About Todd R. Corbett, MBA

Todd R. Corbett, MBA is the founder of Xcelus LLC, where he has spent 21+ years designing scenario-based compliance training for organizations including AXA XL, Hitachi, and Thermo Fisher. Xcelus programs reach more than 400,000 employees a year across 25+ countries. He created the Decision Readiness Engine™, the framework behind Xcelus courses, Decision Briefs™, and the Executive Decision Lab™. Xcelus builds the decision architecture; a client's own counsel owns the legal analysis.
LinkedIn

An Approved AI Tool Is Not an Approved AI Use

By |2026-09-01T15:17:00-06:00July 14th, 2026|AI, AI Ethics, AI Ethics and Risks, Compliance Blog, Data Privacy, Protecting Confidential Information, Todd's Blog|

Xcelus · Responsible AI & Governance An Approved AI Tool Is Not an Approved AI Use Your security review cleared the technology. It wasn’t clear what your people are putting into it. Quick answer: Approving an AI tool clears the technology. It does not automatically approve every data type, business purpose, or workflow that the tool is used for. Most organizations have published an approved software list and nothing else — so employees reasonably conclude that if the tool [...]

Read More
Comments Off on An Approved AI Tool Is Not an Approved AI Use

The $81,000 AI Bill and the Missing Guardrail: Who Owns AI Spend?

By |2026-07-04T14:11:34-06:00July 4th, 2026|AI Ethics and Risks, Compliance Blog, GRC|

Responsible AI · Leadership & Governance The $81,000 AI Bill Wasn’t the Real Problem. The Missing Guardrail Was. When you tell everyone to “go use AI” and set no limits, the overspend isn’t a discipline problem. It’s a governance gap — and it belongs to leadership. The Short Answer Who is responsible when an employee runs up a huge AI bill? Responsibility is shared, but the primary failure is usually structural, not personal. When leadership enables an uncapped AI [...]

Read More
Comments Off on The $81,000 AI Bill and the Missing Guardrail: Who Owns AI Spend?

Why Good Companies Miss the Chance at a DOJ Declination

By |2026-06-30T17:00:32-06:00June 30th, 2026|Compliance Blog, Todd's Blog|

What is the biggest reason companies miss the chance at a DOJ declination? It is almost never a decision not to disclose, and it is rarely ignorance of the law. The most common reason a company loses the chance at a declination is internal speed: the report surfaces somewhere in the organization and then moves too slowly — stalling in an escalation chain, waiting on “one more fact” — so that by the time decision-makers can act, the window [...]

Read More
Comments Off on Why Good Companies Miss the Chance at a DOJ Declination

Is the FCPA Still Being Enforced in 2026? What It Means for Training

By |2026-06-25T10:21:54-06:00June 25th, 2026|Compliance Blog|

Is the FCPA Still Being Enforced in 2026? What It Means for Training Is the FCPA still being enforced in 2026? Yes. Enforcement of the Foreign Corrupt Practices Act was paused by executive order in February 2025, then resumed in June 2025 under new Department of Justice guidelines that narrowed its focus toward cases tied to US national security and economic competitiveness, cartels, state-owned enterprises, and large-scale or concealed bribery. The law itself did not change, and prosecutions have [...]

Read More
Comments Off on Is the FCPA Still Being Enforced in 2026? What It Means for Training

Reorganize, or Make Better Decisions?

By |2026-06-15T10:56:41-06:00June 15th, 2026|Compliance Blog, Todd's Blog|

Reorganize, or Make Better Decisions? The Variable Most Cross-Functional Failures Miss By Todd Corbett, Xcelus When something goes wrong across departments — a data breach that also involved employee misconduct, a harassment complaint that also created exposure to retaliation — the instinct at the top is almost always the same. Redraw the org chart. Add an escalation policy. Stand up a committee. Clarify who reports to whom. Those responses are legitimate. Sometimes, the structure really is broken and needs [...]

