What happened
Assistant Attorney General A. Tysen Duva, who heads the criminal division at the US Department of Justice, said on Wednesday that it is critically important boards and executive teams approve ample resources for compliance. He made the point in a fireside chat with ECI Compliance Week president Maurice L. Crescenzi Jr. at the 2026 Third-Party Risk Management and Supply Chain Summit in Chicago.
The argument he attached to it was about speed. Compliance departments, he said, face fast-moving threats from AI- and cyber-powered crime and corruption. That is a resourcing claim rather than a technical one. Detection work that used to happen at human pace now happens at machine pace, and the team either has the tools and the people to look, or it does not.
The office matters here. The criminal division is the part of DOJ that decides how corporate misconduct is charged and resolved, and the standard its prosecutors apply to a compliance programme is set out in the Evaluation of Corporate Compliance Programs, last revised in September 2024. The document asks three broad questions: whether a programme is well designed, whether it is adequately resourced and empowered, and whether it works in practice. The middle question is the one a budget line answers, and it is the one a board signs off.
The venue carries its own signal. Third parties, meaning agents, distributors, resellers and suppliers, are a recurring route for bribery, sanctions and fraud failures, and third-party management is a standard area in the evaluation criteria. The number of suppliers that get diligence beyond a questionnaire, and how often monitoring repeats after onboarding, is decided by headcount and data access, not by policy intent.
Why this is a GRC story
Money is a control. Resourcing sits inside the framework as an assessed factor, not outside it. A compliance function that is understaffed or dependent on the business for tooling is a described weakness in the same document prosecutors read before they decide on a declination, a non-prosecution agreement or a charge. "We were not given budget" is a control gap with a paper trail.
Boards need the reasoning on file. When a board approves a compliance budget, or trims one, the minutes should record what risk was discussed and what was accepted. Regulators and prosecutors rarely ask whether a board cared. They ask what the board saw. An approval with no supporting risk assessment is hard to distinguish from an approval nobody examined.
AI tooling inherits the same test. Teams adopting AI for screening, monitoring and review need people who can govern those systems: validation, logging, escalation and a way to show a human stayed accountable. Buying the tool without the governance capacity converts a resourcing gap into a model risk, and it lands in the same evaluation section.
What to watch
Watch whether resourcing language starts appearing in resolution documents and declination letters, and whether prosecutors ask for compliance headcount and budget figures during investigations rather than only programme documents. For third-party programmes, the practical signal is monitoring cadence: how often high-risk suppliers are re-reviewed, and whether that cadence survives the next cost-cutting cycle. Both are easy to evidence in a board pack, which is exactly why they are worth fixing before anyone asks.
Attribution: Analysis based on Compliance Week and related public reporting. This article is original commentary, not a repost of the source material.