Podcast S9E9 | How to be a CCO with Natalie McManus

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:24
Welcome to Risky Women Radio. Today we have, I guess, what’s now becoming a book club edition, which is such a fabulous feature for us. The book is How to Be a Chief Compliance Officer, turning compliance into a competitive advantage. So let me just set the scene and give some background before we bring in today’s guest. Some of the comments on the book already show why it is a must read, and you will know more at the end of this podcast, but compliance is one in the shades of gray. This is an excellent guide, along with that elusive but critical path, a must read for the C suite and all leaders operating in today’s complex regulatory environment. What a practical bible to have for any compliance senior leader. How to be a chief compliance officer is the sixth book in the How to Be a C-suite series, and hopefully many of you remember it from other things that we have already done. It’s an essential guide to leading compliance under intensifying social scrutiny, regulatory complexity, AI disruption, and of course our ever present geopolitical uncertainty, so hopefully many of you are familiar with the How to series we covered in Series 6, Episode s7 of this podcast. We had the fabulous Jennifer Geary join us to talk about how to be a CRO, and hopefully many of you know Jennifer is a fabulous Risky Women ambassador, who you’ll see speaking at many events around the globe. She also did an amazing rev up session for us on how to write a book, which I thought was incredibly interesting. If we all think there’s a book in us, you should go back and listen to that session, and if you want to continue to build your knowledge and upskill yourself, which is continually important, you can check out all of Jennifer’s C-suite training programs that are in the Risky Women Academy, but today we are joined by Natalie McManus Barnett, who is the co-author of How to Be a Chief Compliance Officer. She’s also the founder of Compliance and Risk Thought Leadership Consultancy Innovate Compliance. Natalie is a passionate writer on compliance and ethics, and a frequent contributor to the Journal of Financial Compliance. A former compliance chief of staff at Citibank and an ex-regulator for the Financial Conduct Authority, Natalie has worked in the UK, EMEA, and global compliance and risk management, technical and leadership roles across different tranches of financial services and aviation. Natalie was shortlisted in the Women in GRCs Compliance Leader of the year in 2026 She is a non-executive director for the Institute of Employment Studies, as well as a former chair of the Institute of Chartered Accountants in England and Wales Business Law Committee, a Fellow of the Association of Chartered Certified Accountants, and a Fellow of the ICA. Natalie holds specialist qualifications in sustainable finance, sustainability accounting, and data, a BA on in politics, philosophy, and economics from the University of Oxford, and further degrees in law and applied accounting. So, welcome Natalie, and we are welcoming you from Tokyo. So great to have you here. Hi.

Natalie McManus 4:02
Yes. Hello from Tokyo. And it is still daylight, because, of course, we are having an Asia call today, which makes a nice change from 10pm Noon calls my end. But lovely to be here. Thank you so much for welcoming me on.

Kimberley Cole 4:13
No problem at all. Now I’ve sort of given a summary of your CV, but I’d love to hear a bit more about your career journey so far.

Natalie McManus 4:22
Yeah, sure. So, I’ve said this before. I’m a big advocate of the Jungle Gym career. I like to call myself a Renaissance woman, because I have a tiny little bit of an ego, and saying you fell into your career doesn’t quite sound so compelling. But ultimately, I like to dabble, and I think it’s really amazing when people have these careers where they just go, that looks interesting, and take a next step. And throughout my career, I’ve had really fantastic people who’ve just nudged me in just a slightly different direction to the one I thought I was going to take. So, no one, at least when I was a graduate, chose compliance, and I won’t say, “Oh, it chose you, they fell into it. They fell into it because they didn’t go through the legal pathway or the accounting pathway, and frustratingly, I ended up doing both at night school because I’m just a glutton for punishment. So, for me, joining the Financial Services Authority before it split into the FCA and the PRA was just a natural rejection from not making onto the civil service bar stream, so it’s a great lesson in how you think you should go one way because that’s what everyone tells you to do, and actually you’ll go another way and find so many more opportunities that no one knows are fantastic until they do them, and compliance sounds dull, it sounds prosaic, and actually I have a real issue with the PR around compliance as a discipline, we’ll get into that in a moment, but it’s not, and it’s not when you remember that compliance is actually fundamentally about people, and people are imperfect and messy, and they make weird decisions in times of stress, and they make bad decisions, or they don’t necessarily know why they’re doing what they’re doing, and for me finding a career path that explored that tacitly was one of the great takeaways of where I’ve come from, so you’ve done a great job in bringing to life what is quite a polished CV, but ultimately for me the career path was one of finding people who took the air out of the room when they spoke, so I moved into client assets because the incredible Fiona King, who I think is now head of the Jersey Financial Regulator, I might need to check that after the podcast, make sure that is correct, but she was speaking and she was electrifying, so I said I want to work with her, so I did, and then from there I met someone who said, well, if you want to do this properly, you need to be an accountant, so I did, and then from there it was, well, have you thought about looking at the Lloyd’s insurance market? It’s quite interesting, so I did, and it was only when I set up my own boutiques that I realised that was the first time I’d made a career decision for me, and it was in the face of people saying do something differently, so I had other options, and I thought, no, for the first time in my career, I’ve got 20 years of experience in this. I want to be the one who takes the air out of the room, not the one listening to others. And I think we’ve all had this experience where we work for phenomenal companies, but they have party lines, and I didn’t want to follow a party line anymore. I’d found my own vision of compliance, and I wanted to share it with the world.

