Today’s business world is highly regulated. As a result, compliance becomes crucial to a business’s success and longevity. Adherence to rules and regulations isn’t optional. It’s also a core responsibility of the company’s leadership and owners. Over the years, I witnessed many organizations ignoring their fiduciary roles. Unfortunately, many organizations don’t realize the extent of their compliance liability. When things go wrong, and they try to shift the blame to a vendor or advisor. Some of the most frequent forms of blame-shifting are:

• “The accountant missed it.”
• “Our compliance consultant dropped the ball.” or
• “The vendor assured us it was fine.”

Here’s the hard truth for organizations and their leadership teams and owners: you can’t outsource liability. No matter how many experts, accountants, lawyers, or third-party vendors you hire, the ultimate accountability for compliance is yours. Whether it is fraud prevention or regulatory adherence, responsibility and liability stay with you, the business entity, and its principals.

Don’t think this is an opinion. It is a fact upheld by many court cases across industries and agencies. Liability cannot be shifted from the company with primary responsibility for compliance to a vendor. This is a litigation-tested position held by courts and federal agencies across industries. Whether you’re dealing with tax reporting, government contracts, financial disclosures, data privacy, or anti-bribery rules, the buck stops with management. Delegating the work doesn’t mean delegating the responsibility.

Real World Example

Over a decade ago, a CPA audit firm asked me to work with one of their clients on a clean-up mission. The client company failed its independent audit. They did not have compliant business systems. Their accounting system was inadequate. They failed to maintain the required records and engaged in fraudulent billing.

The audit firm was willing to give the client time to develop a comprehensive remediation plan before issuing an adverse audit opinion. This courtesy was dependent on them becoming my client. We would generate a corrective action plan, which could be included with the audit letter and notice to the government. 

I had a productive meeting with the new CFO, who is new to the company. He came in to replace the unqualified controller that had “overseen” the period of non-compliance. We had a scope of work, methodology, and timeline to provide to the audit firm. All we needed was the CEO’s signature. That’s when things fell apart.

The CEO walked in, looked at me, and asked: “How much professional liability insurance do you have?” My response, “It doesn’t matter because you just blew your opportunity to do things correctly. Your question indicates that you still intend to blame someone else for something that is your responsibility.” The CFO stood looking horrified and followed me to the parking lot. He decided to quit that day. I called the audit firm and told them what had happened. They issued their audit report with an adverse opinion on the company. Government auditors arrived 30 days later, and the company was forced to close. Criminal charges were brought against the CEO, board members, former controller, and others. Who didn’t get charged? The vendors whom the CEO tried to blame.

Fiduciary Responsibility and Liability Don’t Transfer

If you review federal and state laws, they are crystal clear on this point. Under frameworks like the

• False Claims Act (FCA),
• Sarbanes-Oxley Act (SOX) internal control requirements,
• Mail and Wire Fraud Statutes (18 USC § 1341, 1343)
• Corporate and Criminal Fraud Accountability Act (within SOX, Title VIII),
• Dodd-Frank Wall Street Reform and Consumer Protection Act (2010)
• Securities and Exchange Act of 1934
• Securities Act of 1933
• Cost principles in the Federal Acquisition Regulation (FAR) or 2 CFR Part 200,
• State laws and regulations, and
• Contract-specific terms and conditions.

The responsibility to comply with all aspects of these laws and regulations falls onto either the:

• submitting entity, which prepares and submits a filing, invoice, etc., or
• company itself, the primary legal entity for which the filing is made.

Usually, the submitting entity is the same as the primary legal entity. The designations are usually determined by the document preparation and written agreement.

Many organizations think that hiring a grant writer, a bookkeeper, or consultants creates a liability shield. It does NOT. The company, signatories on documents, officers, and even board members and employees can be held liable for non-compliance and illegalities. So, if a proposal contains inflated costs, the company is liable. If financial statements misclassify expenses, the company is liable. If internal controls fail to prevent fraud, the business—not the vendor—faces the consequences. These consequences can include: repayment, fines (often triple damages plus per-violation penalties), debarment from contracts, criminal referrals, and reputational destruction.

Accountability Anchor Point

When you accept government funding, operate in a specific jurisdiction, and run the company, compliance is part of your responsibilities. These responsibilities fall on the officers, board members, executives, and certain professionals. You agree to have and are required to implement compliant systems, oversight, and verification processes. Vendors provide expertise and support. They do not own your books, your decisions, or your regulatory submissions. You do.

