She explains why she has always been drawn to the human element: understanding why people do what they do, untangling complicated facts, and helping organizations resolve difficult people problems. Along the way, Corey has created employment law functions, handled complex investigations, and learned how to show up as a trusted partner rather than “the department of no” or “the person you only call when someone is in trouble.”

This episode covers:

• The challenge of wanting the “best possible outcome” as a young lawyer—and the freeing lesson that you can’t change the facts, only work with the circumstances in front of you

• How to shift perceptions from “legal/compliance means I’m in trouble” to “legal/compliance is a value‑add partner”

• Practical ways to build trust, including showing genuine interest in people, starting with “Where do you want to go?” and working backwards from desired outcomes

• Designing paths that move from A to B to X, Y, Z instead of expecting an instant jump from A to Z; and why early, ongoing partnership beats late‑stage roadblocking

• Balancing a heavy job with being a partner, parent, and friend, and the role of exercise, priorities, and perspective in finding some equilibrium

• The importance of honesty and how “the cover‑up is worse than the crime” shows up in investigations and legal practice

• Why almost every mistake is fixable if you own it and ask for help, and how perceived failures can become the most valuable learning experiences

• The concept of “moral drift”: small compromises that slowly move you far from where you intended to be, and why staying alert to those steps matters

• How different people can sincerely believe different versions of events, and what that means for investigations, employment law, and compliance

• Why authenticity, humor, and humility are Corey's core leadership principles; bringing your full self to work, being able to laugh when appropriate, and openly asking experts to “explain it like I’m a third grader”

If you enjoyed this episode of Compliance Chronicles, please consider subscribing and leaving a rating or review—it helps others discover the show and supports more conversations with leaders across privacy, risk, and compliance. Follow Compliance Chronicles on your favorite podcast platform (Spotify, Apple Podcasts, YouTube, and more) and connect with Liisa on LinkedIn so you don’t miss future episodes.

He explains how he “fell into” compliance during a nationwide class action and multi‑state regulatory investigation at Prudential, where his first assignment was telling offices around the country to keep boxes and boxes of files. From there, he moved into health insurance and leadership roles, eventually becoming a chief compliance officer and consultant before stepping into his current role at QBE.

This episode covers:

• Why regulatory compliance feels similar to appellate work: understanding the rules, telling the story, and helping business teams make those rules work in practice

• Jay’s “pre and post” philosophy of compliance: knowing which rules apply and knowing whether the organization is actually following them

• The challenge of rules that are constantly changing, not always practical, and sometimes at odds with what the business wants to do

• The partner vs. guardian dilemma, inspired by Ben Heineman’s work: knowing when to support the business and when to protect it, and getting the business to understand why

• Why counting training sessions, policies, or helpline calls doesn’t truly measure compliance effectiveness

• How to focus on whether changes are communicated, implemented, and whether they stick in daily operations

• The importance of getting out of your office, spending time with business teams, and building relationships so people know and trust you when you say “partner” or “guardian”

• Assuming positive intent, especially when teams resist or push back, and using that resistance as a cue to listen and recalibrate

• Why compliance is a “terrific way to make a living” if you care about understanding, analysis, communication, and helping companies do the right thing

If you enjoyed this episode of Compliance Chronicles, please consider subscribing and leaving a rating or review—it helps others discover the show and supports more conversations with leaders across privacy, risk, and compliance. Follow Compliance Chronicles on your favorite podcast platform (Spotify, Apple Podcasts, YouTube, and more) and connect with Liisa on LinkedIn so you don’t miss future episodes.

She explains why privacy is often treated like “art class”—important but easily deprioritized—and how she works to reframe it as a value proposition tied directly to customer choice, trust, and business growth. Throughout the conversation, Lauren highlights the importance of understanding the business, translating regulatory mandates into tangible benefits, and using both EQ and IQ to navigate complex, evolving privacy frameworks across states, regions, and cultures.

This episode covers:

·        Why privacy is often viewed as “art class,” and how to reposition it as a business‑critical function customers genuinely care about

·        How learning the business first—processes, downstream impacts, and bandwidth—builds trust and makes privacy requests more workable

·        Practical ways to turn compliance objectives (like data mapping and inventories) into tools that help product, engineering, and customer teams

·        Strategies for baking privacy into the value proposition instead of treating it as a late‑stage hurdle to growth and innovation

·        The role of EQ in privacy work: doing right by residents and the company while managing expectations, skepticism, and change

·        How cultural awareness (across geographies and job roles) helps privacy and legal teams “meet people where they are” and collaborate more effectively

·        Why you shouldn’t be afraid to ask for what you want in your career—and how clarifying your “North Star” can actually help managers support you

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

He explains why privacy is most powerful when it’s operationalized—embedded in product and R&D from the beginning—and why privacy professionals often end up owning AI, M&A diligence, and complex data questions. Throughout the conversation, Matthew highlights the importance of bridging legal and product, saying yes to stretch opportunities, and treating privacy as a long‑game career path.

