Corporate Compliance Prof Blog

Document Shredding at the ACLU

In the wake of the Supreme Court’s Arthur Andersen decision, there was bound to be a few stories on document shredding at other organizations.  A story in today’s New York Times describes problems at the ACLU, which the report says “has been shredding some documents over the repeated objections of its records manager and in conflict with its longstanding policies on the preservation and disposal of records.”  The story emphasizes two points made in prior posts.  First, if you have a document retention/destruction policy, follow it.  The Times quotes a former ACLU archivist as saying:

"It has been shown in many legal cases over the years, including the Enron case, that if a company has an established and documented shredding program they will not be liable if documents at issue in a lawsuit are found to have been destroyed," Ms. Linde wrote in a 2003 memo. "If, however, the means for unauthorized shredding is present in the office we cannot say that we have made a good faith effort to monitor and document our records disposal process."

Amen.

Second, as noted in a prior post, corporate culture begins (but does not end) with tone at the top.  Consider this anecdote from the Times article:

[W]hen Anthony D. Romero, the executive director of the organization, casually mentioned to a group of employees in 2002, about a year after his arrival, that he had a shredder in his office, they were shocked, said two former employees who did not want their names used because they feared it would interfere with future employment. Mr. Romero was told it was a violation of policy, the former employees said, but no one pushed the issue.
. . . .
Ms. Linde wrote a memorandum voicing her concerns, so the A.C.L.U. sought advice from the law firm that handles its real estate matters in Washington, D.C. The firm forwarded a report that echoed many of Ms. Linde's points, and several shredders were removed, according to memorandums.
Mr. Romero kept his shredder . . . .

Of course, before making any comment, a couple of the usual disclaimers: we do not know if this story is true (Mr. Romero is not quoted in the article), and even if true, we do not know the full context.  That said, the Times report illustrates the type of situation where management’s actions can affect organizational culture.  If a credible document retention program is important to the organization, it is essential that upper management not give the impression (which very well may be divorced from reality) that the rules do not apply at the top.  The Stephen Cutler speech quoted in a prior post explained the corrosive effect such perceived hypocrisy can have on corporate culture.

Today at the Law & Society Association Annual Meeting

Here is a presentation from the Law & Society Association Annual Meeting on Saturday, June 4,
2005, that might be of interest:

10:15am - 12:00pm

Beyond the Public-Private Divide: New Paradigms for Constraining Corporate Power in the Age of Globalization
Amy Sinden (Temple University)

The treatment of corporations in both domestic and international law is premised on the idea that they are private, not public entities. Historically, one of the primary roles of the public/private distinction has been to distinguish those with power (the State) from those without power (private citizens). A widespread consensus views this power imbalance as necessitating the imposition of certain constraints on state actors as a matter of both domestic and international law in order to curb inevitable abuses of power. Well-accepted constraints, for example, include due process protections and transparency requirements. But throughout the globe, the line between public and private is blurring. Many transnational corporations (TNCs) now wield more power and wealth than most nations on the international stage. Additionally, we are witnessing an increasing trend toward “private” TNCs taking over traditionally public functions, like water supply. These trends suggest that power imbalance may provide a more useful lens through which to view legal standards than formalistic and outmoded distinctions between private and public. If that is the case, it may be helpful to apply principles traditionally employed to constrain state power in thinking about appropriate legal standards to govern TNCs.

The Regulators Speak: Tone at the Top

It seems that at every compliance CLE, the best attended and most active panels are those that present the regulators’ views on an issue of current interest.  This makes sense, given that much of what the “law” requires is determined by the government’s interpretation and enforcement priorities.  For this reason, I plan to note recent speeches by government regulators that shed light on the government’s compliance expectations.