NEWBIE, Inc. Example

Consider a common scenario I’ve seen repeatedly in practice. A company (NEWBIE, Inc.) engages advisors to handle all aspects of government funding compliance and accounting. They also hire a grant writer. The CEO of the newly formed company (NEWBIE) has no accounting or financial training or experience. He hasn’t even read the requirements or understood allowable costs, fee limits, etc.

NEWBIE’s CEO provides the scientific content for an NIH proposal. He then directs the grant writer and the accounting firm to develop the budget. His only direction is that the budget should be for the maximum allowable award amount. The grant writer is being paid a flat fee plus a contingent fee (10%) of any successful submission. [Note: Companies should develop their budgets for every project based on what it will cost. They should develop best estimates supported by third-party data where possible. The budget should include total costs to the company. It should not be limited to costs that will be included in the government proposal.]

The two vendors develop the NIH STTR (Small Business Technology Transfer) proposal budget. They make many incorrect assumptions, misstatements, and other errors:

• Salaries and wages for employees and 1099-NEC contractors under Direct Labor.
• Salaries are listed at the NIH salary cap amount. They should either be actual current or planned future levels.
  • Issues: Compensation amounts are overstated, “pad” project costs, and will result in overcharges to the government if approved as billing rates, etc.
    • No employee or contractor receives compensation at the levels listed. The highest salary amount paid is $140,000. Many of the people listed, including the CEO/PI, are not actually being paid.
    • The company does not have funding to support the listed salary amounts.
    • Direct Labor/Key Personnel section is for W-2 employees or for LLC members guaranteed payments, distributions, etc.
• Contingent fees payable to the grant writer are included in the project budget in indirect costs.
  • Issue: Contingent fees are unallowable as direct or indirect costs per:
    • FAR 31.205-33 Professional and consultant service fees
    • FAR 52.203-5 Covenant Against Contingent Fees
    • 2 CFR Part 200 Uniform Guidance

Other Compliance Issues

• The accounting firm recommends treating the grant writer’s contingent fee as an allowable indirect cost.
• Indirect rates are developed using inflated labor and fringe benefit costs.
• The research entity included in the proposal for subaward is a related entity. The non-profit research institute is under common control of the CEO/PI, board members, and other employees of the company.
• The CEO/PI is the primary researcher in both organizations. He receives a salary at the research institute. He will have financial benefit via the for-profit from an increase in the valuation of IP and the company. No disclosure is made of the relationship between the entities.
• The accounting firm and grant writer “embellish” the company’s current capabilities and status. They decide to draw information from the affiliated non-profit’s “bio” to beef up the for-profit credentials.
• The accounting firm includes items in fringe benefits that inflate the costs. The benefits include items the company will not be provide.
• The accounting firm develops overhead and facilities/administrative (F&A or G&A). They use data from a long-established company, with which they also do work. The company’s are not comparable. The numbers used in the rate development overstate NEWBIE’s operations and activities, current or planned.
• NEWBIE’s CEO provides his login credentials to the grant writer to answer questions and submit the proposal. He did not review or discuss the budget and rates with the accounting firm or grant writer.

The $#!+ Hits the Fan

NEWBIE gets the award and begins work on the project. They are aggressively billing the project as they don’t have any money in the bank or other projects. The CEO and the accounting firm draw funds from the NIH project for any company bill. Six months into the two-year project, NEWBIE has already spent 50% of the funding. It has not achieved any of the project’s technical objectives. When they file an interim report and attempt to draw additional funds, they find their account is frozen. The auditor arrives the following week.

Audit Nightmare

NEWBIE’s CEO greets the auditors and attempts to hand them off to the accounting firm. He indicates that the auditors will need to travel to the accounting firm located in another state to view any records, etc. The CEO discloses that he doesn’t have access to accounting records, bank and credit card statements, and other financial information. He has “delegated” everything to the accounting firm. He also informs the auditors that NEWBIE just passed an independent audit. The audit was conducted by an “audit firm” that the accounting firm works with regularly.

