Inside the Enforcement File: What the Biggest Compliance Penalties of 2026 Reveal About Corporate Control Failures

From a $315 million opioid settlement in the United States to cybersecurity penalties in Australia and export-control violations involving Huawei, enforcement records show corporate safeguards weakening long before regulators act. A review of selected 2026 cases finds recurring gaps in management oversight, internal reporting, specialist expertise and the authority to act on known risks.

The U.S. Justice Department’s case against CVS Pharmacy concerned prescriptions that, prosecutors alleged, should never have been filled. Some involved excessive quantities of opioids. Others came from prescribers the government described as pill mills. Prosecutors said pharmacists saw warning signs and kept dispensing, sometimes under corporate policies that made their professional obligations harder to meet. The allegations cover conduct from 2013 to 2025. On October 13, CVS agreed to pay $315 million to resolve them. The company says the settlement admits no wrongdoing.

In June, Robert Bosch GmbH avoided criminal prosecution after voluntarily disclosing export-control violations. Two of its subsidiaries had sold more than $70 million in sensors and software to Huawei without the required U.S. authorization. Justice Department investigators found that Bosch’s trade compliance staff were ill-equipped to advise on the rule involved and that several opportunities to spot the problem had been missed. Bosch’s disclosure, cooperation and remediation earned a declination. It still paid a $36.2 million civil penalty to the Commerce Department.

Both matters ran for years, and both raise the question of whether the people responsible for compliance had the information, resources and authority to prevent violations. They ended differently partly because of what the companies did after identifying the problems. The legal regimes also differed. CVS was a civil case under the Controlled Substances Act and the False Claims Act, while Bosch was a criminal inquiry with a parallel civil settlement.

The same weaknesses recur in different forms across the records. Operational pressure can interfere with professional judgment. Companies can recognize a category of risk without supervising it. Technical obligations can outgrow the expertise of the people assigned to interpret them. Information that should prompt intervention can stay scattered across departments, subsidiaries and business units.

The penalties are not directly comparable. Regulators apply different laws, penalty frameworks and standards of liability, and a settlement does not establish the allegations behind it. The conduct described by regulators and courts tells us more.

For this first edition of Inside the Enforcement File, GRC Report Access reviewed selected 2026 enforcement actions and resolutions, focusing on control failures documented in official proceedings. The cases were chosen for what they show about those failures, not for the size of the fine.

When the Business Model Undercuts Compliance

The allegations against CVS touch on the relationship between commercial expectations and the professional obligations of the employees expected to enforce the law. According to the Justice Department, CVS filled prescriptions for opioids and other controlled substances that lacked a legitimate medical purpose. These included excessive quantities, prescriptions filled too early and “trinity” combinations of an opioid, a benzodiazepine and a muscle relaxant. Many were billed to federal healthcare programs. The government intervened in 2024 in a case brought by a former CVS employee, alleging violations of both statutes.

The government also challenged the arrangements under which pharmacists worked. Prosecutors alleged that staffing shortages and performance incentives pressured pharmacists to fill prescriptions without adequate scrutiny. They also alleged that certain company policies kept pharmacists from warning colleagues about problem prescribers.

CVS denies the allegations, and the settlement resolves allegations only. Even so, the government’s theory deserves attention because it places part of the responsibility for dispensing violations above the pharmacy counter. Pharmacists were expected to recognize suspicious prescriptions and exercise professional judgment, but staffing, workload, targets and information-sharing rules were set elsewhere. If those arrangements interfered with dispensing decisions, the compliance system depended on management choices that individual pharmacists could not change.

Large organizations know this problem, though a complaint rarely states it so plainly. A company assigns legal compliance to frontline staff while keeping central control over the conditions they work in. The arrangement is most fragile when compliance requires an employee to halt a transaction, question a customer or challenge a profitable relationship.

The settlement also shows what federal authorities considered necessary. Under a memorandum of agreement with the Drug Enforcement Administration, CVS must set up a hotline for employees and the public to report suspected illegal dispensing, monitor dispensing patterns across its pharmacies and establish a process to detect illegal prescribing. Each measure covers a different point where a warning could be lost: reporting, pattern recognition across individual transactions, and follow-up on suspect prescribers.

The management question is whether employees charged with preventing misconduct can do so when it conflicts with the operating expectations placed on them. A compliance policy cannot answer that. Staffing plans, incentive structures, escalation procedures and the treatment of employees who raise concerns come closer.

Knowing the Risk Without Being Able to Show Control

Australia’s case against Fortnum Private Wealth involved a different industry and a more clearly established set of failures. On October 14, the Australian Securities and Investments Commission (ASIC) announced that the Supreme Court of New South Wales had ordered Fortnum to pay about $941,000 (AUD $1.35 million) for failures in managing cybersecurity risk.