This episode covers:

• Why early collaboration with product and R&D turns privacy from a late-stage obstacle into a strategic success factor

• How privacy professionals can bridge the gap between legal requirements and product ambitions by “speaking both languages”

• Lessons from large acquisitions and M&A work, including why “signing authority to assume risk” is a critical governance question

• Why privacy teams are often asked to take on AI, and what it means to “do something with nothing” when it comes to data and emerging tech

• How building teams of passionate learners and saying yes to stretch roles can accelerate a privacy career

• Why privacy is likely to remain a strong, growing career path over the next 20+ years—and how to prepare for that future

• Practical advice on leadership, vulnerability, and knowing when to raise your hand for more responsibility

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Shellie explains why security sits at the intersection of people and technology, and how understanding behavior, motivation, and trust is just as important as understanding firewalls, access controls, and tools. She describes the realities of being a CISO today: constantly evolving threats, rapid technology change, and an expanding privacy and security regulatory landscape.

The conversation covers pushing risk ownership back into the business, framing issues in financial and operational terms instead of “tech speak,” and avoiding burnout by refusing to be the “single point of safety.” Shellie also shares how she builds resilient, curious, adaptable teams and why culture and psychological safety matter as much as any control.

Her advice for security, privacy, and compliance professionals: stay curious, stay human, and remember that cybersecurity is a marathon, not a sprint. Security is not about being the department of no—it is about enabling the business to move forward safely.

If you work in cybersecurity, information security, privacy, or compliance—or you’re aspiring to a CISO or security leadership role—this episode offers practical insight into building resilient teams and leading with both technical acumen and empathy.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, cybersecurity, and real‑world compliance leadership.

Lori describes her path from Division I basketball player to clerk on the Eleventh Circuit, to 18 years at a prestigious firm where she built a practice in employment law, construction, and OSHA workplace safety—while also taking on leadership roles like hiring partner and office managing shareholder.

A central theme is the identity shift that comes with going in‑house. She contrasts the law firm environment, where everything is organized around selling your legal services, with the in‑house world, where the focus is on being a business person with a law degree, not “the lawyer” in the corner office.

Lori and Liisa dig into how to avoid being seen as “the department of no” and instead become a trusted partner who helps the business get to yes. Lori shares how she learned to make sure she’s invited to the right meetings, build credibility with business colleagues, and communicate that her job is to help them achieve their goals in a safe, compliant way. She talks about mentors who modeled calm, unflappable leadership and taught her when to push, when to listen, and how to stay steady in chaos.

The conversation tackles people leadership and feedback as ongoing challenges, no matter the setting. Lori discusses learning to give and receive constructive feedback, advocate for yourself, and live out her personal mantra: “Do no harm, but take no stuff.” She emphasizes the importance of standing up for your needs—whether that’s feedback, mentorship, or opportunities—while still being a supportive leader for your team and partners.

Operationally, Lori shares how she thinks about building systems that set people up to do the right thing. She talks about looking at leadership workloads, time and motion studies, and the realistic number of hours in a workday when designing compliance and safety expectations. Instead of endlessly adding to the plate of field leaders, she emphasizes prioritization, clarity, and creating structures that make compliance achievable rather than overwhelming.

Lori also offers a powerful mindset shift around blame and mistakes. She explains why she reminds herself that people don’t wake up wanting to do a terrible job at work; most are trying their best within the systems and information they have. That perspective leads her to “link arms” with colleagues, use “we” language, and focus on understanding why something happened before Monday‑morning quarterbacking. She shares her belief that each of us is “one of one,” and that careers get better when we own who we are instead of trying to fit someone else’s mold. For those earlier in their journey, she encourages patience: you will find your “sea legs,” and staying true to yourself will help you find the spaces that are truly the right fit.

If you’re a law firm partner thinking about moving in‑house, an aspiring general counsel or chief legal officer, or a compliance and risk leader looking for inspiration on how to be a better business partner, this episode offers candid insight and practical takeaways.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

In this episode of Compliance Chronicles, host Liisa Thomas talks with Bill Connolly, Head of Resiliency Risk for the U.S. retail bank at HSBC. Bill oversees a broad risk portfolio that spans information risk, business continuity, disaster recovery, operational resilience, and more—all brought together in a single resiliency risk program. He shares how his career evolved from managing TCPA suppressions and customer choice, to vendor risk and privacy, to digital compliance, and ultimately into enterprise resiliency risk.