Auditor response:

• NEWBIE and its leadership are responsible for oversight and control of all aspects of the project. That responsibility includes financial reporting, transactions, and drawing down funds.
• NEWBIE is required to maintain records and always have access to them.
• The “audit” conducted of the accounting firm was invalid on the accounting firm was not valid. The audit firm was not a qualified auditor for government-funded projects. The auditor is the spouse of the accounting firm, so it was not an independent audit.
• NEWBIE admitted they had never met or spoken to the auditors. They were not asked any questions.
• NEWBIE had no policies, procedures, internal controls, or other required systems. They “used” the accounting firms.
• The government auditor found that NEWBIE committed fraud in the proposal. They also found fraud in each invoice/draw against the project. The fraud included overstated costs and drawing down funds for non-project-related.

Pointing Fingers

NEWBIE’s CEO immediately pointed the finger at the grant writer and the accounting firm for the proposal issues. The CEO stated he didn’t have anything to do with the numbers. He never even looked at them! He also told the auditor that both advisors said that the contingent fee was an allowable cost if it was built into the budget.

In his race to point the finger at his vendors, the CEO essentially confessed to the violations the auditors had already discovered. He also exposed additional issues they hadn’t yet found.

The CEO was not the only member of NEWBIE to be charged. Several board members responsible for audit, financial reporting, and legal matters also faced charges. Why? The board members had fiduciary responsibilities to ensure NEWBIE was following the rules. Audit oversight and financial statement preparation are key responsibilities.

When the CEO tries again to point the finger at the accountant and grant writer, the response from the agency is simple: “You certified the costs. You are responsible.” So, remember that signing documents related to a proposal, billing the government, etc., makes you personally and professionally responsible. While the CEO didn’t actually submit the information, his credentials were used. His credentials were used in the government system to answer questionnaires, make representations, and certify submissions. Sharing credentials violates the SAM.gov terms of use. So, the CEO was on the hook for that violation as well.

Truth and Consequences

NEWBIE went out of business, and due to other key compliance items that were overlooked, the government was able to pursue the personal assets of those charged to recover the funds paid, plus interest and penalties. Several of NEWBIE’s employees and those of the affiliated non-profit were made ineligible to work on government-funded projects.

Beyond Government Funding

It is crucial to note that the same principles apply far beyond government contracting. In the private sector, there are many federal and state requirements related to tax compliance, SEC filings, HIPAA or CCPA data breaches, and FCPA anti-corruption violations. Courts repeatedly rule that management’s duty of oversight cannot be fully delegated. You can hire help, but you cannot abdicate control.

Why “But My Vendor Said…” Is Not a Defense

There are several practical and legal reasons that companies and their leaders can’t simply pass the buck. The “I didn’t do it, they did it” defense fails because the rules are written to ensure accountability in the company receiving funds, doing business, etc.

Certification and Representation Requirements

Compliance filings generally require the CEO, CFO, or an authorized signer to certify under penalty of perjury that the information is true and complete to the best of their knowledge. That certification is yours alone. The person signing is expected to have the necessary access, expertise, and role within the company to issue the certification. As stated earlier, handing off your credentials to someone else to act on your behalf is equivalent to your executing the certification. Furthermore, when you allow someone else to use your credentials, the system records cannot indicate that someone else did it. Any time you want someone else to fulfill a role in a system for you, ensure that they have their own credentials and that they have the proper understanding and knowledge to execute the role.

Duty of Reasonable Inquiry

I’ve used the word previously but now is a good time to explain fiduciary responsibility and a related concept, due diligence.

Fiduciary Duty in Business

Fiduciary duty is defined as the legal and ethical obligation to act in the best interests of another party. In the case of NEWBIE, the CEO, board members, and employees were responsible for acting in the best interests of stockholders, employees, the funding agency, etc. In executing that duty, people are expected to act in good faith, with the highest standard of care and loyalty. The executives, including the CEO, were in control of the company’s assets (funds from the NIH project, etc.) and were expected to understand and follow the rules and regulations governing those funds for the company’s best interests.

People in a fiduciary role are expected to exercise due diligence, which involves understanding requirements, investigating, verifying, and analyzing transactions, activities, and work products to ensure accuracy. etc.

Regulatory Expectations

When you run a business, participate in government-funded projects, and enter into contracts, you are expected to perform due diligence. Frequently, companies, especially startups, lack qualified team members to handle the more complex and regulated aspects of their businesses. Many times, I’ve heard that “Joe is good at math, so he’s handling the accounting and financial reports.” “Megan is great with people, so she is handling HR.” “Madison’s father and brothers are attorneys, so we made Madison our compliance officer.”