Fortnum admitted that between April 20, 2021, and May 11, 2023, it had failed to:

• implement an adequate cybersecurity policy;
• put adequate processes and systems in place to oversee and monitor the cyber resilience of its authorized representatives;
• maintain adequate human resources with specialist cybersecurity expertise; and
• maintain adequate cybersecurity risk management systems.

The scale of the business made those failures consequential. Fortnum’s network comprised between 81 and 94 financial advice practices, more than 200 authorized advisers and about 55,000 retail clients. The practices held sensitive information, including identification documents, tax file numbers and financial account details.

ASIC Chair Sarah Court said Fortnum was aware of the cybersecurity risks facing its business and its authorized representatives but failed to establish adequate arrangements to manage them. The parties agreed that the failures exposed representatives and clients to the risk of cyberattacks and cybercrime, with potentially serious consequences. The admissions concerned that exposure. They did not establish that all 55,000 clients had suffered a breach or a loss.

The distinction matters because the regulator did not need a catastrophic incident to bring the case. ASIC did begin its proceedings in July 2025 after Fortnum notified it of a cyberattack on one of its authorized representatives, but the admitted contraventions were about the adequacy of risk management, not the attack itself.

As a licensee, Fortnum was responsible for its whole network. In a distributed advice business, the information needed to assess cybersecurity can sit with individual advisers, local technology providers or outside vendors. Effective oversight needs reliable reporting from those places, the ability to challenge inadequate arrangements, and a clear picture of which deficiencies remain open and who is responsible for fixing them. Fortnum admitted failures in each of those areas. The admission about specialist resources is the most telling, because it points to a gap between the responsibilities the company carried and the capability it had to meet them.

Justice Black took into account that the contraventions were not deliberate and that Fortnum had cooperated with ASIC. The court also ordered Fortnum to pay about $174,000 (AUD $250,000) toward ASIC’s costs. According to ASIC, Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist expertise.

The case is a warning for organizations that operate through subsidiaries, franchises, authorized representatives or other distributed structures. Delegating an activity does not shed the responsibility to supervise it. A network may have extensive policies and contractual requirements. The harder question is whether the supervising entity has dependable evidence that they are being met and the ability to intervene when they are not.

Controls That Exist Only on Paper

A second Australian case makes a direct comparison. In February, the Federal Court ordered FIIG Securities to pay about $1.75 million (AUD$2.5 million) for cybersecurity failures that lasted more than four years, from March 2019 to June 2023. It also ordered $350,000 (AUD $500,000) toward ASIC’s costs and a compliance program overseen by an independent expert. ASIC described it as the first time the Federal Court had imposed civil penalties for cybersecurity failures under the general financial services licence obligations. The earlier RI Advice decision, in 2022, was a finding of breach rather than a penalty.

Unlike Fortnum, FIIG’s case rested on a successful attack. In 2023, attackers stole about 385 gigabytes of confidential data from the fixed-income specialist. Client information, including passport details, driver’s licences, bank account details and tax file numbers, was leaked onto the dark web. FIIG notified about 18,000 clients that their information might have been compromised.

ASIC identified deficiencies in multifactor authentication, privileged account security, firewall configuration, vulnerability testing, software updates, threat monitoring, staff training and incident response planning. FIIG also failed to commit sufficient financial and technical resources to cybersecurity.

Most significantly, FIIG admitted that complying with its own policies and procedures could have supported earlier detection of the attack and prevented some or all of the client information from being downloaded. Some of the missing measures were already part of its documented expectations. Commentary on the case has described the allegation as a failure to implement the controls identified in its own risk management system.

That raises a question conventional compliance reporting struggles to answer: how does management know a documented control is operating? An approved policy, an assigned control owner or a completed annual review provides limited assurance. FIIG’s admissions suggest it lacked adequate implementation and monitoring of safeguards that could have changed the outcome.

The two cases reached different outcomes but turned on the same management responsibilities. Both companies needed adequate specialist expertise, sufficient resources and working oversight arrangements, and both admitted deficiencies in those areas. Taken together, they show that Australian licensees can face significant penalties for inadequate cybersecurity governance before an attack happens, and that after one, the adequacy of previously documented safeguards becomes central to the record.

For boards and senior executives, a control’s existence and its demonstrated effectiveness are different things. A cybersecurity dashboard can report that policies are approved and assessments complete while saying nothing about whether critical systems are monitored, vulnerabilities are fixed promptly or staff can respond when an incident begins. The evidence management needs is operational: whether safeguards work, where exceptions remain and how quickly known deficiencies are closed.

The Warning That Never Reached a Decision

Bosch shows a different weakness: an organization’s ability to interpret a complicated legal obligation and recognize that it applied to existing business. From September 2020 to September 2024, two Bosch subsidiaries, Bosch Sensortec GmbH and ETAS GmbH, re-exported more than $70 million in foreign-produced sensor products and software to Huawei and its affiliates without the required authorization. The products were subject to the Entity List Foreign Direct Product Rule, which can extend U.S. export controls to certain foreign-made items produced with specified U.S. technology or equipment.

