The settlement gets signed on a Thursday. General counsel exhales. The comms team pushes the statement. Somewhere a bottle gets opened quietly, because you do not celebrate a settlement out loud.
Everyone in the room treats it as the end.
It is the start. An FTC consent order is not the close of an enforcement action. It is the opening of a 20-year obligation the company just made legally binding, and almost nobody asked the only question that matters over the next two decades: who owns this now?
The settlement ends the case. The decree hires you for 20 years.
Read a modern FTC order and it does not read like a punishment. It reads like a job description.
Twenty years is the standard term. Over that span the order typically demands a written program, recordkeeping, and a third-party assessment every two years, which works out to roughly ten separate assessments before the thing expires. Corporate Compliance Insights calls those assessments the costliest part of the whole decree, and they are right. But the cost is not the trap.
The assessor has to be one the FTC will approve. The evidence has to already exist on the day they show up. And in most recent orders, a senior corporate officer has to personally certify compliance, in writing, every single year.
That is not a fine you pay and forget. That is a control you run continuously, with a name attached, for two decades.
Read that back. Continuously. With a name attached. For twenty years. Then look at how the case was actually staffed: a deal team assembled to end it, not a standing function built to keep it.
Twenty years is longer than anyone who signed it will stay.
Here is the arithmetic nobody does in the settlement meeting.
Twenty years is two or three CISOs. A couple of general counsels. At least one CEO, probably two. The person who negotiated the decree and understood every clause of it will be gone long before the assessor arrives for the fourth cycle.
So the obligation gets orphaned.
It lives in a PDF on a shared drive. It lives in the departing GC's head. It lives in a calendar reminder that gets snoozed the week its author resigns. The knowledge is tribal, and tribal knowledge walks out the door wearing the badge of whoever held it.
Then year seven arrives. The assessor asks for proof that a specific control has run without a gap since the order took effect. Nobody can produce it. Not because the control failed, but because no one was ever named to own the record that it ran.
That is how a settled case becomes a fresh enforcement action. The FTC does not have to catch you doing something new. They only have to catch you unable to prove you did the old thing you already promised.
And the direction of travel is not toward forgiveness. The SEC just stood up a dedicated unit for accounting and financial-reporting fraud, a signal that regulators are building persistence and specialization into enforcement, not retiring it. Orders are getting longer memories, not shorter ones.
The fix is a name, not a binder.
The binder is not the problem. Every company has the binder. The binder is where obligations go to be forgotten.
What almost no company has is an owner: a single named person accountable for the decree as a live commitment, with the authority to keep the control running and the mandate to hand it off cleanly when they leave.
Not a department. A person. Departments do not get subpoenaed. People certify. The difference between a folder and a program is whether that accountability survives the person who accepted it.
So here is Monday. Pull the consent order, or any binding obligation with a multi-year tail: a deferred prosecution agreement, a corporate integrity agreement, a settlement with recurring terms. For each recurring requirement, write down three things:
- The named owner today, by person, not by team.
- The exact evidence the next assessment will demand, and where that evidence lives right now.
- What happens to both when that owner leaves.
If you cannot fill in the third column, you do not have a governance program. You have a promise nobody is keeping.
The obligation binds you for 20 years whether or not you ever named someone. The only real choice is whether the name is written down before the assessor asks, or discovered, painfully, after.
So pull the last order your company signed. Whose name is on it for year 15?
Sources
- You Settled With the FTC; Now Comes a 20-Year Consent Decree, Corporate Compliance Insights
- The SEC’s New Accounting Fraud Unit: What It Signals About Where Enforcement Is Headed, Volkov Law, Corruption, Crime & Compliance