dan. There's so many challenges that we can pick a couple, and I'm sure more can come up along the way. Let me start with a really easy one, which is I've talked to some peers recently who are very excited about potentially acquiring an AI tool or a data analytics capability.

But there's this kind of first run recognition that in order to do data analytics, you have to have data. And I think for some organizations, they're just not ready yet to do data analytics because they're not either operating at a scale or have the previous systems or have made those structural decisions to have the right data in the right place. There's also then always in business enterprises the question of resourcing, right, and what is it gonna take. One of the things that I think is really beautiful about insights from data is that there's efficiencies gained when we're able to share data across the organization. So whether we call it the data lake, the data warehouse, the data lakehouse, whatever that is, right, That often a legal or compliance organization is seen as a bit of a cost center and may not be the place where an organization wants to invest in the coolest tools.

But if we have a perspective that the revenue generating arms in the organization already have certain data, there's data they're acquiring, using, there's insights and resources that they want in order to accomplish their mission, and then we use the same data to say what additional insights can we get about the organization's risk profile, about behaviors within the team. What can we do with the data we have? I think I've seen that be more valuable to the legal and compliance team than creating just a standalone legal or compliance data set, set of data inquiries and data dashboards.

So, Jared, your question goes to the point we referenced earlier that for me, really, culture is the most important aspect of compliance.

And I deeply believe the team members have to feel like they are part of the enterprise and committed to the mission in order for them to be comfortable doing the right thing. And so there have been times when my day job is to advance or develop a transformer compliance program, and yet there's some cultural impediment that is getting in the way of compliance being received. So the example you mentioned, I, one time, was in an organization where there was a bit of a us versus them between a couple of teams, And it was a challenge to getting the buy in that we needed for what we wanted to do from a compliance perspective.

And so we tried to think creatively about what are some areas of interest that bring people together, what are things that people do get excited about, And how can we then indirectly benefit from the excitement that they have about that thing? And so, the thing we came up with was music. And we put out to the organization from the compliance team a challenge that wasn't characterized. We didn't label it too heavily with compliance to detract from it.

We instead got a little bit of time slot on the town hall for the entire company and said, hey, a few of us in the company have this idea. We wanna create a company playlist, and we're gonna take nominations, and we're going to have voting on list. We want the songs that are nominated to really reflect what do you think about where we are as a company, or what do you think about our mission of our company? And so what it did is it brought the excitement that people have for music or for their various Spotify playlists and it got them to tie that in to how they felt about the company.

And then when we got to the event where we were announcing what the playlist would be and what the words would be, we also introduced, lo and behold, that the new compliance training this year was going to be thematically reflective of music as well. Right? That we're all in this band together, that we have a set list that we play from. There's certain rules that govern it, but there's also opportunity for ad libbing creativity.

And that became kind of the core of the branding for the compliance team. What playlist do we live by? And, of course, with that success, with that cultural buy in, and having really done something impactful with very little resource, it positioned us well to be a stakeholder when asking for financial resources to accomplish other things from a client's perspective. We had secured through a very fun little game, some cultural buy in that we were for the organization and that we were helping the organization accomplish its mission, which is sometimes, you know, a little more challenging for a legal compliance team to communicate.

So, yeah, thanks for the opportunity to remember that. It was a fun example. I don't know if it will replicate, right in my next step. I've heard other companies say they wanna borrow the idea and do it, but it was what was right for the moment, and it helped us as a company move forward.

Well, thanks, Dan. I may have been subconsciously influenced by some psy ops tip or something that I learned along the way. But what I'll really make a plug for with it is that I think it's really important that all stakeholders, whether it's a legal or compliance, the digital team or whatever, be at the table and plugged in with an organization to know what is the vibe, what is the energy or the challenges that the organization is experiencing so that the work that is delivered in those functions can be relevant to the outcome. There's couple of downsides that it can work, I'm sure, for me or for you.

If an organization says, well, we want a great data insights program, but they don't open the door to understand what are the business challenges, what are we trying to solve for, what are the personalities that we need to navigate. Right? Then you end up with a siloed off the shelf tool that may or may not be valuable for what the organization wants. And the same is true for legal or compliance services.

If it's simply, hey. Last minute, I've got a plan. Yes or no. The compliance officer is really limited in the value that they can add.

But if they're there enough to really understand, hey, what this organization could use as a come together moment around a playlist, that same, hey, what this organization could use or could benefit from in a compliance program, You know, the same seat that gives a view into both of those insights. And I can't take all the credit myself. Right? Kudos to a CEO who also happened to love music and people who got on board.