According to the Justice Department’s declination letter, Bosch’s trade compliance personnel were ill-equipped to provide accurate guidance on the rule, which led to the violations. The investigation also found sales continuing despite several missed opportunities, when third-party companies had identified how the rule might apply to their own products or to equipment used in providing their services. Bosch made about $11.43 million in pre-tax profit from the sales.

The findings point to two related weaknesses. The company lacked the expertise to interpret the legal requirements correctly, and information that might have prompted scrutiny did not lead to intervention. Another general compliance policy could not have fixed either.

The rule requires detailed knowledge of products, manufacturing technology, supply chains, customers and export restrictions. Deciding whether a transaction is permitted may depend on information held by engineers, sales staff, lawyers and trade compliance specialists. A compliance function that cannot obtain or interpret that information may be unable to reach a reliable conclusion, wherever it sits on the organization chart.

The declination records the scale of remediation that prosecutors weighed. Bosch added 66 employees to its trade compliance organization, expanded its U.S. trade compliance resources, made organizational changes and updated its policies to explain U.S. export-control jurisdiction and licensing requirements more clearly. Bosch voluntarily disclosed the matter while its internal investigation was still under way and cooperated with investigators. It agreed to disgorge $11,430,098 in profits, with $7,829,069 of its payment to the Commerce Department credited against that amount. Commerce imposed a civil penalty of about $36.18 million. The Justice Department also cited the adequacy of that civil penalty as a factor in declining to prosecute. The first declination issued by the National Security Division under the department’s revised corporate enforcement policy, it does not protect individuals from prosecution.

The outcome is not a finding that Bosch’s original compliance arrangements were adequate. The declination followed the discovery and correction of serious deficiencies, and it shows how much a company’s response can shape the resolution.

The comparison with CVS has limits, given the different legal regimes. Both involved conduct over several years, and both raised the question of whether compliance obligations were adequately supported inside the business. Bosch’s record, however, documents voluntary disclosure and substantial organizational change that the government credited. A company that finds a violation must decide how to investigate, whether to disclose, how to preserve evidence, who to hold accountable and what to fix. Those decisions can determine whether regulators see the organization as able to correct its own failures.

Bosch also suggests that specialist compliance resources should be judged against the actual complexity of the business. Headcount alone does not establish competence, but a team without the necessary technical and legal expertise cannot reliably oversee highly specialized transactions.

What the Records Show

The cases involve different industries, laws and kinds of misconduct. Their similarities become clearer when each failure is matched to the responsibility a control was meant to fulfill.

At CVS, the allegations center partly on operating decisions. Staffing levels, performance expectations and limits on information sharing allegedly made it hard for pharmacists to meet their professional obligations. The case asks whether commercial management can undermine safeguards that employees are formally required to observe. CVS disputes the allegations, and the settlement did not establish liability.

Fortnum’s failures were about oversight. It ran an extensive adviser network but admitted that its policies, monitoring arrangements and specialist resources were inadequate. FIIG’s were about implementation: it had documented requirements but did not apply important safeguards consistently. Bosch’s exposed weak specialist expertise and escalation. Staff lacked the knowledge to interpret complex restrictions, and chances to recognize the legal implications of certain transactions were missed.

These failures were not identical, and the evidence does not support treating them as one. Each, however, involved a gap between an obligation the organization was expected to meet and its demonstrated ability to meet it.

The point is clearest in internal reporting. At Fortnum, awareness of cyber risk did not produce adequate oversight. At FIIG, documented safeguards were not effectively implemented. At Bosch, information that might have prompted scrutiny did not produce timely intervention. The CVS allegations raise the related question of whether employees could raise concerns and exercise independent judgment under the company’s operating arrangements.

Documentation alone gives limited assurance. A policy sets an expectation but does not show that employees follow it or that management acts on exceptions. What matters more is what happened after a warning surfaced, who was responsible for responding and whether the response addressed the underlying problem.

For boards, compliance officers and internal auditors, the recurring concern is the distance between the control environment described in corporate reporting and the one operating inside the business.

Where Responsibility Sits

The cases challenge a common assumption: that compliance failures belong to the compliance function. In each, the cause or the fix sat elsewhere.

• At CVS, the government alleged that corporate decisions on staffing and incentives contributed to unlawful dispensing. Those are decisions for operational and commercial management.
• At Fortnum, oversight gaps extended across a network of authorized representatives, and the licensee remained responsible for the risk management arrangements.
• At FIIG, the deficiencies included insufficient resources as well as unimplemented protective measures.
• At Bosch, correcting the misreading of export restrictions required changes to staffing, organizational structure and internal guidance.