Read More
Comments Off on Reorganize, or Make Better Decisions?

Cybersecurity Runs Tabletop Exercises. Why Doesn’t Compliance?

By |2026-06-17T08:14:26-06:00June 9th, 2026|Compliance Blog, Todd's Blog|

Xcelus Blog — Compliance Leadership Cybersecurity Runs Tabletop Exercises. Why Doesn't Compliance? By the Xcelus Editorial Team Editor's Note The opening scenario below is the basis for one of our Executive Decision Lab™ kits, The Invisible Insider — a 90-minute facilitated session designed for public company leadership teams who want to practice these conversations before an incident forces them. Imagine your organization discovers that a vendor employee accessed confidential FDA approval information and shared it with a family member [...]

Read More
Comments Off on Cybersecurity Runs Tabletop Exercises. Why Doesn’t Compliance?

The AI Training Gap: Why Prompt Courses Miss the Risk

By |2026-09-01T08:58:37-06:00June 1st, 2026|AI Ethics and Risks|

AI Compliance · Responsible AI Training The AI Training Gap: Why Prompt Courses Miss the Compliance Risk   AI Compliance  ·  June 2026 Every AI training program on the market teaches employees how to write better prompts. Almost none teach them how to recognize the compliance risk they just created. That is not a small gap. It is the gap — because the speed that makes AI valuable is the same speed that makes AI dangerous. A well-meaning employee [...]

Read More
Comments Off on The AI Training Gap: Why Prompt Courses Miss the Risk

What Four Senior Leaders Wish Every Employee Knew (And Why Training Rarely Tells Them)

By |2026-05-30T16:06:37-06:00May 30th, 2026|Compliance Blog, Culture of Compliance|

What Four Senior Leaders Wish Every Employee Knew (And Why Training Rarely Tells Them) Here's a thought experiment I've been sitting with lately. Ask a Chief Compliance Officer, an HR leader, a VP of Security Awareness, and a VP of AI Readiness the same question—what do you wish every employee actually knew?—and you'll get four different lists. Different priorities, different language, different fears. But if you read all four answers carefully, one thread runs through all of them. It's [...]

Read More
Comments Off on What Four Senior Leaders Wish Every Employee Knew (And Why Training Rarely Tells Them)

Are Your Managers Trained to Handle Compliance Concerns — and Avoid Retaliation?

By |2026-05-07T08:36:16-06:00May 6th, 2026|Manager's Role in Compliance|

Are Your Managers Trained to Handle Compliance Concerns — and Avoid Retaliation? Managers are the most common first point of contact for compliance concerns. They are also the least prepared person in the system for what comes next. Every compliance program has a speak-up component. The hotline number is posted. The non-retaliation policy is in the Code of Conduct. The annual training covers employees' rights as reporters. Organizations invest real effort in telling employees that it's safe to come [...]

Read More
Comments Off on Are Your Managers Trained to Handle Compliance Concerns — and Avoid Retaliation?

What Is a Manager’s Role in Corporate Compliance?

By |2026-05-06T08:45:29-06:00May 4th, 2026|Blog/News|

What Is a Manager's Role in Corporate Compliance? Most compliance programs treat managers as additional recipients. Here's why that's wrong — and what the manager's role actually looks like when it works. Every year, organizations invest in compliance training — code of conduct courses, policy acknowledgments, and annual certifications. Employees complete the training, pass the quiz, and return to their desks. And then, for the next eleven months, compliance goes quiet. The assumption embedded in this model is that [...]

Read More
Comments Off on What Is a Manager’s Role in Corporate Compliance?

The scenarios, articles, and training materials on this site are provided for general educational and training purposes only and do not constitute legal advice. Compliance laws and enforcement priorities change and vary by jurisdiction — consult qualified legal counsel about your specific circumstances.
Read the full disclaimer.

This website uses cookies and third party services.
Ok
Go to Top