To begin, I am reaching back to the end of last year, to a wonderful speech by Stephen Cutler, the former Director of the SEC’s Enforcement Division.  The speech was delivered on December 3, 2004, to a meeting of the General Counsel Roundtable; the topic was “Tone at the Top: Getting It Right.”  Cutler’s brief remarks offer one of the best articulations I have seen of what it means to
have an ethical corporate compliance culture.  Here are some of the highlights:

• We're trying to get the fundamentally honest, decent CEO or CFO or General Counsel - the one who wouldn't break the law - to say to herself when she wakes up in the morning: "I'm going to spend part of my day today worrying about, and doing something about, the culture of my company. I'm going to make sure that others at the company don't break the law, and don't even come close to breaking the law."
• You've got to talk the talk; and you've got to walk the walk. Both are critical to maintaining a good tone at the top.
• You have to talk about the company's ethical standards again and again.  Those standards have to infuse the day-to-day lives of your employees.  What does that mean?  Ethics and compliance should be part of your regular education and training efforts - and I mean efforts that go beyond perfunctory lectures about legal requirements, but embrace well-conceived, real-life situations and dialogue.
• And no double talk. You can't say to the broad audience that ethics, integrity and honesty are important, but ignore them (or worse yet, joke about them or dismiss them) when you're in a social setting, or "off line," or off the record, or when you're talking to smaller groups.
• All the words in the world mean nothing without deeds to support them.  You have to pay more than lip service to values.  You have to live them.
• [M]anagers themselves have to comply with the letter and the spirit of the rules.  Employees watch what their managers do as well as say - they scrutinize their every move and follow their lead.  If employees see managers bend the rules, they'll bend the rules.  That applies to the smallest of rules.  If all employees are required to attend the company's ethics training program, then senior management should be attending the training too.  They can't just say, "well, that's for the others, I don't need to do that."
• [M]ake integrity, ethics and compliance part of the promotion, compensation and evaluation processes as well. For at the end of the day, the most effective way to communicate that "doing the right thing" is a priority, is to reward it. Conversely, if employees are led to believe that, when it comes to compensation and career advancement, all that counts is short-term profitability, and that cutting ethical corners is an acceptable way of getting there, they'll perform to that measure.
• [M]ake it clear that you won't tolerate compliance risks - even if that means losing a lucrative piece of business or a client or a transaction.
• [H]old all of your managers accountable for setting the right tone.  That means disciplining or even firing them when they have failed to create a culture of compliance.

Today at the Law & Society Association Annual Meeting

Here are the presentations from the Law & Society Association Annual Meeting on Friday, June 3, 2005, that might be of interest:

8:15am - 10:00am

Hybrid Approaches to Corporate Governance Standards
Dimity Kingsford Smith (University of New South Wales)

In the last decade, an important new source of regulation has been added to the control of corporate conduct. It is the corporate governance standard. Whether part of stock exchange listing rules, or 'best practice' guidelines issued by investor bodies much reliance has been placed on the effectiveness of such standards. This is so in the politics of corporate regulation, and also the case in the growing literature on the best ways to get corporations to govern themselves. The introduction of these corporate governance standards can be seen in the regulation of corporations in most of the advanced economies. While there are some very good accounts of the 'soft law' style and content of these standards of private provenance, none analyse their legal or regulatory nature and effect. The aim of paper is to consider how these standards operate in hybrid ways with existing mechanisms of corporate governance, from both legal and non-legal orders. It is also to consider the strengths and weaknesses of these standards as a regulatory governance technique.         

12:30pm - 2:15pm

New Mechanisms in the Regulation of Business: The Role of "Corporate Social Responsibility"
Doreen McBarnet  (Oxford University)

The limitations of traditional regulatory control of business are well known and the issues of both non-compliance and creative compliance have been well documented. This paper explores alternative legal mechanisms which are being brought into play to control business. It also explores new trends in business itself, in civil society and the market, focussing particularly on the developing ‘Corporate Social Responsibility’ (CSR) movement, and asks: has CSR a role to play in enhancing the control of business?

2:30pm - 4:15pm

Narrating a Corporate Mens Rea
Aditi Gowri

As observers, scholars or jurors, we do not directly experience another’s guilty mind. Our judgement that a person is guilty of a crime of intent is contingent on what narratives of that event we find most plausible. In other words, mens rea is a legal hypostatization of cultural patterns of narrative about criminal motivation and will, character and plot. Corporations are legal persons possessed of rights and obligations. Yet the attempt to prosecute and convict corporations of many crimes has foundered on the supposed absurdity of a corporate mens rea.  This paper proposes that several new narrative elements may be required if we wish the idea of an intentional corporate crime to become more plausible. Most important, we might begin to tell corporate crime stories in ways that put the corporate person in the role of protagonist rather than victim, dupe, weapon, or setting.  Narratives in which corporate actors become protagonists may have correspondingly less space for human characters to take central roles; so we may have to recast some human protagonists as tools, weapons, or elements of background setting in these tales.

