Episode 398 -- Anik Shah, SanDisk Head of Compliance: Anti-Corruption Developments and Managing Risks

Vera is a Chartered Accountant, Certified Internal Auditor, and award-winning Ethics and Compliance expert who writes and speaks about philosophy, business ethics, compliance, risk, and governance.She is the Executive Director of Boards of the Future™, a non-profit that works with corporate boards globally to advocate for stronger ethics, risk, and compliance backgrounds.She spends time between Milan and Los Angeles and serves as a Chair, director, and ethics advisor for global professional bodies, corporations, and international nonprofits.

Anik A. Shah is Director & Sr. Legal Counsel, Anti-Bribery and Anti-Corruption, at Sandisk, a global semiconductor manufacturer. Anik has more than 15 years of compliance, investigations, regulatory, and law enforcement experience.Anik started his career at the U.S. Securities and Exchange Commission (SEC), where he investigated anti-fraud, anti-bribery, and other violations by multi-national financial institutions and technology companies and their executives. At the SEC, Anik routinely partnered with law enforcement and regulatory authorities throughout the U.S. and in Europe, Africa, and Asia on multi-jurisdictional investigations and enforcement. He was also selected for a special detail assignment as a federal prosecutor with the U.S. Department of Justice.Prior to joining Sandisk, Anik worked on compliance, regulatory, and corporate governance issues at multi-national financial institutions. As a leading anti-bribery and anti-corruption practitioner, Anik routinely presents at industry, professional, and trade association events.

Each year, LRN’s Ethics & Compliance Program Effectiveness Report provides one of the most useful snapshots of the global compliance profession. The 2026 report—“The Next Leap: Technology, Trust, and the Transformation of Compliance”—again offers valuable insight into how corporate ethics and compliance programs are evolving amid rapid technological change, new regulatory expectations, and shifting workplace culture.Based on surveys of more than 2,500 compliance professionals and employees worldwide, the report paints a picture of a profession that is progressing—but unevenly. Compliance programs are becoming more sophisticated and technologically enabled, yet many organizations are still struggling to translate technology investments into measurable improvements in culture, risk detection, and program effectiveness.

The Commerce Department’s Bureau of Industry and Security (BIS) has sent an unmistakable message to the semiconductor industry: creative interpretations of the Export Administration Regulations (EAR) will not shield companies from significant enforcement risk.BIS imposed a $252 million penalty against Applied Materials — the second-largest fine in the agency’s history — for illegally exporting semiconductor manufacturing equipment to China’s Semiconductor Manufacturing International Corp. (SMIC), an Entity List company since 2020. The size of the penalty alone warrants attention. But the facts and legal analysis underlying the case provide even more important compliance lessons.

Episode 395 of Corruption, Crime and Compliance features an in-depth conversation with Bob Lemmond, the new CEO of LRN, on the evolving role of ethics and compliance in today’s risk environment. In this episode, Bob discusses how organizations can move beyond “check-the-box” compliance to embed a culture of integrity that drives performance, mitigates misconduct risk, and strengthens stakeholder trust. He shares his perspective on the growing complexity of global regulatory expectations, the importance of leadership tone and middle-management engagement, the integration of technology and data analytics into compliance programs, and the measurable business value of ethical culture. The discussion offers practical insights for compliance officers, boards, and senior executives navigating enforcement uncertainty while maintaining high standards of corporate accountability.

FCPA enforcement in 2025 was defined by what did not happen as much as what did. Compared to prior years, the number of publicly announced cases declined sharply, corporate resolutions were fewer, and the overall enforcement posture appeared more restrained. This slowdown, however, reflects a policy recalibration—not a dismantling—of the FCPA enforcement regime.Early in the year, DOJ paused FCPA enforcement activity while it reviewed policy priorities. That pause, followed by the issuance of revised enforcement guidance mid-year, produced a measurable decline in announced actions. Several investigations slowed, at least one long-running prosecution was dismissed, and the SEC brought no new FCPA cases during the year.DOJ’s revised guidance emphasized selectivity, signaling that enforcement would focus on higher-impact cases—large bribe payments, clear evidence of corrupt intent, sophisticated concealment, and conduct implicating U.S. national security or competitiveness. Lower-value cases and routine “business courtesy” fact patterns were explicitly deprioritized.The public numbers reflect that shift. 2025 was one of the lightest FCPA enforcement years in more than a decade. DOJ announced only a small handful of corporate outcomes, while continuing to emphasize voluntary self-disclosure and cooperation through declinations and deferred prosecution agreements.

Earlier this year, the Securities and Exchange Commission (SEC) charged Archer-Daniels-Midland Company (ADM) and three of its former executives with accounting and disclosure fraud, in what has become one of the most significant financial reporting enforcement actions of 2026. The case underscores a fundamental compliance truth: strong internal controls and transparent disclosures are not optional — they are core risk mitigants that protect investors, markets, and corporate reputations.At its core, the ADM matter highlights how breakdowns in accounting controls and disclosure practices — even when aimed at projecting performance — can quickly spiral into regulatory enforcement, civil penalties, and individual liability.On January 27, 2026, the SEC announced a settlement against ADM, as well as actions against two former executives, and a litigated complaint against a third. The SEC found that ADM materially overstated the performance of its nutrition business segment by recording intersegment transactions on terms that did not approximate market, thereby misleading investors about the segment’s profitability and growth.According to the order, executives directed “adjustments” to nutrition’s results — including retroactive rebates and price changes not available to third parties — to hit targeted profit levels and mask underperformance in key fiscal years. These adjustments were inconsistent with ADM’s internal policies and its public representations, creating materially false and misleading financial statements for multiple annual and quarterly reporting periods.ADM settled the matter and agreed to pay a $40 million civil penalty. Two former executives agreed to pay civil penalties and disgorgement, and one agreed to an officer and director bar. Meanwhile, the SEC is pursuing litigation against a third executive for fraud-based claims.Regulators do not view financial reporting risk as an isolated technical issue. The SEC’s enforcement approach in this case reflects several core priorities that every compliance leader should internalize.

Conflicts of interest are not abstract compliance niceties. They are serious risks to integrity that, if left unidentified or unmitigated, can erode employee trust, compromise decision-making, and expose organizations to regulatory enforcement, litigation, and reputational harm. Recent high-profile scandals involving relationships between supervisors and subordinates have underscored how personal conflicts can quickly morph into enterprise-wide compliance failures when controls, oversight, and ethical culture are weak.A conflict of interest program, when thoughtfully designed and actively managed, is far more than a static policy on a shelf. It is a risk identification and mitigation engine that anticipates where incentives might diverge from organizational interests, assesses control effectiveness, and embeds ethical decision-making into everyday business processes.Conflicts of interest arise wherever personal interests have the potential to interfere — or appear to interfere — with the objective performance of professional duties. Classic examples include financial interests in third parties, personal relationships that influence work decisions, and outside employment that competes with an employer’s interests.

The Justice Department has increased False Claims Act prosecutions, reflecting a continued focus on healthcare fraud and a new initiative on trade fraud. DOJ announced the largest annual recovery figure in the FCA's history -- $6.8 billion in settlements and recoveries.  FCA whistleblowers filed a record number of new cases -- 1,297 lawsuits and the government initiated 401 investigations. Since 1986, DOJ has recovered a total in excess of $85 billion. DOJ is taking full advantage of the power provisions of the FCA that include treble damages, broad liability coverage, and favorable amendments adopted to increase government leverage. Health care fraud remained the primary source of FCA settlements. Approximately $5.7 billion of the total $6.8 billion related to actions against healthcare companies. Notably, DOJ continued and expanded its success in three major areas: Managed Care, Prescription Drugs, and Medically Unnecessary Care.

From my perspective, hopefully a reasonable one, there is a little too much AI-Risk Hype. Not to belittle the experts or ignore potential risk concerns but this is getting a little carried away.  The compliance industry appears to be taken over by AI-this and AI-that. Third party risk bleeds into major AI risks, corporate governance needs to incorporate AI risks, and policies and procedures have to incorporate AI risks, while of course no risk assessment is worth its sale unless there is a discussion of dramatic AI risks. My first response is whoa -- let's all take a deep breath. The best self-help tactic when experiencing anxiety is to take a deep breath, a proven remedy. The AI discussion is veering off into a racing brain phenomena where the compliance profession is sprinting to keep up with the newest hypothetical risk. So let's take a calm and deliberate review of some of the key issues.