Bill walks through his “privacy by almost accident” story: starting with do‑not‑call and do‑not‑solicit databases, helping to build practical privacy questionnaires, and being asked to relaunch a new privacy program by writing a privacy policy that actually reflected how the organization worked. That experience led him into digital compliance, where he carried forward his privacy and information risk expertise to tackle cookie compliance, cross‑border data issues, and global data privacy obligations in a large financial institution.

A major theme of the conversation is how to communicate risk in a way the business understands. Bill explains how he created “guardrails” to reduce low‑value questions and empower teams: if people stay within well‑defined parameters on TCPA, privacy, or other rules, they can move quickly; if they step outside those guardrails, that’s when legal and compliance step in. He shares why this kind of tooling not only helps the business move faster but also protects second‑line teams from getting buried in ad‑hoc requests.

They dig into the challenges of new regulatory and resiliency requirements, including “important business services” mapping and the sheer scope of work that often falls on a small group of people in each business unit. Bill talks about translating highly technical topics—like IT vulnerabilities—into business language and compelling risk narratives that management can act on and fund. He emphasizes the importance of understanding both the compliance requirements and the resource impact on the business, so you can prioritize, sequence, and negotiate change effectively.

Bill also shares career advice for compliance, risk, and privacy professionals at different stages. For those starting out, he stresses curiosity—following your interest into areas like digital privacy or information risk, and backing it up with credentials such as CISA and IAPP certifications. For those who are bored or burned out, he suggests re‑examining your role, looking one year ahead at where you want to be, and exploring adjacent areas like digital, operations, or new risk domains where your expertise can be uniquely valuable.

The conversation closes with a focus on growth and reflection: using sabbaticals or mini‑sabbaticals, mentorship, and honest self‑assessment to decide when you need a new challenge. Bill’s parting advice is to deliberately step outside your comfort zone—because no one will do that for you—and to treat each stretch assignment as a way to expand both your knowledge and your network.

If you work in privacy, compliance, operational risk, or resilience at a bank or large corporate and want to become a more effective partner to the business while continuing to grow your own career, this episode is for you.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Takeaways

• Understanding technology
• Building trust
• 'Yes before no' approach
• Continuous learning

  If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Katie explains how working in PR, marketing, and entertainment licensing led her to law school and ultimately to becoming a “second‑career solicitor,” using her creative background to connect with stakeholders and translate complex regulatory requirements into practical guidance. She describes going from “poacher to gamekeeper” as a regulator under multiple licensing and safety regimes, and how that experience shaped her approach to helping businesses do what they really want to do while staying compliant.

They dig into the realities of compliance work: why “nobody likes compliance,” why most people genuinely want to do the right thing, and how curiosity and context are essential for getting buy‑in. Katie talks about how dyslexia has made her a better privacy and compliance professional, because it forces her to demand context, clear agendas, and upfront information so she can give her best advice. She shares how this mindset helps her understand business objectives, identify real risks, and avoid selling “solutions in search of a problem.”

The conversation also explores Katie’s time as a data protection officer and internal advisor on data privacy, including a vivid story about data retention, data subject access requests, and what happens when organizations keep personal data far longer than promised. She highlights a key lesson: privacy and compliance teams advise on the “how,” but the business owns the “what” and the accountability for data processing decisions.

Finally, Katie offers practical, encouraging advice for privacy, compliance, and audit professionals at every stage: be curious about what people actually want to achieve, see yourself as a trusted advisor rather than the “fun police,” and learn to speak the client’s language so your guidance lands and drives real behavior change. She emphasizes that every business, function, and client group has its own vocabulary—and the more you can mirror it, the more effective you become as a compliance and data privacy partner.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

You’ll hear how Kam:

• Looks for opportunities to showcase strong compliance
• Builds partnerships with CTOs and CIOs by being willing to ask “basic” questions
• Uses a straightforward test: does this outcome match what a reasonable customer would expect if you explained it at the dinner table?