FCPA Compliance CLE from the ABA

On Tuesday, June 7, from noon to 1:30 pm Eastern, the ABA Center for CLE will have the next program in its series entitled “Hot Topics in FCPA Compliance and Enforcement.”  For those new to the subject, FCPA stands for the Foreign Corrupt Practices Act, which is a federal law that (1) imposes an accurate books and records requirement on public companies, and (2) prohibits all United States businesses and citizens (as well as a good number of foreign entities and citizens) from bribing foreign government officials to obtain or retain business.  Next week’s course is entitled “Compliance Trends,” and will cover:

• Effective FCPA internal compliance programs in the wake of Sarbanes-Oxley
• Impact of new laws in other countries on internal policies regarding facilitating payments
• Anti-money laundering compliance
• Special ethical issues for legal counsel

The program will be online, and registration is now open at the ABA’s web site.

Institutional shareholders turn attention to compliance

The Wall Street Journal reports today that “[a] group of institutional shareholders called on Wal-Mart Stores Inc. to review its legal and regulatory controls, citing recent lawsuits over the company's employment practices and a scandal over a top executive's alleged expense-account abuses.”  (Wal-Mart Urged to Review Controls, 6/2/05)  In a letter to the chair of the company’s audit committee, the shareholders claimed that “‘[r]ecent reports of legal and regulatory non-compliance raise serious concerns about the adequacy of the company’s controls . . . .’”  The letter asks that the board conduct a “comprehensive review” of the company’s compliance efforts, and issue a report and recommendations by December of this year.

Institutional shareholders have long pushed companies to tackle pet social, political, and corporate governance causes, often submitting their proposals to be included in a company’s proxy statement.  Popular issues have included labor practices, board election and composition, and executive compensation.  Here, we see shareholders flexing their collective muscle on compliance.  To my knowledge, “placating shareholders” simply has not been on the list of reasons to start or beef up a company’s compliance program.

So, what does this mean for compliance?  A few initial thoughts.  First, this development gives compliance personnel another argument for increasing the resources devoted to compliance – shareholders will demand it.  And if shareholders start focusing on compliance, how long will it be before some rating agency decides to evaluate and rate companies’ compliance programs?  (We have already seen the introduction of corporate governance ratings.)  Now that the warning shot has been fired, better to get out in front than to be caught behind.

Second, I wonder how such shareholder activism will play into the Caremark claim.  Can shareholders put a board on notice (by letter as here, or by shareholder proposal) about compliance problems, and then use subsequent board inaction as the basis for a Caremark claim?  If so, will institutional shareholder “proposals” become de facto directives?

Last, the Wal-Mart shareholders tapped into a hot topic among regulators and compliance professionals: corporate culture.

Karina Litvack of F&C Asset Management PLC in Britain added that Wal-Mart may have weakened its internal controls when it fired an employee who spoke out in the expense-accounting abuse case surrounding Wal-Mart's former vice chairman Thomas Coughlin.  “Independent directors need to demonstrate to shareholders that Wal-Mart hasn’t built an ostrich culture – where employees are better off sticking their heads in the sand than speaking up,” Ms. Litvack said.

In the new compliance environment, where “culture trumps compliance,” this is a comment no company wants to hear.  Putting aside its accuracy, the anecdote illustrates what we were told as children – actions speak louder than words.  The wall of corporate culture is built brick-by-brick, by thousands of day-to-day decisions made throughout an organization.  Cumulatively, those decisions educate employees about which actions and values the organization truly prizes.  If the organization’s culture is off balance, normal compliance fixes – like re-drafting policies and ramping up training – won’t right the corporate ship.

What does the Arthur Andersen decision say about compliance?

Kudos to Kurt Eichenwald for his piece yesterday in the New York Times (Analysis: Reversal of Andersen Conviction, 6/1/05) analyzing the Supreme Court’s Arthur Andersen decision.  He makes the much needed point that the Court overturned Arthur Andersen’s conviction based solely on an erroneous jury instruction, and that the decision did not address the government’s evidence.  Indeed, reading the Court’s statement of the facts (on the first five pages of its opinion), one wonders how well Arthur Andersen would have fared on a retrial.