Kimberley Cole 7:23
I love that, and I mean one of the things that I love about the podcast is we always start off with the women’s career journeys, and I just think so different and so inspiring. So I think this is a great tool for all sorts to listen to and go, oh, that’s an interesting thought.

Natalie McManus 7:41
Oh, well, if I can pay it forward, I’d love that, because I wouldn’t be here if it hadn’t been for some women, and predominantly women who just pushed harder than perhaps I felt ready to be pushed at the time. And then I sat on it, reflected, came back, and went, “Why was that a knee-jerk no rather than a yes? And they were still open to pushing me forward, so, and I know normally we wrap up with, or what are the takeaways for young women and men trying to move forward with their career, but for me it was very simply, do things that you’re curious about, build a portfolio of works that you love, do the daily grind as well, and sooner or later your portfolio will speak for itself, and someone that you didn’t know you impressed will remember you five years down the line. For me, there was a moment where I was working on the nearly thankless – I was doing the MISA 2 complaints upgrade for Citibank for our EMEA, and it was thankless, and I thought no one noticed it, and I worked very, very hard on it. And then three years later, someone said, “I remember that piece of work that you did. You want to do this piece on sustainability? And that changed my career. And so, never feel like it’s wasted effort. Be curious. Interestingly, one of the pieces of feedback I always got through my career was, “You don’t stay in your lane, and I knew it was time to leave Citibank when that became seen as a criticism rather than a benefit, so for me that’s who I am in a nutshell. As I meddle, I enjoy making things better, and I like to think I do it with respect. My company has this thing called polite disruption that we like to advocate for, but ultimately, if that’s no longer the brand of the company you work for, then you part ways, and it doesn’t mean either one of you’ve got it wrong. It just means you’re no longer a fit, and having 20 years of maturity to realise what’s right for you, as opposed to what’s right for someone else, that’s a real kind of defining moment, I think, for me in your career. It’s not just maturity, it’s purpose, and it’s something I think was really hard won with me. I spent too much of my career being too focused on pleasing my boss rather than pleasing me. And you should always make your boss look good, like rule one in this game is make your boss look good, but there comes a time when you have to say, am I shrinking to let someone else be bigger, and if the answer to that is yes, then you have to really re-evaluate if you’re getting what you need out of the job that you love.

Kimberley Cole 10:07
Well, I think that’s so many good career tips in there. I love the polite disruption, because I was actually told by someone, which I love, that I was constructively disruptive. So, I think kind of good as well, like it wasn’t seen as a negative, it was, and I, you know, people have got to grasp that if you’re outside your lane, I love that, but yes, got to be in the right fit for the organisation. So, I mean, you’ve got some terrific ideas of how you’re thinking about compliance as a philosophy and as a framework, but let’s kick off. Let’s talk a bit about that, but also let’s start with what drove you to write How to be a Chief Compliance Officer, and obviously you did that with the fabulous Jenny Geary, who’s written all of these other how to be a chief risk officer, how to be a chief operating officer, and the whole C-suite Framework, so talk about what did you learn from Jenny, obviously in getting involved in this project, and how did you bring together your careers, your leadership, the things that you’ve done along the way.

Natalie McManus 11:15
So this is the one moment where I’m grateful that Jenny couldn’t join us today, because I think she would probably cringe with the praise I’m about to shower on her, but Jenny is a very rare leader who really shows, doesn’t tell. She’s a phenomenal ambassador. I can absolutely see why she’s an ambassador for Risky Women. She, I can say this with a straight face, she changed my life by coming into it at the right moment with the right vision. I would have written a compliance book, probably quite a technical, inferior book to the one we wrote. I was planning on doing that when Jenny said, “Oh, so am I,” and we put our heads together after meeting by chance on a Women in Banking and Finance panel, that again it felt serendipitous, and she had this wonderful holistic view of the world, and she’d really refined it over time with her books, and I had this sense of real frustration with the way the world was, and wanted to make it better through things I’d observed. And so we met in the middle, and as a consequence, I think created something that is very rare in this world, which is a playbook, a practical guide for how to do things well, that doesn’t preach, it doesn’t say this is the right way to do it. It says this is what we’ve explored, and this is how we’ve shaped it into a vision for you, but you’re the one who has to take it forward in a way that makes sense for your organisation. And Jenny wanted to write a leadership book, I wanted to write a book for any compliance officer, and we somehow managed to do both, and if you’d asked me at the start, if we’d manage it, I would have said no, that’s impossible. We also made a decision early on that we wanted to write an industry agnostic book, and we felt there were universal compliance principles that just got missed, and we felt that financial services gets the attention on compliance, and actually, there’s an assumption that it is golden standard, it’s best in class, and in many ways it is, but it’s also, I think, starting to erode in places. It’s starting to chase its own tail a little bit, and there are practices from aviation and pharma and engineering worlds where actually they do it much more agilely, much more dynamically, and I feel that we could see this beautiful virtuous benefit from bringing together those perspectives. So when we talk about compliance as a philosophy, we’re talking about compliance as a mindset, compliance as rooted in people, in our imperfect messy people, we’re talking about compliance that is shaped by behavioural psychology, we’re talking about compliance that is shaped by accounting theory on controls. We’re talking about shaping it on risk management life cycles, so it’s not just here’s your operational manual for how to do compliance, it’s here’s some ideas for how to think, and one of the things that I really wanted to emphasise through the book is the best compliance officers are not the ones who get invited to the room for an opinion, that’s fantastic, and that’s what we strive for as compliance officers, but the best ones are the ones who create environments that mean it doesn’t matter if you’re not in the room, because the leaders are making compliance decisions for themselves. So when you are outsourcing your ethics, when you are outsourcing your compliance decision making, your compliance advice, you’ve got a problem. And again, we get into this in the book, there’s a real kind of question of compliance versus legal. What’s the true kind of regulatory advisory position? If you speak to a general counsel, they will tell you that they are the advisor. You speak to a chief compliance officer, they may have a different view. So, who are you going to? And the answer to that question is whoever you trust. So, yes, you will always need legal advice on matters of nuance. You will always need compliance advice on matters of nuance, but if you are asking a fundamental question of what is the harm, what is the purpose, why do I think rules might exist in this situation. Then you’re probably 80% of the way there to figuring it out for yourself. And in the world of leadership, you’re not looking at the here are the 100 very prescriptive rules around how you do reconciliation, here are the prudential rules around how you calculate capital adequacy. Other people are doing that for you. At the leadership level you are asking more fundamental questions than that, which is, have you set back, and are you asking whether what you’re doing is sustainable for the organisation? So we wanted to talk about compliance through the lens of sustainability. We wanted to talk about it through the lens of operational resilience and financial control and culture and conduct and people leadership, and it’s funny how the best compliance books don’t often have the word compliance in the title, so for me compliance has evolved into something far beyond what it was 20 years ago, when I started my career. You will still find checkboxes, you will still find checkbox compliance, and that is compliance that is performative. But organisations that do compliance well, it’s ingrained in their DNA, it’s ingrained in the desire to be safe, it’s ingrained in the desire to put the customer first, and to create return, repeat business, manage their cost of capital, and to basically be good actors. So that’s the book we wanted to write. So I should caveat that with one thing. So one thing that was very important for Jenny and became very important for me was that we started the book following the same framework as the other C-suite books, with a focus on culture and execution and strategy, they really anchor what you’re trying to do. They create purpose, and if you don’t have a compliance programme with purpose, it will fail over time. So, using the culture that you have to get things done, acknowledging if you’re an entrepreneurial culture, you’re not going to put a big bureaucratic compliance function on top of your organisation. It won’t work. There won’t be synergy. The organisation strategy defines what your compliance risk is. So, if you are not plugged into it, if you do not fundamentally understand the business, the business model, how it makes money, then you will not understand the compliance risks within the business. And then, of course execution, which is where our 365 model hits the road, which is how do you operationalise compliance, and that’s looking at established theories of compliance and risks, but also that’s where we created one of our own.

Kimberley Cole 17:36
I think it is, as you say, it’s a leadership book as much as something for compliance leaders, so it’s fantastic, and you said so many interesting things there, which hopefully we’ll touch on again, but best practice and trust, people go to those that they trust, that comes up all the time in every podcast and discussion that I have, but I love the whole structure of I think the C-suite series has a very nice easy structure that everyone can then put their arms around and use, so I think it’s great that you’ve sort of used some of that, but I can see that there’s lots of different things in this episode, if you like. And the other thing I absolutely love is you position compliance as a competitive advantage, and you kind of kicked off around that, saying that you know compliance had bad PR. I think this is a great lens, but how do you get organisations to build that mindset?