You know what I’m going to say at this point: accounting isn’t just math, HR isn’t about being “good with people,” and compliance isn’t something that happens through osmosis. Companies need to invest early and often in advisors with depth and breadth of experience in business, functional expertise, and, when it comes to government funding, the special rules and regulations that accompany it. Compliance requirements are a complex weave of the everyday, every business thing that must be done and followed, and the company-specific, contract-specific requirements.

Another level of complexity comes from the impact of the legal and tax entity types, ownership structures (investor composition), development stage, funding agreements, related entities, industry regulations, and more. While working with a medical device company with both US and European operations, the interplay of international tax, IP, transfer pricing, and other business elements created complex decisions where a wrong decision could result in a Jenga-like collapse of the entities.

One Size Does NOT Fit All or Even Most

As business owners, we frequently ask for referrals, thinking this gets us one step closer to finding a qualified vendor. Unfortunately, that can often be furthest from the truth. The differences between companies, legal agreements, relationships, etc., can be significant. Also, when it comes to compliance, you will often find that the referring entity may not have had an issue yet.

A few years ago, I had a meeting with one of my favorite attorneys. He handles corporate start-ups through IPOs and specializes in the securities aspect for these companies. During our lunchtime chatter, I mentioned that many of my new clients were contacting me because they had used a grant-writing firm that charged contingent fees and handled all their reporting, certifications, and accounting.  These companies had failed audits and were facing significant legal issues over “material misstatements” in their proposals, inflated costs, and other issues because they relied on the grant writers and accountants to know the rules. While I didn’t name the firm, he immediately knew the firm, because several of his clients had the same experience. He was, in fact, working on a lawsuit against the firm.

Do Your Due Diligence

Companies must verify credentials and understand key points about what they need from a vendor, particularly those related to government funding and compliance. When I’m talking with prospective clients who are evaluating several companies for their needs, I often provide them with two or three crucial areas of compliance to understand, references for that information, and questions to ask the other prospective vendors.  

Another screening technique is to read materials on companies’ websites and look for the author and sources. You want to check out white papers, long-form articles (on deep-dive topics), templates, and books. The more you can understand what the vendor knows and doesn’t, the better off you will be.

Real World Example

When I started my business over 20 years ago, I was fortunate to begin writing articles for many international, national, regional, and local publications. Those articles enabled companies, inventors, and others to understand my expertise and experience. One of my competitors decided to literally copy one of my published articles, replace my name with his, and take it into a prospect meeting. I found out about this when the CEO called me right after that meeting and asked me to meet with him the next week.

My competitor made two mistakes: he took in content that wasn’t his to position himself as an expert, and…he put his name on the article he had copied. Not only was he violating copyright laws, but he also revealed his lack of integrity by that action.

Read the Vendor Agreement

So many times, companies sign agreements without fully understanding what the terms and conditions mean. For instance, your tax accountant may provide an agreement to “prepare taxes based on the numbers and reports provided by the client.” This usually means the tax preparer will just plug the numbers into the tax software and will not validate the classifications, etc. Another thing to consider is that many organizations across all types and industries are using AI, templates, and other technologies to create what I call find-and-replace documents. They are taking your information and filling in blanks. That’s all well and good if they subsequently read through and edit the language to fit your specific business and legal situations. If they don’t, then you may find holes in your contract and other terms big enough for Artemis III to fly through.

Read the Work Product

The work product of any vendor (and arguably employees) should not be blindly accepted. Any vendor’s work product must be reviewed, discussed, and analyzed to ensure that the vendor had the correct information. When I’m working with clients on everything from policies to final reports and rates, we walk through the details. I am not working 24/7/365 in their businesses. My perspective is through the information they have shared (or haven’t). I can deploy my expertise for the client in context, but each client has to gain an understanding of the underlying rules and implications on their business and the joint work product we produce. Ignorance is not a defense—especially when you select and pay the vendor.

Limited Recourse Against Vendors

Legal action is expensive. I’ve found that most small businesses don’t have the resources to pursue actions against a negligent accountant or consultant. For one of my clients, the obvious negligence and misrepresentations of qualifications were substantial. However, the litigation attorney told the client that initial costs would exceed $100,000 to get the case to court.

Those costs wouldn’t be recoverable, nor would any additional costs be incurred, because the vendor agreement failed to specify that legal costs could be included in litigation cost recovery.  Another complicating factor was that the client was in North Carolina, and the vendor was in Colorado. The vendor agreement specified that all legal matters were governed by Colorado laws and had to be filed in that state. Again, read your agreements and understand them. The company didn’t have any funds to pursue litigation, but we did negotiate a refund of all fees paid to the vendor.