I’ll return to the facts at the end of this post; let’s start with the Court’s legal decision.  The government charged Arthur Andersen under the following federal statute (18 U.S.C. sec. 1512(b)(2)(A) & (B)):

Whoever knowingly uses intimidation or physical force, threatens, or corruptly persuades another person, or attempts to do so, or engages in misleading conduct toward another person, with intent to . . . cause or induce any person to . . . withhold testimony, or withhold a record, document, or other object, from an official proceeding [or] alter, destroy, mutilate, or conceal an object with intent to impair the object’s integrity or availability for use in an official proceeding . . . shall be fined under this title or imprisoned not more than ten years, or both.

All parties conceded that the issue was whether Arthur Andersen personnel “knowingly . . . corruptly persuade[d]” someone to destroy relevant documents, with the precise meaning of that phrase being the bone of contention.  The government argued that “knowingly” and “corruptly persuade[d]” should be construed separately; knowingly refers to the person’s actions, and corruptly persuaded refers only to the effects of those actions. Under this reading, a violation would occur if a supervisor knowingly (but quite innocently) instructed an employee to destroy a document under the company’s document retention policy, as long as doing so would lead the employee (i.e., have corruptly persuaded the employee) to impede the government’s investigation.  The Court offered two examples of similarly innocent conduct that might fall within the government’s broad interpretation:

• Consider, for instance, a mother who suggests to her son that he invoke his right against compelled self-incrimination, or a wife who persuades her husband not to disclose marital confidences.  (p. 7) (citations omitted)
• Nor is it necessarily corrupt for an attorney to “persuad[e]” a client “with intent to . . . cause” that client to “withhold” documents from the Government [under the attorney-client privilege].  (p. 7) (citations omitted)

According to the Court, it was this broad interpretation that the trial court wrote into its jury instructions.

The Court rejected the broad interpretation in favor of a reading that linked the word “knowingly” to the phrase “corruptly persuade[d]”:

“[K]nowledge” and “knowingly” are normally associated with awareness, understanding, or consciousness.  “Corrupt” and “corruptly” are normally associated with wrongful, immoral, depraved, or evil.  Joining these meanings together here makes sense both linguistically and in the statutory scheme.  Only persons conscious of wrongdoing can be said to “knowingly . . . corruptly persuad[e].”  (p. 9) (citations omitted)

The actor must know not only that they are taking certain actions (e.g., instructing someone to destroy documents), but also that those actions are “wrongful, immoral, depraved, or evil.”  Of course, this still leaves the question of when a person knows that their actions have crossed the line from innocent to wrongful.  For example, must a defendant know that her instruction to destroy documents was illegal?  Or is it enough that the person delivered the instruction for the purpose of destroying evidence (as opposed to carrying out a legitimate document retention policy)?  What if the person sincerely believed that the order was technically legal because the government had not begun an official investigation?  The answer to these questions must await another day, as the Court simply punted: “The outer limits of this element need not be explored here because the jury instructions at issue simply failed to convey the requisite consciousness of wrongdoing.”  (p. 9)

What does all of this mean for compliance professionals?  The answer lies in a point no one in the case disputed: “‘Document retention policies,’ which are created in part to keep certain information from getting into the hands of others, including the Government, are common in business.  It is, of course, not wrongful for a manager to instruct his employees to comply with a valid document retention policy under ordinary circumstances.”  (pp. 7-8) (citations omitted) (Of course, “document retention policy” is quite the misnomer, given – as the Court acknowledges – that most such policies focus on document destruction.  That said, just think of having to defend a “Document Destruction Policy” against an obstruction of justice charge.)  So, ordinary operation of a document retention policy will not be wrongful or immoral (i.e., corrupt).  The key is to have the policy up and running like clockwork long before a legal problem arises.  That way when trouble occurs, nothing different need be said or done – just keep following the policy.  If, however, the document retention policy changes either in letter or practice after a problem arises, a skeptical regulator may infer that the change was due to wrongful or corrupt reasons.

