What this means

Seven common business model archetypes, each with its own risk profile. Subscription (recurring revenue, data retention and auto-renewal exposure). Transactional (unit sales, supply chain and product liability). Marketplace (matching buyers and sellers, contractor classification and safety). Freemium (free tier converting to paid, data privacy and upsell transparency). Licensing (IP and patents, antitrust and enforcement). Advertising (attention sold to third parties, privacy and content moderation). Hardware plus services (devices with recurring support, export controls and product safety). Most large companies run several at once, so "more than one of these" is often the most accurate answer.

Key terms

Subscription

Customers pay a recurring fee (monthly or annual) for ongoing access to a product or service.

Transactional

Revenue comes from one-time sales of individual units, orders, or services.

Marketplace

The company connects buyers and sellers and takes a fee or commission on each transaction.

Freemium

A basic version is free; revenue comes from converting users to paid tiers or add-ons.

Licensing

Others pay for the right to use the company's intellectual property, such as patents, software, or brands.

Advertising

Users get the product for free and the company sells access to their attention to advertisers.

Hardware plus services

The company sells a physical device and earns ongoing revenue from support, software, or consumables.

Who to ask

Your CEO or CFO

Try: Can you give me fifteen minutes on how we actually make money, the way you'd explain it to an investor?

If you can't get the time, your investor presentation or annual report opens with this. At a private company, pull a public competitor's 10-K; the business overview will describe the same model.

Why it matters

Your risk profile is your business model. Regulations are external and generic; the risks your model creates are internal and specific to you. Hybrid models compound, because each layer adds its own compliance profile and the intersections are where risk concentrates.

Where we covered it

What this means

A revenue stream is a mechanism for bringing money in, not a product. Subscription fees, services, licensing, and transaction fees are streams; the product names that sit on top of them are not. Ranking them tells you which mechanism the business can least afford to disrupt.

Who to ask

Your CFO or head of FP&A

Try: Could you walk me through our top revenue streams and roughly how they split?

The same person can tell you which streams are growing and which are under pressure, which is where cost cutting and shortcuts tend to show up first.

Why it matters

Each stream carries its own legal and ethical risks. Comparing your top three streams against your risk register almost always reveals a gap: the register is organized around regulations, while the money is organized around mechanisms.

Where we covered it

What this means

Customer concentration is how much of total revenue depends on a small number of accounts. A single customer above roughly 10% is usually disclosed by public companies as a material dependency.

Who to ask

Your CFO or head of sales operations

Try: How concentrated is our revenue, and which accounts would hurt most to lose?

Knowing the handful of accounts that matter most tells you where commercial pressure will be highest, and where your program needs to be most visible.

Why it matters

When one account carries a large share of revenue, the pressure to keep it happy can override judgment: side agreements, aggressive concessions, looking the other way on red flags. Concentration is a leading indicator of where rules get bent.

Where we covered it

What this means

A moat is whatever makes it hard for a competitor to take your customers. Brand (reputation built over millions of experiences), network effects (the product gets more valuable as more people use it), switching costs (leaving is painful), cost advantage (you can deliver cheaper), and regulatory barriers (licenses or approvals others can't easily get).

Key terms

Brand

Customers choose you because of trust and reputation built over time.

Network effects

The product becomes more valuable as more people use it, which makes it hard for a newcomer to compete.

Switching costs

Leaving is expensive, slow, or disruptive for the customer, so they stay.

Cost advantage

You can produce or deliver more cheaply than competitors, often through scale or proprietary processes.

Regulatory barriers

Licenses, approvals, or certifications that competitors can't easily obtain.

Who to ask

Your CEO or head of strategy

Try: What do you see as the thing competitors would find hardest to copy about us?

Leaders talk about the moat constantly. Asking signals you think about the business the way they do.

Why it matters

Compliance failures attack moats directly. A brand moat is erased by a scandal; a regulatory moat by a lost license; a network effect by a trust or safety failure. Knowing the moat tells you which failure would be existential rather than merely expensive.

Where we covered it

What this means

Net profit margin is net income divided by revenue: how many cents of every dollar the company keeps after every cost. It sets the exchange rate between spending and selling. At a 5% margin, a $1M investment needs $20M in new revenue to fund itself. At 25%, it needs $4M.

Who to ask

Your CFO or head of FP&A

Try: How have our margins trended over the last few years, and what's driving it?

Margin trends are the story leadership is already telling itself. Hearing it firsthand lets you frame every request in its terms.

Why it matters

The thinner the margin, the more a compliance investment has to prove, and the more a compliance failure costs in revenue terms. It also tells you how much pressure the business is under, which is when misconduct risk rises.

Where we covered it

What this means

A profit and loss statement runs top to bottom in six lines: revenue (what customers paid), cost of goods sold (what it cost to deliver), gross profit (the spread between them), operating expenses (salaries, rent, marketing, and your program), operating income, and net income. Compliance sits in operating expenses, alongside HR, legal, and finance — costs that keep running regardless of short-term revenue changes.

The answer: Operating expenses.

Key terms

Revenue

The top line: total money earned from customers before any costs are subtracted.

Cost of goods sold (COGS)

Direct costs of producing what you sell, such as materials, manufacturing, and hosting.

Operating expenses (OpEx)

The costs of running the business that aren't tied to a specific unit sold: salaries, rent, marketing, legal, and compliance.

Below the line

Items recorded after operating income, such as interest, taxes, and one-time gains or losses.

Who to ask

Your CFO, or whoever runs financial planning and analysis

Try: I want to understand our cost structure better so I can align compliance work to what actually matters.

Executives almost never hear that sentence from compliance, and the person who answers it is the same person who decides whether your next budget request gets funded.

Why it matters

Operating expenses are the first place leadership looks when margins compress. Knowing you live there is what lets you prepare a defense before the conversation starts rather than after the cut is announced.

Where we covered it

What this means

Program spend as a percentage of revenue is how finance compares you to other cost centers and to peers. Total it up: headcount, tools, outside counsel, training, and hotline. Across industries, programs commonly land somewhere in the 0.3–3% range, with heavily regulated sectors at the high end.

Who to ask

Your CFO or your finance business partner

Try: Can we look together at the fully loaded cost of compliance, including what sits in other budgets?

Much compliance spend hides in legal, HR, and IT budgets. Mapping it together makes finance a co-author of your number rather than an auditor of it.

Why it matters

If you don't know your number, someone else will calculate it for you, usually during a cost-cutting exercise. Knowing it lets you argue against cuts before they happen instead of reacting after.

Where we covered it

What this means

Net income is an accounting figure; operating cash flow is the cash that actually came in and went out from running the business. Over time they should move together. When profit rises but cash doesn't, something in between — receivables, revenue recognition, reserves — is doing the work.

Key terms

Operating cash flow

The cash actually generated or used by day-to-day business operations in a period.

Net income

Profit after all expenses, interest, and taxes, as reported under accounting rules. Also called the bottom line.

Revenue recognition

The accounting rules that decide when a sale counts as revenue, which is not always when the cash arrives.

Who to ask

Your controller or CFO

Try: How closely does our operating cash flow track net income, and what explains any gap?

Controllers rarely get curious questions from compliance. This one builds a relationship with the person who sees anomalies first.

Why it matters

Divergence is the classic signal of earnings manipulation, aggressive revenue recognition, or fraud. It may be legitimate — a large customer paying late — but it's always worth a question.

Where we covered it

What this means

Strategic priorities are the handful of outcomes the leadership team has committed to this year: the OKRs or annual goals that animate the operating plan. They are usually named in the CEO's all-hands deck or the annual planning memo.

Who to ask

Your CEO, chief of staff, or head of strategy

Try: I'd like our compliance plan to line up with the priorities you're driving this year.

Once your initiatives map to their priorities, every conversation afterward starts from shared ground instead of a request.

Why it matters

If you can't connect a compliance initiative to a strategic priority, leadership won't either, and it will be the first thing deprioritized. The priorities are also where strategy-derailing risks live.

Where we covered it

What this means

Businesses grow in a small number of ways: organically (new products and customers), through M&A (buying companies or technologies), through partnerships and joint ventures, and by entering new markets. Cost reduction isn't growth, but it often runs alongside it. Select every move underway.

Key terms

Organic growth

Growth from the company's own efforts, such as new products, customers, or sales capacity, without buying other businesses.

Acquisition (M&A)

Buying another company, or merging with it, to gain its customers, technology, or talent.

Partnership or JV

A formal arrangement with another company. In a joint venture, the partners create and co-own a separate entity.

Geographic expansion

Entering new countries or regions, which brings new laws, regulators, and cultural norms.

Cost reduction

Programs to cut spending, such as layoffs, consolidation, or outsourcing, often run alongside growth plans.