Natalie McManus 18:36
See, if we could bottle this up, I think we’d sell it for millions, because this is the million dollar question, and I think the answer is big things and little things. So the answer is not go and buy next book on compliance frameworks and copy and paste it. It’s not that. The answer is tell the story. People don’t like being told what to do. So much so that we have fairly antagonistic cultures sometimes with compliance officers feeling like they can’t get traction because it’s seen as that adversarial, you’re telling me what to do, I know my own business better, and I don’t trust you. Again comes back to trust. So, for me, positioning compliance as your trusted advisor is fundamental to building better outcomes for the organisation, and that sounds like a bit of a buzzword, but actually it’s really foundational, and it’s proven in the little things. So, the big things are, are you tying your compliance mission statement up with your organisational purpose to make sure that you’re spending your time and your limited resources in the right place for the risk profile of the organisation, but the little things are things like did you anticipate the needs of the person you were talking to, did you make time for them, did you take your ego out of the relationship that you have with them, and did you empathise with whatever commercial pressures they were putting themselves through in that moment. So the best compliance advice that landed with me wasn’t necessarily the most perfect advice. It was the advice that recognised the moment was right to hear it, and recognised that my most important meeting of the week was their least important, and so I had to be smarter and sharper with the three minutes on the agenda that I got when they dedicated 57 minutes to whatever was actually top of mind for them, so you need to be compelling, and we can talk about data and how data is enabling that, but we really need to anchor it back in people, in understanding why people make decisions, and how you can be relevant to the decision. So if compliance is not part of the decision making process, it is not relevant. It will always be seen as a fact checker, a post facto, did you follow the rules, rather than a did you enable us to expand our business in that geography or follow that product’s expansion? We had this issue getting these people on-boarded, did you help us solve the problem, as opposed to, did you create more problems for us? And I talked about this briefly. Obviously, there’s certain things on enhanced due diligence and vetting going on in the news around certain people, and it’s a great example of how if the decision has already been taken before you do the compliance analysis, there’s no point doing the compliance analysis, because it will not change the decision. So, fait accompli decisions destroy compliance. So, if you want to make decisions that are in the best long-term interests for the franchise, compliance needs to be in the room when the decision is taken, and the really important thing there is it doesn’t have to be a big C compliance officer. Again, it’s did the compliance questions get asked and discussed, was there a reasonable response to that? Not who did the asking. Again, got to take the ego out of the room.

Kimberley Cole 21:52
Yes, I think once again great leadership principles in all of what you just said that can be used across different industries and areas, and yeah, really, really interesting, and I mean, you’ve sort of touched a bit on it there, but you talk more about it’s not being a one size fits all, you’ve talked so you’ve looked across different industries for compliance models, but where do you think organisations often take a wrong turn when they’re trying to build out their compliance programmes?

Natalie McManus 22:20
I think there’s a question of proxy dynamics. It is much easier to say, here’s my document, here’s my policy. It’s much easier to say, here’s my training on X date. I did this training on this policy to this person, done, evidence, move on. That is much easier than saying, did the training embed, did the policy make sense, did it fit the organisation. If you spend more time getting your policies right at outset for the people you have and the processes you have, then you’re not constantly playing catch up, fighting these small fires of really quite irrelevant things, policy breaches that happen, which actually should never have been in your policy in the first place, because they were just slowing down your business. So again, if I think about where organizations get it wrong, I think the main thing for me is the lack of dynamism in a compliance programme. It’s a sense of if I’ve written it down, I’m okay, I’ve covered my proverbial ass. Literally, there is a CYA audit file in any audit team, they may not call it that, but they will have one. It makes compliance an audit function, and there’s the real kind of drive behind regulation that forces that, because you have to be seen to be compliant as much as you are compliant, and your regulators have to have faith in you, and if you don’t have written down evidence, it’s really difficult to do that, but as a consequence, people write down the wrong things, and I talked about performative compliance. You look at two of the cornerstones of a compliance programme, you look at monitoring and risk assessment. Compliance risk assessment is almost always out of date the moment it’s done. It’s usually done on poor or no data. If it’s done by your compliance advisors, it probably has a sense of nuance to it, but the more you ask them to write it down, the less they can display that discretion and nuance. So, there is always a tension between what you document and what you do, and obviously documenting things slows things down, but with risk assessment, it’s particularly bad. It can go through really long quality assurance process, you know. Compliance risk assessment is exactly the same problem as an enterprise assessment. If you’re not doing it dynamically or fresh data, if you’re not empowering the people who actually have the insight to make the decisions, then don’t even bother doing it. Risk assessment is required by a lot of financial services regulation, especially in Europe, you know, there’s an expectation that there are actual rules that you will do it, and you will demonstrate it. And again, it’s form over substance, because the reality of risk management is it’s done in water cooler moments, it’s done before the meeting that got minuted happens, because you wanted to condition the room to get a good outcome. So there’s still a backward thinking from regulators sometimes, which creates that pressure on compliance officers to just write it down, but I think there’s also a bit of fear and a bit of overwhelm. The world of compliance has changed, it’s complicated, the amount of regulations you need to comply with, even if you are not in a traditionally conventionally regulated industry, it runs into the hundreds of compliance risk areas. We map it out in the book. We’ve created a taxonomy of 10 compliance, universal compliance risks, and they break into 145 different areas of compliance regulation, and that’s assuming you’ve got maybe one or two employees and you’re selling a product, so by the time you get into the nuance of what that product is and where you’re selling it, that rule set just grows and grows and grows, and so if you don’t have enough resource, if you don’t have the space as a compliance officer to zoom out and think about the picture that you’re operating in and around, then of course you’re going to default to doing things in more of a checklist way, because it gives you structure, but it’s not necessarily the right structure for your organisation. So going back to Jenny’s mindset of start with culture, start with strategy and execution, if you can create a framework after you have evaluated your organisational design, your organisational direction. Then you’ll find something more agile, more lean. And there’s one area in particular where I have seen this done better outside of financial services, and that’s the integration point. If you’re not in financial services, you’ll come across decentralised compliance models a lot more, and they’re models where compliance expertise is embedded in the organisation that is responsible for the behaviours that create the risk, and there’s a sense of empowerment about that. There are some independence challenges with that, which we can come back to, of course, but ultimately the person responsible for customer protection compliance is the person responsible for the customer centres, and so we see it in financial services with the accountability regimes of, well, you’re responsible for compliance in your area, but then we still have an independent compliance department that’s quite large, bureaucratic, that supports it, so again, there’s a disconnect between what people are doing, what they say they’re doing, and sometimes what they think they’re doing, and so if you’re not pulling that all together, if you’re not basically shining a light on what you’re actually doing, then you’re really going to struggle to change it.