With this advice in mind, let’s return to the facts of the Arthur Andersen case.  Consider the following excerpts from the Court’s opinion:

• On August 28, an article in the Wall Street Journal suggested improprieties at Enron, and the SEC opened an informal investigation.
• By early September, petitioner had formed an Enron “crisis-response” team, which included
• Nancy Temple, an in-house counsel.
• On October 8, petitioner retained outside counsel to represent it in any litigation that might arise from the Enron matter.
• The next day, Temple discussed Enron with other in-house counsel. Her notes from that meeting reflect that “some SEC investigation” is “highly probable.
• On October 10, Odom spoke at a general training meeting attended by 89 employees, including 10 from the Enron engagement team.  Odom urged everyone to comply with the firm’s document retention policy.  He added: “‘[I]f it’s destroyed in the course of [the] normal policy and litigation is filed the next day, that’s great. . . . [W]e’ve followed our own policy, and whatever there was that might have been of interest to somebody is gone and irretrievable.’”
• On October 12, Temple entered the Enron matter into her computer, designating the “Type of Potential Claim” as “Professional Practice—Government/Regulatory Inv[estigation].”  Temple also e-mailed Odom, suggesting that he “‘remin[d] the engagement team of our documentation and retention policy.’”
• [On October 17], the SEC notified Enron by letter that it had opened an investigation in August and requested certain information and documents
• On October 19, Enron forwarded a copy of that letter to petitioner.  On the same day, Temple also sent an e-mail to a member of petitioner’s internal team of accounting experts and attached a copy of the document policy.
• On October 20, the Enron crisis-response team held a conference call, during which Temple instructed everyone to “[m]ake sure to follow the [document] policy.”
• On October 23, . . . [Arthur Andersen’s lead Enron partner David] Duncan met with other Andersen partners on the Enron engagement team and told them that they should ensure team members were complying with the document policy. Another meeting for all team members followed, during which Duncan distributed the policy and told everyone to comply.  These, and other smaller meetings, were followed by substantial destruction of paper and electronic documents.
• On October 30, the SEC opened a formal investigation and sent Enron a letter that requested accounting documents.
• Throughout this time period, the document destruction continued, despite reservations by some of petitioner’s managers.

If there was an effective, functioning document retention policy, why all the “reminders” to destroy documents?  Did Arthur Andersen offer such reminders every time they spoke to an Enron employee?  (“Morning Bob.  How about those Astros?  Oh, and don’t forget about the document retention policy.”)  Or did the specter of a government investigation suddenly trigger interest in reviving a moribund policy?  And was the purpose of reviving the policy to make relevant (incriminating?) documents “gone and irretrievable”?  Regardless, the episode illustrates an important compliance maxim – to be truly effective, a compliance policy must be a living, breathing part of the organization, and not some corporate fire extinguisher sitting around until a legal fire flares.

Who is editor of the Corporate Compliance Prof Blog?

My day job is Professor of Law and Director of the Corporate Compliance Center at the South Texas College of Law, which is a free-standing law school located in downtown Houston. I wear three hats at South Texas that are relevant to this Blog. First (and foremost), I am on the teaching faculty, where two of my regular courses are a Corporate Compliance Seminar and Professional Responsibility. Second, I am Director of the College’s Corporate Compliance Center (more on that in a moment). And third, I am a member of the College’s Risk Assessment Group, which handles the College’s internal corporate compliance efforts.

A few words about the Corporate Compliance Center. The College asked me to start the Center about a year ago, and our mission is to serve the legal and business communities as an independent resource for education and research concerning business ethics and corporate compliance. In addition to sponsoring courses at the College, the Center conducts semi-annual compliance conferences (our next conference is scheduled for November 10-11, 2005) and supports research on compliance issues. The Center is currently undertaking its 2005 Best Practices Project, the first phase of which is an online Best Practices Survey that runs through the end of this month (more on the survey in a later post).

For the last six years, in addition to my work at the College, I have served on the faculty of the Executive MBA Program of the Mays Business School at Texas A&M University. I have taught the course on Business Ethics, which includes units on corporate compliance, corporate governance, business ethics, and social responsibility.

What type of content can you expect to see in the Blog?

Overall, as the prior posts suggest, the blog will cover legal and practical issues involved in designing, implementing, and operating an ethics and compliance program. Within that broadly defined universe, I plan to include posts in the following (non-exclusive) categories:

Compliance 101

Periodically, I plan posts for those new to compliance (though hopefully also of some interest to those long in the compliance tooth). The goal will be to highlight some of the basic compliance tasks (codes, policies, training, etc.) as well as the basic sources (Sentencing Guidelines, Thompson Memo, Caremark, etc.). In the end, I hope that the archive of these posts can form the beginning of a virtual compliance library.