Realistic Options

So, while you might have the option to pursue and recover some damages through malpractice claims or breach-of-contract suits, if you have ironclad documentation of bad advice and can prove causation, it will be costly and time-consuming. Furthermore, it won’t solve your problems with the government. It also won’t erase your obligations to the government or affected parties. You will still repay the funds, pay the fines, and, if you are lucky, must fix the compliance gaps and continue doing business. Your vendor agreement, the vendor’s insurance, and/or assets rarely cover the full cost, let alone the full scope of your exposure and reputational damage. So, your best option is to do your homework up front with qualified, competent vendors and take responsibility for understanding the rules your business must follow, at least the highlights of each requirement, if not the details.

Your Real-World Consequences

Many company founders, officers, board members, and key personnel make the mistake of thinking that they don’t have personal liability, that everything falls on the company. Unfortunately, liability too often attaches first at the personal level and then shifts to the company. When we sign as the certifying party, you personally state that you have the knowledge and experience to confirm that things are being done correctly, that the information is representative, etc. Your signature means you are taking responsibility.

Many PIs and others sign documents for government filings (technical reports, financial reports, invoices, drawdowns, etc.). PIs, in particular, need to be aware of the scope of their responsibilities. It isn’t just the technical aspects of the project you are responsible for. You are also responsible for the budget and how it is spent. If you aren’t reviewing the invoices/draw documents, reviewing time charged to projects and by whom, etc., then you are overlooking a significant part of your fiduciary role as PI.

Audits, investigations, and lawsuits usually focus on the company and its executives. Others, like PIs, have personal liability too. Personal liability can be imposed on officers and directors who fail in their fiduciary duties. It can also pass to them when the company fails to maintain its proper legal structure.

Real World Example: Construction Company

Several years ago, a construction company in Massachusetts contacted me for assistance with their most recent government construction contract. My process always starts with doing some due diligence on the new client. I check their government registration information, Secretary of State registrations (Massachusetts and Delaware), and other public records to get a sense of the company’s status. It didn’t take long for me to find the first major issue.

This company failed to maintain its corporate entity status by failing to file annual reports and pay appropriate fees. The State of Delaware had administratively dissolved its corporate structure. The operating privilege as a foreign corporation in Massachusetts was no longer valid. This company was no longer a corporation, but a partnership, and had been for over 7 years! To make matters even worse, a new company now had my new client’s legal name. So, the contract that was just issued, the registration in government systems, state and federal tax filings, and many other things were invalid.

Reality Check

It was a difficult conversation to have with the PI, CEO, CFO, and board. It was also expensive for the company, as this “oversight” affected every aspect of their business, including IP, tax, and securities filings. Legal costs, fines, penalties, loss of business, and other expenses totaled well over $1 million. That million did not include any costs related to government contract noncompliance; it only covered the initial costs of dealing with name changes, refiling tax returns, etc.

There was a whole lot of finger-pointing among executives, board members, staff, and advisors. Ultimately, it didn’t matter who specifically dropped the ball, because the real failure was systemic. The company lacked the business, financial, and compliance systems necessary to maintain its good standing and meet regulatory requirements.

Practical Steps to Protect Yourself and Your Business

It isn’t all doom and gloom. Compliance isn’t an insurmountable problem, but it is an ongoing process. Your business is growing and changing. Government requirements evolve and often expand. The more projects you do, the more relationships you create, and the more complex things become.

The good news? You can dramatically reduce your risk by recognizing compliance as a core business process integral to your daily, transactional, and strategic operations. It isn’t an afterthought or something to be outsourced and ignored.

Own the Numbers and the Narrative.

The more you know and understand, the higher your compliance level will be. Part of that process is reviewing every certification, cost proposal, financial report, and compliance filing before they go out. Ask questions until you understand the “why” behind every number and assumption.

Build Robust Internal Controls.

Begin your compliance journey by reviewing your existing system, if you have one, or by implementing a new one that meets regulatory standards (think DCAA-compliant, FAR and GAAP accounting for government work, SOX-level controls for public companies, and documented processes for private firms). Leveraging new and existing technologies, such as integrated time tracking, financial reporting tools, expense categorization, and audit trails, makes this manageable.

Choose and Screen Vendors Wisely.