Kimberley Cole 23:06
And I think you know, I love how you’ve centred around the compliance 365 model, which is sort of touching on here as well, and you’re putting compliance risk management and the sort of CCO and CRO partnership at the heart of the design. So, tell us more about that compliance 365 model. Tell us about, you know, how it works in practice. Are there parts that are aspirational, or it really is perfectly achievable for everyone?

Natalie McManus 25:47
I think if you look at the impact wheel, which is the six in our 365 model, it might intimidate you, because it shows that the universe, the ecosystem of compliance activity, is huge, but actually all it’s doing is shining a light on things you’re probably already doing. You’re just not necessarily calling compliance with a big C. For us, the 365 model, it was an organic evolution out of the three lenses that Jenny brought and the regulatory risk cycle that I brought, which again turned into the impact wheel, underpinned by five pillars of governance, operations, advisory, data, and tech, and essentially the model was simply shining a light on what you have or what you might not have and what you need to connect up the different processes of compliance in a way that generates the most intelligence and creates the most dynamism. So, are you doing horizon scanning? Yes, probably somewhere someone is doing horizon scanning. Are you joining it up with road change management, even at big banks? I’m not sure they’re still there yet. Are you then feeding that into your risk assessment, are you doing post implementation reviews on what changed, or are you waiting to year end to do a risk assessment that’s backward looking, and then reverse engineering your monitoring programme, because you can only audit controls anyway. So, for me, the 365 model is actually centred on one principle, which is your risk assessment should be the beating heart of everything that compliance does. It should generate your reporting to the board. It should generate your stop-go decisions when you’re thinking about taking on new activities. It should generate your monitoring plan, and these are principles that compliance practitioners will pay lip service to, but they won’t be doing in practice. So, by pulling out the impact wheel and showing how all these different spokes of activities connect up, we’re giving people the tools to build something for themselves. So, the three lenses help you think about what the organisation needs and what tools you have at your disposal. The impact wheel helps you think about the compliance ecosystem and what you actually need, and then the five enabling pillars help you think about where in the organisations those tools might be, are they in the company secretary, are they with your legal advice team, what’s the technology stack that you’re working with, what are your budgets? How big is your compliance resource? And is it in financial control? Is it the CFO that controls your compliance programme? Is it the general counsel, or is the CCO actually a figure in practice who has the power? So, just as a moment of levity, we made one last edit to the book last week in preparation for launch, and it took our page count to 365 pages, which just felt like a perfect rounding of everything we’d done, as I say, a moment of levity, but that made Jenny and I chuckle. So, yes, is it aspirational? Yes, it is, but that doesn’t stop it from being achievable. So, I think if you are a compliance officer, if you’re a CCO in waiting, or if you’re a CEO who just wants to know more about what compliance is, you pick this book up and you can immediately go through the programme and go, well, we don’t have that, but do we need it? So, again, it’s not bottom-up compliance, it’s what the organisation needs, what is available to improve compliance, and then you start being more critical and evaluating the tools that you have, and then back to the CCO and CRO partnership. Yes, it’s absolutely fundamental. We’ve seen it with certain organisations that they actually blend the two functions. I am a big advocate for greater integration of governance, risk, and compliance, especially with things like Provision 29 in the UK, with the Corporate Governance Code, which talks about risk and control, that blends the compliance and financial control mandate even further. We have a world of proliferation with regulation, where any risk you give me, I can probably give you a regulation that underpins it. So, creating a separate economy of compliance risk from enterprise risk just doesn’t make sense anymore. I understand why firms have taken the approach they’ve taken, and they’ve siloed a compliance programme, especially after the financial crisis, they wanted to spotlight compliance, give it gravity, but there’s a point at which that starts to buckle, and if you don’t reintegrate your compliance back into your risk programme, you’ll see duplication, you’ll see tension, and that adversarial relationship will come back in, the CRO and the CCO should be best friends. They should be in lockstep with one another. The risk assessment should be done off of consistent methodology, consistent systems, and for me, the real winning argument here centres on data analytics. Non-financial and financial risk management are all operating off of the same pool of data at the organisation. The idea that your compliance team would create and manage their own data set to operational risk or financial risk doesn’t make sense anymore, because you’re looking at predictive analytics, you’re looking at cultural drivers, and you are looking at operational resilience. So to try and separate those out doesn’t make any sense. And you can apply a lens at the end of your analysis, but applying it at the start, you need a central risk engine of data that compliance becomes a user of, not a sister to. But again, that’s a personal view. So organisations may say we want to do it differently, and the book gives you the freedom to explore that.