Who to ask

Your head of corporate development or strategy

Try: Which growth moves are in motion or on the horizon that compliance should be ready for?

Corporate development tends to loop people in by habit. Becoming a habit is the goal.

Why it matters

Every growth move imports new risk: an acquisition brings its history, a JV brings a partner's conduct, a new country brings new law. Knowing the move early is the difference between shaping it and cleaning up after it.

Where we covered it

What this means

Think of the last acquisition, market entry, major partnership, or product launch. The question is at what point compliance had a voice: while options were still open, while terms were being set, or once the deal was done.

Who to ask

The executive sponsor of that decision

Try: Looking back at the last big decision, where would an earlier compliance view have helped?

Framed as a retrospective rather than a complaint, it invites them to design you into the next one.

Why it matters

Due diligence that happens after the decision isn't diligence, it's discovery. Late involvement is how multi-million dollar surprises get acquired along with everything else.

Where we covered it

What this means

Sales pay is built in layers. Base salary gives stability. Commission pays a share of each deal. Accelerators raise the rate once a rep passes quota. SPIFs (sales performance incentive funds) are short-term bonuses to push a specific product or behavior. Management overrides pay managers on their team's total production. Select every layer that applies.

Key terms

Base plus commission

A fixed salary plus a percentage of the revenue from each deal the rep closes.

Accelerators above quota

A higher commission rate that kicks in once a rep exceeds their sales target for the period.

SPIFs

Sales performance incentive funds: short-term bonuses for selling a specific product or hitting a specific goal.

Management overrides

Commission paid to sales managers based on the total production of the reps they manage.

Quota

The sales target a rep is expected to hit in a given period, usually a quarter or year.

Who to ask

Your CRO or head of sales operations

Try: I want to understand how the team is paid so we can design controls that don't slow down good deals.

Sales ops owns the comp plan document. Seeing it once changes how you read every deal flag afterward.

Why it matters

Each layer incentivizes something different. Accelerators and commission cliffs reward pulling deals into the quarter. SPIFs reward pushing one product, whether or not it fits. Overrides reward volume across a team, which weakens a manager's appetite to scrutinize it.

Where we covered it

What this means

An override is any path that lets a flagged deal proceed: a discount beyond policy, a third party that hasn't cleared diligence, non-standard terms. The question is whether that path exists, who can use it, and whether it leaves a record.

Key terms

Compliance flag

An automated or manual hold placed on a deal because something, such as a discount, third party, or term, falls outside policy.

Documented approval

A recorded sign-off by a named person, creating an audit trail for why the exception was allowed.

Deal desk

The team that reviews and approves non-standard pricing, terms, and exceptions before a deal closes.

Who to ask

Your head of sales operations or deal desk

Try: Walk me through what happens today when a deal gets flagged. Who can move it forward?

Deal desk sees every exception. It's the most efficient early-warning relationship you can build on the commercial side.

Why it matters

"Yes, with no defined approver" is itself the finding: an override path with no owner and no record. Combined with overrides in manager pay, it's where oversight quietly disappears.

Where we covered it

What this means

Channel revenue is sold by someone who isn't your employee: resellers, distributors, sales agents, referral partners, marketplaces. They carry your brand, but they operate on their own incentives.

Key terms

Channel partner

Any outside company that sells or delivers your product on your behalf.

Reseller

A company that buys your product and resells it to its own customers, often at its own markup.

Agent

An individual or firm paid, usually on commission, to find customers or represent you, often in foreign markets.

Who to ask

Your head of channel or partnerships

Try: Which partners drive the most revenue, and how do we onboard and monitor them?

The channel team knows which partners are struggling to hit targets, which is exactly where risk rises.

Why it matters

Intermediaries are the most common route to bribery exposure; historically, the large majority of FCPA enforcement actions have involved third parties. Resellers can also misrepresent your product to close their own deals, and you own the consequences.

Where we covered it

What this means

Tier 1 suppliers contract with you directly. Tier 2 suppliers supply your suppliers, and so on down the chain. Most companies have good visibility into Tier 1 and very little below it.

Key terms

Tier 1 supplier

A supplier you contract with and pay directly.

Tier 2 supplier

A supplier to your Tier 1 supplier. You usually have no direct contract with them.

Supply chain visibility

How far down the tiers you can actually see who is making what, where, and under what conditions.

