What should a CCO do when a compliance investigation implicates the General Counsel?

Bypass the normal escalation path entirely and escalate directly to the Board's Audit Committee and independent outside counsel. When the subject of an investigation is the normal escalation target, governance protocols require escalation to a level where independence can be preserved. Preliminary evidence is sufficient to trigger this — certainty is not required.

What personal risks does a CCO face for failing to escalate when a senior executive is implicated?

Personal liability under SEC whistleblower rules, potential obstruction of justice liability for securities fraud cases, termination for cause, and professional reputational damage. The CCO's independence and willingness to act on it — even in difficult circumstances — is the core of the role.

Compliance Escalation — Senior & CCO Audience

As CCO I’m Investigating Misconduct — and the Evidence Is Pointing at the General Counsel. My Normal Escalation Path Just Disappeared. What Do I Do?

Q: Who does a CCO escalate to when the General Counsel is the subject of an investigation?

The Board's Audit Committee is the primary path for public companies. Independent outside counsel engaged directly by the board — not the company's legal department — provides legal support. For private companies, escalation to independent board members is the equivalent path.

A real senior compliance scenario — with three decision options and the right answer.

Quick Answer

What should a CCO do when a compliance investigation produces credible evidence implicating the General Counsel — the person they would normally escalate to?

Bypass the compromised escalation path entirely and escalate directly to the Board’s Audit Committee or independent outside counsel. When the subject of an investigation is the person compliance would normally report to, governance protocols require that the escalation go around that person — to a level of the organization where independence can be preserved. Continuing to route through the GC, or pausing the investigation, both create risks that are more serious than the discomfort of going directly to the board.

The Situation

You are the Chief Compliance Officer of a publicly traded company. You have been conducting an investigation into potential financial misconduct following a whistleblower report. The investigation is still preliminary, but the evidence you have gathered is credible and points to conduct that, if confirmed, would constitute a serious violation — and it appears to implicate the General Counsel.

The GC is your typical escalation path for sensitive matters. They are also someone you have worked alongside for four years and have a collegial relationship with. The evidence is preliminary — you are not certain. You’re not sure whether to continue the investigation, pause pending clarity, or escalate — and if so, to whom.

What Should You Do?

Choice AContinue the investigation normally and present findings to the GC as you would any other matter. The evidence is still preliminary. You don’t have enough to act on yet, and the GC deserves the same process as anyone else. Wait until there is more certainty before changing your approach.

Choice BEscalate immediately to the Board’s Audit Committee and independent outside counsel, bypassing the GC entirely. The investigation’s integrity requires an untainted escalation path regardless of how preliminary the evidence is.

Choice CPause the investigation pending clarity on how to proceed. Given the sensitivity of the situation and the uncertainty about the evidence, taking more time to assess the right path before acting protects both the GC’s reputation and the integrity of the investigation.

The Right Call

Choice B — Escalate to the Audit Committee and outside counsel immediately.

Choice A is the most dangerous option — presenting findings to the subject of an investigation compromises the investigation and potentially the CCO’s own position. Choice C creates its own risk: pausing an investigation involving a senior executive when credible evidence exists creates a record of inaction that is difficult to defend and, if the misconduct is ongoing, allows it to continue. The evidence’s preliminary nature is exactly why escalation to the board level is appropriate — they can evaluate it with the benefit of legal counsel and decide how to proceed.

Why This Is Harder Than It Looks

Four years of collegial relationship make the escalation feel like an accusation — but it isn’t.

Escalating to the Audit Committee when the GC is implicated does not imply that the GC is guilty of anything. It follows governance protocol when the normal escalation path is compromised. The CCO’s job is to protect the integrity of the investigation — and that job doesn’t change based on the personal relationship with the subject.

“The evidence is still preliminary” is not a reason to wait.

The threshold for bypassing the normal escalation path is not certainty — it is credible evidence that the normal path is compromised. Preliminary credible evidence of GC misconduct is sufficient to trigger a board-level escalation. Waiting for certainty while continuing to route through the GC creates exactly the kind of documented inaction that exposes the CCO to personal liability.

The CCO’s own independence is at risk in Choice A.

A CCO who presents findings from an investigation to its subject — even unknowingly — has compromised the investigation and potentially their own position. If the GC responds by taking any action based on those findings, the CCO may face consequences for both the investigation failure and for any decisions the GC made with advance knowledge of their exposure. Bypassing the GC is protective of the CCO as much as it is protective of the organization.

Frequently Asked Questions

Who does a CCO escalate to when the General Counsel is the subject of an investigation?

The Board’s Audit Committee is the primary escalation path — for public companies, the Audit Committee is specifically designed to provide independent oversight in situations where management conflicts exist. Independent outside counsel engaged directly by the board (not by the company’s legal department) is the appropriate legal support. For private companies and nonprofits, escalation to the full board or a subset of independent directors is the equivalent path.

What if the CCO doesn’t have a direct reporting line to the Audit Committee?

Governance best practices recommend that the CCO have a dotted-line reporting relationship to the Audit Committee specifically to address situations like this one. If that relationship doesn’t formally exist, the CCO should go to the CEO — unless the CEO is also implicated. In extreme cases, the CCO may need to engage the Chair of the Audit Committee directly through their own legal counsel to protect both themselves and the integrity of the investigation.

What are the personal risks to a CCO who fails to escalate appropriately when a senior executive is implicated?

A CCO who knows of credible evidence of senior executive misconduct and fails to escalate appropriately may face personal liability under SEC whistleblower rules, potential obstruction of justice liability if the conduct is securities fraud, termination for cause, and reputational damage in the compliance profession. The CCO’s independence and their willingness to act on that independence even in uncomfortable circumstances is the core of the role.

How to Use This Scenario in Training

This scenario is designed for chief compliance officers, audit committee members, and senior legal and compliance professionals. It addresses one of the most difficult practical governance situations a CCO will face — and one for which they are rarely given specific preparation. The recognition skill is knowing that the standard escalation path is not always available — and knowing what to do when it isn’t.

This scenario is built on the Decision Readiness Engine™ — the Xcelus methodology that trains employees to recognize a compliance moment, pause under pressure, and take the right action before the rationalization wins. Learn how it works →

More Compliance Scenarios

Board Governance

A board member’s company bids on a contract. They recused themselves. Is that enough?

Reporting Obligations

An investigation found nothing. Will the employee who reported be punished for being wrong?

Full COI Cluster

Browse all conflicts of interest scenarios.

Want These Scenarios in Your Program?

Xcelus builds scenario-based compliance training for CCOs, boards, and senior compliance professionals — covering the governance situations that standard training programs don’t address.

View Compliance Programs →
Contact Xcelus