Kimberley Cole 25:01
I think there’s so much, and as you’ve just covered, given your impact wheel and all of these things, and we get a lot of discussion around this, but I’d love your thoughts around, and I know that you cover this in the book, but the different skills needed to be successful, and if you can talk about what are the things that really differentiate a good compliance leader from great ones?

Natalie McManus 25:24
This is a brilliant topic, and I think it’s where we go most wrong as a profession, because we think conviction and principle is enough. So, for me, the big stand-up win is persuasion, and it’s the ability to step into a room armed with facts and information and distill it into a really compelling recommendation for change. So, as a compliance officer, you’re not owning the decision, you’re owning the advice, and in a world where that gets questioned, you have accountability gaps and it creates the wrong outcomes for leadership and. And especially with the lens of social scrutiny on big leaders who eventually say it’s not my problem, compliance should have fixed it. So we absolutely need to own the advice and not the decision, that means it’s got to be technically correct, but it’s also got to be translated. So the best leaders are, as I say, trusted advisors, and that requires being empathetic, it requires being technically very strong, but it also requires being humble and having grace, the grace to know that you might not always get it right. There’s a lot of ambiguity and compliance and interpretation of regulation. There’s an awful lot of partnership. Again, you have to partner with all of the C suite, you can’t upset anybody. You want to bring charisma to the table, because if you can’t be interested in your own ideas, how in the world is someone going to listen to you share them with them? Again, I’ve seen people fall asleep in compliance training. I’ve almost fallen asleep in compliance training myself. And as I say, being technically correct is not enough, so you have to be impassioned, you have to be an authority, and the thing with that charisma is a very fine line, you have to be charismatic, but you can’t go over that line to a leadership of the organisation more generally, stepping on someone else’s toes, and that is going to get you shut down and kicked out of a room. The big issue I see with individuals in compliance leadership roles is they know something is wrong, so they say no rather than saying not like that. So, again, it’s a problem-solving mindset. There are obviously situations where something is fraudulent or something is clearly wrong or corrupt and needs to be shut down, but a lot of the time it’s taking a different route to the same organisational strategy. Organisations are not setting out to be fraudulent by design, they’re taking fraudulent paths to get to different outcomes. So, focus on where the organisation is going comes back to strategy and helps them get there through another route, and also that’ll make you more commercial as a compliance officer.

Kimberley Cole 37:10
Yeah, and a lot of what you’re talking about is soft skills, and it’s interesting because we added a whole course into the Risky Woman Academy called Soft Skilling It for that exact reason, if you can’t communicate your beliefs, your concepts, your whole framework convincingly, compellingly, and as you say, with passion, no one’s going to listen to you.

Natalie McManus 37:34
No one’s going to listen. Being right is not enough. And we do actually go through some of our favourite persuasion principles in the book, we love a reading list, so we have things that we spotlight, but for me, there are two that really stick with me. The first is actually a military acronym, it’s called BLUF, Bottom Line Up Front, so if you’ve only got 30 seconds, you better make damn sure that in those first 30 seconds you’ve made your point, and the other person knows what they want to do, are they listening, are they agreeing, are they challenging, are they endorsing? So, you’ve got to make it clear up front. And then the second thing, which I think people sometimes forget, is it’s not just about brevity, but you have to write beautifully. In this world you have to make it really easy for someone to read your report, and the amount of compliance literature that you know, testing reports or policies, so they’re just insane. You can’t get around what the purpose actually was, and it’s not that anything’s wrong, it’s just not conveying the right message. And no amount of structure and policy governance will fundamentally fix someone writing who doesn’t know how to write, or speaking who doesn’t know how to speak. And so, as a CCO, you’re not necessarily going to be writing your own policy, but you need to create skills within your department that bring to life words on a page, and this is why I’m a big, big advocate for storytelling. Do a storytelling course, and it will make you better at nonfiction.