This episode is ideal for in‑house counsel, privacy and compliance professionals, and leaders in financial services and other highly regulated sectors who want practical, business‑savvy ways to manage risk and strengthen customer trust.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

What we cover:

• Being open to new opportunities and volunteering for stretch assignments can unexpectedly launch a career in privacy and compliance
• Moving from a pure legal role into a compliance role requires a mindset shift toward controls, documentation, metrics, and disciplined, programmatic thinking
• Mature compliance programs are built on clearly defined controls, monitoring, testing, and consistent documentation
• Privacy and AI work often happens “in the gray,” where laws are incomplete or unclear, and professionals must use analogies, principles, and creativity
• Giving specific, actionable guidance to the business is challenging when statutes and regulations leave gaps or ambiguities
• Rotations or close work inside a compliance function help lawyers better understand operational realities and what “good” looks like on the ground
• Building a strong network and “phoning a friend” — peers, experts, and trade organizations — is critical when working in uncertain or novel areas
• Learning to be comfortable with ambiguity reduces anxiety and enables better decision-making in evolving regulatory landscapes
• Effective compliance planning starts with mapping principles and end goals, then designing a practical program around them
• When teams feel overwhelmed by a compliance plan, it helps to prioritize: start with what is highest risk or what must be done first to enable everything else
• Version one of a solution does not need to be perfect; a good-enough, law-compliant baseline can be iterated over time
• Risk-based prioritization allows teams to focus limited resources on changes with the greatest impact, while deferring lower-risk improvements
• Stepping outside your comfort zone is essential for growth in privacy and compliance, even when it feels uncomfortable
• Raising your hand and being known as someone willing to try new things expands opportunities and builds a deeper experience base
• Each new experience, even tangential ones, adds to your toolkit and confidence for future roles and challenges
• Curiosity is a superpower in a fast-changing field; asking follow-up questions and staying inquisitive keeps you adaptable and effective

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Takeaways include:

• The constant evolution of privacy law
• Building relationships with the business
• Importance of community and support

  If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Takeaways

• Saying yes to new challenges and opportunities is important for career growth.
• Compliance is a journey, and it's important to focus on the long game and risk management.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Jill describes the challenge of working between two worlds: helping consumers understand what is happening with their data and helping business and technology teams understand how new products and practices affect transparency, choice, and trust. She also shares the importance of humility in compliance work. Rather than always trying to be the immediate “yes or no” expert, Jill emphasizes the value of saying “I don’t know,” looking deeper, and collaborating with others to reach the right answer.

What is covered:

• Privacy compliance requires translation between legal, technical, and consumer perspectives
• When a data practice feels invasive, creepy, or out of control, it likely needs to be questioned or rethought
• Humility is a core strength in compliance work, including being willing to say “I don’t know” and research the right answer
• Collaboration across legal, compliance, IT, and business teams leads to better privacy outcomes
• Viewing privacy issues through the eyes of a consumer or non-expert family member reveals gaps in transparency and communication
• Real-world consumer touchpoints should guide how organizations design notices, choices, and data handling practices
• Privacy is an evolving, emerging field, so continuous learning and adaptation are essential
• Effective privacy professionals balance regulatory requirements with practical implementation in complex, regulated industries
• Empathy and clear communication help build consumer trust around data use and protection

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Key takeaways include the concept of compliance as everyone's job and the criticality of solid market identification.

Takeaways

• Data Privacy and Compliance
• Challenges in Privacy Compliance

  If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Takeaways

• Transitioning from audit to privacy compliance
• Balancing methodical approach with risk

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Keikoh shares how negotiating massive multinational real‑estate deals opened her eyes to the risk buried in pages of contractual obligations—and why that curiosity led her to raise her hand for a brand‑new global compliance role. She explains the realities of international regulatory compliance, from navigating conflicting data privacy regimes to balancing cultural nuance with consistent standards, and why relationship‑building is the most underrated tool in a compliance leader’s toolkit.

You’ll hear candid lessons on job moves for long‑term growth, building credibility so you are not seen as the corporate police, and finding fulfillment in work that constantly changes with new laws, enforcement priorities, and business risks. This episode is a must‑listen for in‑house lawyers, global compliance professionals, and anyone wondering whether a lateral move into ethics and compliance could actually be the best career decision they ever make.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.

Mike shares how running a centralized privacy project pulled him into the field, why adding the CRCM and broader regulatory compliance responsibilities changed his career ceiling, and how he thinks about the line between smart data use and “creepiness” in financial services. You’ll hear honest reflections on burnout, finding new energy in a fast‑moving regulatory landscape, and the importance of picturing a real person at the other end of the data—whether that’s your own family member or your most vulnerable customer.

Perfect for: privacy and compliance professionals in banking and financial services, aspiring CPOs, and anyone considering a move from fraud, risk, or operations into data privacy.

If you enjoy this conversation, make sure to subscribe to Compliance Chronicles in your favorite podcast app and follow the show so you don’t miss future episodes on privacy, AI, internal audit, and real‑world compliance leadership.