By Marcella Lim
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In the intricate dance of GRC, it’s fascinating how we expertly track every dollar while the real threats slip by unnoticed. After all, who needs to worry about the physical supply chain when there’s so much digital money to monitor? Clearly, the ghosts in the machine are having a field day.
In the world of Governance, Risk, and Compliance (GRC), we’ve become exceptionally skilled at watching the money. We build sophisticated, data-driven systems to screen wire transfers, monitor transactions, and flag suspicious financial activity. But in our intense focus on this digital flow of funds, we often miss the physical reality: sanctioned actors don’t just need money; they need parts, technology, and resources. While we scrutinize the wire transfer, the ghost in the machine—the illicitly sourced microchip in military hardware or the sanctioned oil sold under a false flag—often slips through undetected.
This article argues that our traditional, bank-centric GRC frameworks are dangerously incomplete. By focusing disproportionately on financial transactions, we have failed to adequately address the immense risks within the global physical supply chain. This oversight is not a minor gap; it is a critical vulnerability that sanctioned regimes and individuals are actively exploiting, undermining the very objectives of our international security policies.
A Call from the Front Lines
This conviction doesn’t come from a textbook; it was forged on the front lines of the current global sanctions crisis. When the world responded to the invasion of Ukraine, I was the compliance lead for translating complex, rapidly evolving sanctions from multiple jurisdictions into concrete actions across a vast and intricate global maritime logistics network.
The core challenge became painfully clear: it’s one thing to block a payment, but it’s another thing entirely to identify and halt one specific container with consolidated cargo among thousands on a colossal vessel already at sea. The world’s GRC playbooks, largely written for the financial sector, felt inadequate. This experience ignited my motivation to speak out. We must:
Acknowledge our blind spot. The ultimate goal for sanctioned actors is often not the money itself, but what the money can buy. The physical movement of goods is a critical stage of circumvention, yet it remains a shadowy area for many GRC professionals.
Empower the human factor. The effectiveness of a sanctions program rests not just on an algorithm in a data center, but on a well-trained shipping coordinator, an empowered customs broker, and senior leadership that champions a culture of compliance. As I’ve seen in my work developing and deploying training programs across diverse operational landscapes, embedding this culture is our most difficult—and most vital—task.
Advocate for a new GRC paradigm in logistics. We must evolve beyond simple screening. It’s time to build a framework that embraces the complexity of modern trade.
From Theory to Reality: Why This Matters
The consequences of this GRC gap are not theoretical. The economic pressure on Russia demonstrates that when sanctions effectively target the supply chain, the impact is catastrophic. With imports collapsing, we see reports of Russian manufacturers cannibalizing semiconductors and other spare parts from dishwashers and refrigerators to use in military equipment, a stark illustration of supply chain desperation.¹ The Russian auto industry, heavily reliant on international parts, has seen domestic production plummet.
These are not the results of financial sanctions alone; they are the direct outcome of a crippled supply chain. This proves that focusing on physical trade is not just an alternative strategy, but a profoundly effective one. Yet, evasion continues because our controls have not kept pace with the threat. Much like in proliferation financing, bad actors use legitimate commercial channels, shell companies, and fraudulent documentation to obscure their activities, making detection a “herculean task” for any single company.²
A New Paradigm for a Physical World
To hunt this ghost in the machine, we need to adapt the fundamental pillars of compliance to the world of logistics. The U.S. Treasury’s OFAC framework provides the essential components: management commitment, risk assessment, internal controls, testing, and training.³ However, their application must be reimagined for a world of physical goods, not just financial data.
- Risk Assessments Beyond the Transaction: A maritime logistics company’s risk assessment cannot simply be about the customer; it must analyze the entire journey. Where are the goods coming from? What is the final destination? Who are the intermediaries, and do they have a history of diversion? We must assess the risk of dual-use goods and transshipment through high-risk jurisdictions with the same rigor we apply to Politically Exposed Persons (PEPs) in banking. The question is no longer just “Who are we dealing with?” but “What are we moving, and where is it really going?”
- Controls Focused on “Suspicious Activity”: Sanctions evaders are adept at changing company names and registration documents to avoid detection. Therefore, our internal controls must focus less on finding a perfect match on a sanctions list and more on identifying red flags and anomalous activity. Are the shipping routes illogical? Is the vessel turning off its transponder in a high-risk area? Are the goods being routed through known transshipment hubs without a clear economic reason? Is the declared value of the cargo inconsistent with the product? This moves compliance from a static checklist to a dynamic, intelligence-led function.
- Training Against Moral Disengagement: A policy is worthless if the person on the loading dock fails to enforce it. Often, rule-breaking isn’t a coldly logical calculation, but the result of irrational biases and what psychologist Albert Bandura calls “moral disengagement.” Employees tell themselves comforting stories to justify cutting corners: “It’s standard business practice,” “If we don’t do it, our competitors will,” or “No one was harmed.”⁴ Our training must directly challenge these delusions. It should use real-world case studies to demonstrate how a seemingly minor compliance lapse in shipping can directly contribute to major geopolitical harm. We must empower employees to be our first line of defense, fostering a culture where compliance is not a burden, but a shared responsibility for global security.
The physical supply chain is the circulatory system of the global economy. By continuing to treat sanctions compliance as a primarily financial exercise, we are ignoring a critical GRC failure. It is time to bring the same level of scrutiny, innovation, and commitment to the tangible world of trade as we do to the digital world of finance. The ghost in the machine is real, and we can no longer afford to let it roam free.
Citations
¹ Sonnenfeld, Jeffrey A., et al. “Business Retreats and Sanctions Are Crippling the Russian Economy.” Yale Chief Executive Leadership Institute, August 2022.
² Arnold, Aaron. “Understanding proliferation finance risk.” inCompliance, issue 65, 2023.
³ U.S. Department of the Treasury, Office of Foreign Assets Control. “A Framework for OFAC Compliance Commitments.” May 2, 2019.
⁴ Eccleson, Paul. “Don’t expect people to do as you wish.” International Compliance Association, 2022.