Kimberley Cole 39:01
Yes, excellent. Yeah, we did actually do a whole Rev-up session on business storytelling as well, which I thought was fantastic, and some of these we need to repeat because they’re just so important. But I would love then to hear what’s your advice for a new compliance leader, because we’ve just talked about the skills, etc. and maybe what was the hardest lesson that you learned as a practicing compliance officer?

Natalie McManus 39:27
The good thing is the book has done my homework for me on this. So one of our last chapters is the first 100 days, it’s observe, design, build. So obviously pause, take a moment to think through what you’re doing, like I said, the book’s quite a systematic, I know I’ve spent some time saying no checklists, but actually checklists are kind of important, and they help you understand whether you’ve really gone through some gaps. And so use the book and the blueprint to go through and really evaluate how comfortable you are understanding the organisation and what that is. Ask questions, do a culture audit, or if you know you haven’t got the asset permission to do things like culture audits, go and find someone who does know the answer to your culture questions. So take that moment to learn the organisation. When you’re designing, you have to put purpose at the heart of the question. So why does compliance exist for this organisation? What matters to the organisation, and you can anchor that in social license, you can anchor that in sustainability theory, but it’s much more fundamental than that. It’s what’s going to keep this business looking good to the people that matter tomorrow, and how do I position compliance within it? And then when you get to build the fundamental question, will have actually been asked for you, so someone will have brought you in to rebuild it, maybe build it from scratch, maybe there’s been some regulatory trouble. You need to understand the history, the regulatory history of the organisation, and what the expectations are, because again, if you’ve looked at this lovely glossy 365 model and looked at your organisation through that model’s lens, and you’ve come to the conclusion you are missing a lot, doesn’t mean you build it, because it’s possible that you won’t have the resources to build it, and it’s possible no one will have the appetite to give you more resource. So again, you have to ask, what is proportionate for the organisation given its objectives, and this is not saying accept non-compliance. It is saying take a risk-based approach to how you design your framework, and still take the position that you will address non-compliance where you find it, because at the end of the day, you still have to comply with the rules, but you don’t have to lift up every stone, and there is a commercial cost to having a compliance officer in the room. If you put a compliance officer in every client meeting, the clients aren’t going to want to talk to you. If you do employee surveillance the way AI tells us it can do it, employees just won’t write anything down, and so you will have these really counterintuitive behaviours emerging because you’re trying to do the right thing by putting more compliance structure in. So that’s how you get started. And again, it doesn’t have to be big, compliance can be in the little moments rather than the big framework. Start agile if you need to. What was my hardest lesson? So I had a phenomenal, phenomenal manager way back when, at Citi, when I was in research compliance, when I was practicing as a technical product compliance officer. Every day, he gave me something that made me think I was going to get fired. So, there was one lesson. One lesson was, you better make damn sure that you thought through your advice, because if you give the wrong advice, you will have to resign. And that can be up at night for a year. Now we didn’t argue about whether he was right or not at the time. I think it was a very strong message for me to hear that I needed to hear. But there is a point of fact that you have to have conviction, but that means a moral compass that you are prepared to enact when it gets really hard. It is really easy to stay in the shade of gray, and to manage the relationships on one side, the access to information on one side, and then the independence on another, that gives you the line of sight to say, actually, that wasn’t great, that actually brings into question the integrity of the organisation, why did we do that? But I think, for me, it was this step change in thinking that it’s not about me, that being technically proficient is absolutely a necessity in my role, but what really matters, as I say, is what the other person takes away from it, and I have a big personality, so sometimes I’m the ego in the room people need to go around, and so I did have to shrink. I had to shrink my personality. Sometimes you have to resort to flattery. Sometimes you just have to know which lever to press to get someone to listen to you, and it doesn’t always feel great knowing that you’re playing a card that can sometimes feel a bit manipulative, just so that it creates the space for someone to listen to you.

Kimberley Cole 44:05
Well it sounds like you’re a salesperson!

Natalie McManus 44:07
Well, funny enough, that was the other lesson that my manager said, is that it’s all sales, everything is sales.

Kimberley Cole 44:13
Yeah!

Natalie McManus 44:14
And I frigging hate sales!

Kimberley Cole 44:16
As an ex-sales salesperson, I’m like, it’s all sales!