It should go without saying that you need vendors with verifiable, proven expertise.  It is also important to establish the appropriate vendor compensation. You should use fixed-fee, project-based, or hourly arrangements rather than success-based or contingent structures, which can create conflicts of interest and lead to disallowed costs. Be sure to include indemnification clauses and establish the state law that would govern the agreement. Also, specify remedies for performance failures. I’ll say it one more time: recognize that vendor expertise does not replace your own liability and due diligence requirements.

Real World Application

A key part of my consulting relationship with clients is ensuring they develop internal knowledge and expertise to remain compliant daily. From customized policies and procedures to training and educational materials, coaching, and skill development, my job is to prepare the client to operate in compliance with the rules. I can’t be there every minute of the day. I’m not the one performing the work. The client is ultimately responsible, and the on-site employee team needs the skills and experience to do the work correctly. I’m a phone call, Zoom meeting, or email away to help troubleshoot issues and analyze new requirements and changes. The team calls when faced with a complex issue or something new.

Train and Document.

It seems like every meeting with clients brings a change that needs to be incorporated and documented in company policies, desk procedures, and systems. It is important to ensure your team understands key concepts, allowability, reasonableness, and allocability rules relevant to your industry. Recordkeeping and timekeeping requirements can make or break your business during an audit. Your team needs to maintain clear records of decisions, reviews, and approvals. Every employee, whether they work on a government project or not, should understand how their role affects your compliance, both in general and specifically with government projects and other funding agreements.

Compliance is an ongoing process. So, it is important to maintain records of training topics, attendees, and related details. Today’s technology tools can be combined with intranet access and other platforms to ensure that training happens, is documented, and keeps your organization current.

Engage Compliance Expertise Proactively.

Over the years, I’ve spent more time helping companies clean up after a failed audit than I’d like. It is always more expensive to clean up non-compliance (to the limited extent you can) than to invest in compliant systems up front.

Remember that non-compliance usually leads to disallowed costs. Disallowed costs mean repayment of funds to the government for those costs. You may also pay interest, fines, and penalties on those funds. Companies may be suspended or debarred from participating in the programs. You can even face criminal and civil charges.

Many people assume that compliance begins after the first award. It actually begins when you register in the government system (SAM.gov), ramps up as you submit your proposal, and reaches another level when you accept the award and begin spending the money.

Non-Compliance Icebergs

Non-compliance issues in your business related to government funding can become the tip of the iceberg when audits reveal “regular” business non-compliance with taxes (sales, use, property), overtime, employee classification (employee or contractor), securities violations, and many more areas. One company I worked with hit a trifecta of auditors, not a good one. The CFO arrived to find the conference room full of auditors from DCAA, the state department of revenue for sales and use taxes, and county property tax auditors. This particular company was 20 years old and kept referring to itself as a “start-up.”

It was a big reality check for the company leadership, board, and investors. Fortunately, the CFO was new and wasn’t present when the failure to comply occurred. So, the CFO asked for time to get things into compliance, quantify all the violations, and implement a comprehensive, compliant business system. Working with the auditors, the CFO created a plan and timeline.

The agencies, due to the willingness to take responsibility, limited the audit period to just three years for tax issues, waived fines and penalties, and were generally happy not to have a long, drawn-out battle. The DCAA had to take a hard position and called in the Board Chair and CEO. They had a tighter timeline, held frequent audit status meetings, and reviewed findings and reports in excruciating detail. The upside of the process was that the company could continue working on its government projects while still participating in an additional one.

Accountability Starts (and Ends) at the Top

Compliance failures, fraud, or legal violations happen when leadership doesn’t take the requirements seriously. Businesses are happy to invest in research and commercialization efforts. What they fail to understand is that compliance is about commercialization and funding. The most successful companies I work with view compliance not as a burden but as a competitive advantage, evidence of strong governance, operational excellence, and integrity.

Whether you are a startup chasing grants, a growing enterprise managing contracts, or an established firm navigating complex regulations, compliance isn’t optional, and everyone is part of the compliance process. If you are in a key position (CEO, PI, etc.) related to government-funded projects, you are the compliance officer. Your support team (accountants, consultants, and other vendors) is a valuable resource, but they are not responsible for compliance.

The bottom line is that you must learn the rules. Make sure your company does the work. Monitor operations and apply rigorous oversight. When you can comply with confidence, you can succeed with integrity.

That’s how you build a business that lasts.