Who to ask

Your COO or head of procurement

Try: Which of our key suppliers depend most on sub-suppliers we can't see?

Procurement is often already worried about resilience. Pairing their concern with yours earns you shared data and a shared budget case.

Why it matters

Forced labor, sanctions, and environmental violations cluster below Tier 1, where visibility falls off sharply. Regulators increasingly hold you accountable for what's in your supply chain regardless of how many tiers down it sits.

Where we covered it

What this means

A data map records what sensitive information the company holds (customer, employee, health, payment, trade secrets), where it's stored — cloud, on-premises, laptops, phones, vendors — and how long it's kept. Data classification is the labeling system that makes the map usable.

Who to ask

Your CIO, CISO, or privacy lead

Try: Do we have a current data map, and could you walk me through where our most sensitive data sits?

Security and privacy teams often lack a business-side ally. You can be the person who helps them get attention and funding.

Why it matters

You can't meet breach-notification, retention, or cross-border transfer obligations for data you can't locate. Cloud migrations and new vendors move data constantly, so a map that isn't maintained goes stale quickly.

Where we covered it

What this means

An AI inventory lists every system that uses machine learning or generative AI to make or influence decisions — including features quietly added to existing vendor software. AI governance for compliance is about asking the right questions, not building the models. Bring these eight to every AI conversation.

Who to ask

Your CIO, CTO, or AI governance lead

Try: Which of our tools, including the ones we buy, now have AI built in, and which touch decisions about people?

Most organizations are building this inventory right now. Joining early puts compliance in the design of the governance, not the audit of it.

Why it matters

AI that influences hiring, lending, pricing, or eligibility carries discrimination and transparency risk under emerging law such as the EU AI Act and state-level rules. You can't govern systems nobody has listed, and regulators are going to ask for documentation.

Where we covered it

What this means

The reporting line is who the head of compliance answers to administratively, and whether there's a direct path to the board or audit committee. Regulators read it as a signal of independence and access.

Key terms

Reporting line

The executive the head of compliance formally reports to for day-to-day management.

Dotted line

A secondary, informal reporting relationship, often direct access to the board or audit committee.

Audit committee

A board committee that oversees financial reporting, internal controls, and often compliance.

Who to ask

Your GC or audit committee chair

Try: How do you see compliance's independence and access today, and would you change anything?

Your GC is a natural ally. Having this conversation openly strengthens that alliance rather than competing with it.

Why it matters

Prosecutors and regulators evaluating a program ask whether compliance has autonomy, resources, and direct access to the board. A reporting line buried under legal isn't disqualifying, but you should be able to explain why it works.

Where we covered it

What this means

A standing meeting is on the calendar regardless of whether there's an issue: a monthly one-on-one, a seat in a staff meeting, a quarterly business review. Ad hoc meetings during investigations don't count. Select every one that applies.

Key terms

CFO

Chief financial officer: owns budgets, financial reporting, and capital allocation.

GC

General counsel: the company's top lawyer.

CHRO

Chief human resources officer: owns people, culture, and employment policy.

CTO

Chief technology officer: owns the technology the company builds or relies on.

Business unit leaders

Executives who run a division, product line, or region and own its revenue.

Who to ask

Each executive's chief of staff or assistant

Try: Would a recurring thirty minutes each month work, so I can bring things to you early rather than urgently?

Chiefs of staff control calendars and context. Getting to know them is often faster than getting to the executive.

Why it matters

Compliance runs on influence more than authority. Standing meetings are where influence is built — when there's nothing to escalate, the conversation can be about the business.

Where we covered it

What this means

Activity metrics describe what compliance did. Impact metrics describe what it achieved in terms the business uses: dollars, exposure, and time. The test is simple: if a metric doesn't connect to a business outcome, it doesn't belong on an executive dashboard.

Key terms

Activity metrics

Measures of what compliance did, such as trainings delivered, policies issued, or calls received.

Impact metrics

Measures of what compliance achieved in business terms, such as dollars saved, exposure reduced, or time to detection.

Risk reduction

A quantified estimate of how much potential loss a control or program has prevented.

Who to ask

Your audit committee chair or the board liaison

Try: What do you read first in the compliance report, and what would make it more useful to you?

Directors are rarely asked. The answer tells you exactly what to lead with next quarter.

Why it matters

Reports that lead with activity make compliance look like a cost of doing business. Reports that lead with impact make it look like an investment, which is how budgets and influence get decided.

Where we covered it