Compliance Spotlights

Occasionally, when time and interest warrant, I hope to dive deeper into a given compliance topic. The focus could be on a compliance issue or practice, or on a specific industry or risk. The goal will be to provide a more detailed discussion and resources on the chosen topic.

Compliance in the News

This category is just what it sounds like. I will highlight compliance-related news stories as they come to my attention.

Compliance Developments

This category will be a sort of compliance current awareness service, summarizing recent enforcement actions, regulatory developments, and court decisions.

In addition to posts in these basic categories, I plan to provide regular updates on recent publications, upcoming conferences, and other goings on in the compliance universe. Of course, as you will soon get sick of reading, please contact me with any suggestions for information to post in each category as well as additional or different categories of posts.

Who is the Blog's intended audience?

In short, this Blog is written for anyone interested in the legal and practical issues raised by designing, implementing, and operating a corporate ethics and compliance program.  This audience has many potential members:

• In-house lawyers whose responsibilities include compliance.
• In-house non-lawyers whose responsibilities include compliance.
• Outside lawyers and compliance professionals.
• Law professors and students teaching and studying subjects related to compliance.

While much of the Blog’s content will deal with legal sources and issues, the Blog will not be written solely for lawyers.  My hope is that non-lawyer compliance professionals will find the content both useful and accessible.

What is corporate compliance?

Corporate compliance as a field grows out of the reality that business organizations can be civilly and criminally liable for the wrongdoing of their agents and employees.  While lawyers like to maintain the legal fiction that a business organization exists separately from its officers and employees, having its own distinct rights and interests, the reality is that an organization acts only through those same business people.  And the same power and discretion that these people have to do the organization’s business can also be used to break the law.  For example, a company that expects its salespeople to vigorously negotiate with buyers must give those people pricing authority.  That same pricing authority, however, could be misused to break the antitrust laws by fixing prices with competitors.  The challenge of corporate compliance is to design and implement internal controls that balance the desire to give business people the autonomy they need to succeed with the need to prevent and detect legal violations.  A corporate compliance program is the organization’s main tool in striking this balance.

A corporate compliance program consists of an organization’s code of conduct, policies, and procedures designed to achieve compliance with applicable legal regulations and internal ethical standards.   To do so, the organization must: first, create an ethical corporate culture that educates and motivates the organization’s employees to act consistent with legal rules and ethical norms; and second, to deter and detect violations through risk assessment, monitoring, auditing, and appropriate incentives.  The challenge is to identify and implement practical measures that best accomplish each task given an organization’s structure, culture, and legal environment.

The careful reader will have noted that the preceding paragraph mixed business ethics in with legal compliance.  This was no mistake, as ethics is increasingly seen as inseparable from compliance.  For example, the United States Sentencing Guidelines, which are one of the main sources of compliance standards (much more on the Guidelines in later posts), refer to an “ethics and compliance program,” placing ethics on equal footing with legal compliance.  Also, many organizations refer to their head internal compliance person as the Chief Ethics Officer or similar title.  This new focus is captured by a phrase I have heard repeated at recent compliance conferences: “Culture trumps compliance.”  The notion is that an ethical corporate culture is a necessary (though not sufficient) component of effective legal compliance.  No compliance program, no matter how well designed and funded, can operate successfully in a corporate culture poisoned by cynicism and distrust.  Employees will discount all statements regarding ethics and values as mere words, more evidence of corporate hypocrisy.

In sum, this blog will cover the practical and legal developments related to designing, implementing, and operating an effective ethics and compliance program.  In a later post, I will discuss in greater detail the various types of information I plan to include in the Blog.  And as always, I invite readers to suggest topics of interest.

Welcome to the Corporate Compliance Prof Blog

Welcome!  To start things off, I will have a series of posts that outline my expectations for the blog.  The posts will introduce the subject of corporate compliance, the Blog, and myself by answering a few questions about the Blog's planned scope and content:

• What is corporate compliance?
• Who is the Blog's intended audience?
• What type of content can you expect to see in the Blog?
• Who is editor of the Corporate Compliance Prof Blog?

To make the Blog as reader friendly and useful as possible, I invite feedback about topics, issues, and events to cover in this space.  Also, you will notice that the menu on the left contains links to compliance related resources.  I hope to expand this list as time goes by, so please feel free to contact me with suggested sources to include.

So, without further ado, let's get started.