And it was a corporate matter. So we did end up having to have reviewers that some songs were not appropriate, certain language couldn't work. There might copyright rules to put in some on the playlist. I mean, all of those things are part of the story.

Right? But there really is, I think, a little bit of a case study in both cross functional and diverse thinking at the table together, as well as, you know, the principle of indirection. That sometimes to get something done, it's best to come at it from a side angle.

Yeah. Thanks, Jared. So, you know, in some ways, as in a lot of things in life, it was kind of a story of a few roles, maybe at least two, where in one organization, as I was taking initial steps toward data analytics, I was challenged to think about what are some of the major categories, the buckets, when I think of data to create a taxonomy around what are the principles that we have in common across a diversified business. Right.

What what are some of those things? And that helped us in the second company to then say, okay, what we've figured out is that even though there's different rules and regulations in different markets, even though there's different risks around different franchises within the organization, that ultimately there are a few core areas that can be bucketed into four or five things that we want to have insight into. So when we look to query data, right, that one of the benefits of where we are this time is that we're not simply, you know, in flat file world where you have to have the right column or the right row in order to find that data.

But instead, the ability to say, I wanna I wanna be able to query and map the data up to a number of this limited number of principles. And what we were able to do is to put those principles into a mnemonic device and then have that simple framework, it's called the focus frameworks, five key pillars that we wanted to be sure we got right and everything. And really have that framework be in our policies, in our trainings, in our monitoring checklists, and then in how we map the data to tell us stories or how we query the data to tell us what was going on in the organization. We had support to do it because we were at a place in a biotech company that really wanted to emphasize the tech part of biotech.

And so there was an appetite to invest in data across the organization, and there was also an appetite to invest in scalability.

And so those two things were not my own doing, and I really have to credit the organization and others for it. The insight that we brought to table from an appliance perspective is that we can buy into the data that you have. We can buy into the scalability that you have, and we can bring a rubric that will allow us to see what we need to see from a compliance perspective from your data. And there were a number of benefits that came from it that we anticipated, and then there were a number that were even more than what we expected.

Because two things. First of all, the COVID nineteen pandemic happened. And so the organization went from a largely field based human interaction sales team to people sitting behind their computers. And while that would have radically changed how compliance would have traditionally monitored or stayed ahead of what was happening in the business, Because we had these data pillars in place and we had a data warehouse that was feeding insights based on those pillars, the organization was able to pivot quite seamlessly in terms of keeping our eye on risk despite the changed sales model.

And then the second thing is that in the biotech industry, organizations so often rise and fall or rapidly expand and contract based on the clinical trial data. And so it can be very difficult for an organization to go through the upheavals that that involves from a human capital perspective, right, to rapidly expand and then to downsize. And in our industry, anyone who's who's been in it for a while has lived through that. Because we had built and planned early to have this data analytics framework, we were able to mitigate some of that.

Because the good thing about getting our data systems and queries right is that the scalability up or down tends to be much more facile than doing that with added human resources.

You know, Dan, while I had this one very positive experience that we shared, I have also lived through some of those challenges, right, where there's not always buy in. And one of the things that I think is really important for legal and compliance professionals to do is to slow down and take a lot of time upfront to think about their risk assessment, their prioritization of what they're going after, and then where they can show value with what they currently have and what data might enable them to do. So one of the first conversations that I had in the life sciences industry around data was a largely manual process where I held in my hand two printouts of two different data sources.

One was to take the sunshine or transparency data that our industry is required to publicly post. It goes to the Center for Medicaid and Medicaid Services every year. I took that data. And then on the other hand, I took a PowerPoint that had kind of our top ten customers.

The analysis was initially a visual one that I then manually represent, it, which says, look at the correlation between these. Why or why not? Do we see certain correlations?

And it would be important for us to know the answers to those questions before those questions are asked by enforcement authorities.

And so then when the question was, well, how do we get the answers to that? It was, well, it's either a very heavy lift to do this deeper manually or it's a fairly light lift to bring those data sources together into a visualization that we can have both now and in the future, year over year quarter, so that we can see trends in that. And I think that kind of incremental step, the establishment that here's somebody with humanities background that at least can put two pieces of data side by side and tell us a story that's relevant to the organization and then can show how as we go forward, the investment in additional data capabilities will allow us to better understand our business to mitigate risk and avoid costs, I think is the right approach.

The other approach that I have seen some try, but it's not great, is that they so want to participate in the data story that they identify one software as a service that tells them the data about one of their business processes.

And it gives them some nice bar charts and pie charts that's happening in that one space. And it requires a lot of capital, you know, a lot of social capital for them to get the funding to get that one thing in place. But then it turns out the ground shifts under them and that's not the most valuable place to have your resources. Right? So I think it's much better rather than investing in one particular tactic to invest in the capability and the growing of aggregated data set, whatever we call it, so that we can realize those efficiencies over time as the business evolves.

I think, again, that the element of a compliance program known as risk assessment is one that is often skipped over too quickly. We think about compliance in terms of policy, training, monitoring, perhaps investigations.

But that step back that says before I get to those things, I need to have an enterprise governance, the right stakeholders thinking together about the enterprise.

And then we need to have an assessment of what are the risks that we as an organization are going to face given the strategic direction that we're moving.

And to then say, what data resources do we have that correspond to those top risks, Or what could we do to get the insights we need on those particular risks? You know, it's a risk benefit calculation. It may not make sense to invest in a proprietary version of a generative AI tool that does some really cool things around, you know, helping to identify policy answers and helping to generate new policy guidance if it turns out that understanding of policy guidance is not your organization's primary risk. Right?

So I think that that's really important thing to not be swept up in the exuberance that we have as a culture around what's capable and ask first what do we need and then what capabilities correspond to that need. And then I think the other question is what data do we have or what data is available that makes more sense of the data we already have rather than building frameworks or building platforms that are potential, but that we'll need to come up with the data for in the future, which I've seen a couple missteps in that area as well.

So, Dan, I think that AI is already beginning to play a role across every aspect of a compliance program. We think often in compliance about seven elements. It turns out that depending on which authority we're talking about, there's different iterations of the seven elements. But essentially, they all have the need to do a risk assessment, the need to have people responsible and overseeing the program, and then it goes into policy training, monitoring, and so forth.

What I have seen particular to compliance within the compliance program itself is that AI tools are making valuable contributions at every one of those stages. So as I mentioned, you know, we've talked a little bit about oversight and governance, how you can see across the enterprise and you can know what your risks are. I think that there is some really key efficiencies to be realized in policy writing, which is a fairly laborious task and a fairly heavy lift. And a lot of the generative tools built on large language models, they can produce pretty good policies on a lot of subjects.

Put a caveat on that and come back to it because I think there's some gaps in it, but it's making good headway. In the same way, I think some of the image generating capabilities, AI image generators, are really nice complements to the training that we put forward as an organization. We often need to do a customization of the content of those trainings, but I think we have really increased the pace at which we can generate visually engaging materials to support a story. And then I think, you know, just going on and on, whether it's monitoring investigations, those are places where there's great capabilities, whether we're looking at emails, as Jared mentioned earlier, or expense reports.

The idea of a tool that can worm its way through the expense systems and identify anomalies or outliers and suggest that they be the focus of additional review has really reduced the amount of time that junior team members need to spend combing through export spreadsheets from financial systems.

The caveat that I threw on that earlier and mentioned is and this might lead to another topic just around what this means for the future of compliance. But I currently see AI tools as very efficiently doing the role of junior team members. And I'll give you an example of what I mean by that.

I recently was experimenting with ChatGPT to write a policy on pharmaceutical companies' charitable contributions to independent patient assistance programs. And so I'll make the story short, but it essentially required three prompts for me to get I first just said, give me a policy on the subject. And it produced a beautiful fourteen paragraph, had all the right, you know, layout of a nice looking policy. But it was the kind of policy that I would expect an enforcement authority to say, this is just paper. It's worthless. And it misses the biggest point.

I refined it with a second prompt that said, address these particular types of risks, and it got a little better, but it was still coming up short.

The third prompt, I gave it case names from settlements to consider the fact patterns, and it came out pretty good. Now that prompt engineering exercise took me about twenty minutes to get to a policy that might take a junior writer twenty hours or more to write. So there's substantial gain there. The challenge is that it required my experience and expertise to know its deficiencies in iteration one and iteration two in order to get it to iteration three and then put the finishing touches on it. And so I think that some of these tools are bringing great value.

We're seeing a nice direction of what they can do, but they will continue to require that human intelligence and human integrity oversight.

I'm greatly enthusiastic about what the tools are delivering.

I am also skeptical about the capability of tools to replace us in the next decade.

Thank you, Jared. Thank you, Dan. It's been fun to think with you and have this conversation.