Natalie McManus 44:21
It’s all sales, so the humility of being a compliance officer, you can’t overstate it, but I would say this: you can lose yourself as a compliance officer, you can lose yourself in the role, and so you’ve got to make sure you are surrounded by people who will pull you out if you get too close to your business, and that’s not just about the organisation building those environments for you, you’re accountable for your own options, more so as a compliance officer, and that’s stayed with me as a career message, is that sense of actually you are held to higher standards than perhaps is fair, and you do have to hide pieces of who you are to make other people feel open enough to listen to you, and you just got to get over it. And maybe it’s because I’m turning 40 this year, maybe it’s because I’ve got a two year old, but I’m just like I was so naive in my 20s, and I was so convinced I was right, and that my opinion mattered, and my opinion does matter, but sometimes it’s not my opinion that needs to be heard, it’s quite a sobering moment when you realise that.

Kimberley Cole 45:22
Well, I think I mean it’s been fantastic having this conversation. I’ve got a couple more questions before we wrap up, but really I think everyone needs to read the book. But if we’re going to share with listeners what’s going to be that one takeaway from the book that they should absolutely read it, what would that be?

Natalie McManus 45:40
Probably should have spent longer thinking about this final question, because I could give you six or seven, but give me a moment to actually think…

Kimberley Cole 45:47
It’s tough to think of one thing.

Natalie McManus 45:49
I don’t know why I put this question on the agenda. Like, this is a horrible question to land on. I, the thing…

Kimberley Cole 45:57
Read the book, maybe it’s just read the book!

Natalie McManus 46:00
It certainly is. Read the book, but I think it’s more than that. I think it’s okay. So, I think this is my one thing. So, I think there is an upskilling of vision that compliance officers can benefit from. So, I know how technically gifted some of my peers are, I very much respect and admire so many of the people I work with, but they have time that gets crowded out, so they don’t have the money to go and buy the six textbooks on regulatory legal theory. They don’t have the inclination to read it, and why would you? There’s far too much. There’s far too much out there that needs distilling. So, in this world of noise, it’s really important to take a moment and sit back and just think about the world that you’re in and why it exists. And this book will help you do that. It will give you the pause you need to really think about why you do what you do, and if you can do it better, or if you can teach someone else to do it as good as you. So that’s for me. I think the takeaway is it’s not just by the book, but it’s the book is something you need to help others understand your vision of compliance, and to elevate your vision if you’ve been feeling overwhelmed, or like you’ve been for too long in the weeds of compliance, and not long enough in the philosophy of it.

Kimberley Cole 47:27
Brilliant. And how did they buy the book?

Natalie McManus 47:31
Ah, yes. See, natural salesperson didn’t even put the book in the answer. So it’s on Amazon from May 5, Amazon Worldwide. So, How to be a Chief Compliance Officer by Natalie McManus Barnett and Jennifer Geary. You can go to Jenny’s website or my website or follow us on LinkedIn. We’re putting things out on LinkedIn every day.

Kimberley Cole 47:50
We’ll put it in the show notes, so it’ll all be clear.

Natalie McManus 47:54
Okay, great stuff.

Kimberley Cole 47:55
And lots of events coming up where I’m sure we’ll give copies, and it’s all going to be very enlightening.

Natalie McManus 48:02
yes, it will be brilliant. And I’ve just released a whole suite of compliance digital playbooks, and there is one that I’m giving away for free to readers of the book, so just something that will get them started.

Kimberley Cole 48:13
Wonderful, excellent. Well, we’ll make sure that we add that in. You don’t have to tell me in the notes, I’ll add that in.

Natalie McManus 48:19
Yes, I’ll put it in,

Kimberley Cole 48:20
But I will just say, don’t wait, buy the book. I think, as we’ve covered, this is a book not just for compliance leaders, but for the whole C-suite. So, I recommend you all getting your own copy. I think everything we’ve talked about today, given the incredibly complex regulatory environment that all senior leaders are working in, regardless of industry or the size of your organisation, as we’ve talked about that right sizing, this is a great tool to equip leaders and give them insight and advice and tools that you can embed throughout the organisation, or even just have a greater understanding, and I think, as Natalie’s covered, this is really going to set the standard in how to make decision making, strategy setting, and really position compliance as a competitive advantage, as is in the title. So I would recommend it. I think it’s a great structure, like all of the other in the C-suite series, you’ve got your foundational elements of the culture, strategy, execution, then the impact wheel, the five enabling pillars. So, go out, get your copy of How to Be a Chief Compliance Officer, and I think you’re going to have a really practical blueprint that you can execute within your own organisation, so thank you everyone for listening, and thank you to Natalie for sharing what an amazing book I think this is going to be for the industry.

Natalie McManus 49:52
So kind of you to say it’s been a genuine pleasure. And hello and goodbye to all your listeners. It’s been great. Thank you.

Kimberley Cole 49:59
Thank you.

Kimberley Cole 50:00
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org