No compliance function could have resolved all of these alone. Operational managers controlled the conditions employees worked in. Senior executives decided how resources were allocated. Business units held the information needed to evaluate transactions. Technology staff maintained the systems the organization’s security depended on. Failures emerge when each of those responsibilities is treated as someone else’s problem.

An organization can make a person responsible for monitoring a risk without giving them authority over the activity that generates it. Management can receive assurance that a policy exists without evidence that it is implemented. An unresolved exception can pass between teams because no executive has accepted the final decision. The cases do not show that all of this happened in every organization examined. They do show why regulators look at resources, reporting lines, operating practices and management decisions as well as the formal compliance framework.

Directors are not expected to review every prescription, export transaction or security alert. Their job is to set up appropriate oversight and demand reliable information about material risks. What that information looks like depends on the business:

• For a pharmacy chain: suspicious prescribing patterns, unresolved dispensing warnings, staffing pressures and how well pharmacist escalation works.
• For a financial services network: cybersecurity assessments across authorized representatives, overdue remediation, independent test results and deficiencies needing central intervention.
• For a multinational manufacturer: export-control classifications, restricted-party screening exceptions, unresolved legal interpretations and transactions suspended pending review.

Asking whether the organization has a compliance program does not give a board effective assurance. Directors need to know which decisions the program is meant to influence and whether management can show those decisions are being made properly.

Discovery and Correction

Bosch’s declination offers a counterpoint to the penalties elsewhere in the sample. Its violations ran for years and generated substantial profit, yet the Justice Department declined to prosecute, crediting voluntary disclosure, cooperation and remediation. That shows the value of finding and correcting misconduct early. It does not mean every company that discloses will be treated the same way. The decision turned on the applicable enforcement policy and the facts of the case.

The remediation the declination describes is concrete: more specialist staff, revised procedures and organizational changes. In the Australian cases, courts imposed penalties after admitted failures, and FIIG must undertake a compliance program with independent expert involvement.

Corrective action and real improvement are not the same. A policy revision can clarify requirements but does nothing for a shortage of qualified staff. Training can raise awareness but cannot replace an escalation procedure that lets employees stop questionable activity. A new reporting dashboard can improve visibility but will not fix a problem senior management keeps declining to address. The right remedy depends on the failure:

• Where staff lack expertise, build technical capability.
• Where business incentives undermine compliance, examine the incentives.
• Where risk sits across a distributed network, give the accountable entity reliable monitoring and the power to intervene.
• Where warnings are missed, find out why information did not lead to action.

Regulators appear to weigh whether corrective measures address causes. Internal audit teams should apply the same test to management’s remediation plans.

What Boards and Compliance Leaders Should Take From the 2026 Cases

The most useful lesson concerns the evidence organizations should expect from their control systems. These four cases do not establish a pattern across all 2026 enforcement. They arise under different legal regimes, the conduct occurred over different periods, and the outcomes reflect circumstances that no single measure of compliance maturity captures.

Within those limits, the similarities are substantial. Companies ran into trouble when legal obligations depended on capabilities they had not provided, when their responsibilities extended beyond the reach of effective supervision, or when information that could have prompted action did not.

In practice, a board reviewing compliance effectiveness should be able to name the organization’s most consequential legal and operational obligations, identify which business decisions could undermine them and examine evidence that the controls operate. Senior management should be able to explain how a material concern moves from identification to investigation, decision and resolution, and who owns an issue that remains open.

Internal audit should be ready to challenge assurance that rests mainly on policy documents, management attestations or completed reviews. Testing should establish whether controls do their job, especially where failure could cause serious legal, financial or customer harm.

Compliance leaders should ask whether their teams have the expertise and authority the business requires. General awareness training cannot manage a technically demanding legal obligation. Nor can an employee be held meaningfully responsible for a control when the decisions needed to operate it belong to someone else.

None of this is new, and its persistence in enforcement proceedings is part of what makes the cases troubling. Organizations have spent years formalizing risk assessments, policies, control inventories and management reporting. Those tools help when they improve decisions and make failures visible. They lose value when completing them is treated as proof the underlying risks are controlled.

The cases also show why enforcement analysis should look beyond the size of the penalty. CVS’s $315 million settlement dwarfs the other outcomes, but Fortnum matters because ASIC pursued inadequate cybersecurity governance without a realized loss to point to. FIIG shows how control deficiencies played out in an actual attack. Bosch shows how weak expertise and escalation can produce years of violations, and how disclosure and remediation can change the enforcement result.

One exercise can show an organization its own exposure: reconstruct the path of a material warning. Identify when it first appeared, who received it, what information was available, which decisions followed and how the outcome was verified. That can expose weaknesses a review of policies and procedures would miss. The question for boards is whether the organization can produce that account before an investigator asks for it.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey