This in a tweet is why I'd generally suggest that one aim for neutral good rather than lawful good with respect to business.
(I will acknowledge some discomfort that all businesses must be lawful when compliance professionals ask.)
Some examples of "Technically compliant is the best kind of compliant" from my personal experience, very much not coextensive with that of any current employer:
HIPAA requires workforce training. Management is not exempt. I was 100% of the workforce at my company when we (the royal we) instituted HIPAA-compliant services.
There is no requirement regarding the *form* of your training. You don't have to e.g. buy a course.
There is no requirement regarding the *form* of your training. You don't have to e.g. buy a course.
So I locked myself in a room for an hour, trained myself on my responsibilities under HIPAA using our company's standard curriculum which I had written, then had myself sign an acknowledgement that I had received training.
"You can't have expected that to pass muster."
Oh no, voice in my head, I structured it like that because I was virtually certain that no regulator in the United States would have an issue with that approach.
Oh no, voice in my head, I structured it like that because I was virtually certain that no regulator in the United States would have an issue with that approach.
Similar example:
*writes email*
Counterparty: "We need an official statement from your company about this."
*copies email to PDF file, enters header Official Statement From Company*
Counterparty: "Cool."
*writes email*
Counterparty: "We need an official statement from your company about this."
*copies email to PDF file, enters header Official Statement From Company*
Counterparty: "Cool."
Another extremely common example of strategic ambiguity is "What is your address?", where I often got *very* poindextery about "OK so exactly what do you need there?", because some of my addresses were e.g. in Japan and some were not, which sometimes had consequences.
e.g. "Oh we need the address of your main place of business."
Me: "Presumably you're OK with the mailroom?"
"Sure."
*writes down the PO Box in Chicago not the office in Tokyo*
Me: "Presumably you're OK with the mailroom?"
"Sure."
*writes down the PO Box in Chicago not the office in Tokyo*
(The one time this was extremely not OK was for an insurance company, which needs actual physical addresses for underwriting, but was willing to underwrite the mailroom for risk of fire and then add an additional office in Japan for no additional charge as a courtesy.)
Which, n.b., required asking three carriers (through a broker) "Will you write the policy to include claims incurred at our location in Tokyo in addition to the location listed on the application?"
Warren Buffett [0] was like "Sure, that's a thing we do."
[0] USLI
Warren Buffett [0] was like "Sure, that's a thing we do."
[0] USLI
