#compliance

We have decided to bring HR, Legal, Compliance and Corporate Affairs together under Keeley Aleman in an expanded role as Waters General Counsel and Head of Global Human Resources.

We are grateful for Cheryl Kennedy’s leadership and contributions over the past year, as she helped support our people and advance our HR strategy during an important period for the company. Cheryl has left Waters and we wish her the very best.

Who in their right mind would “bring HR, Legal, Compliance and Corporate Affairs together?”

Went in office for only a couple hours connecting with the IP address and HR counts as a compliance on Workday.

It is an open secret that many employees across major hubs—including Hopkins—are navigating the RTO mandate by doing the bare minimum, coming in person for few hours/two days a week, leaving laptops on Monday locked with Kensington T-Bar laptop Lock ($15) at or under a desks overnight to simulate presence, and take them off on Thursday or Friday. They all got 100% RTO compliance for last 4-5 months given RTO enforcement uses IP address tracking which is also our OFFICIAL "Talent" and "Performance" Metric for year 2026 (no other company or bank has this metric).

It’s an open secret that most employees hit 60-100% compliance while they were actually working from home, just by using U.S.bank Teams (attend meetings from home) and Outlook (compose reply emails) all from mobile phones at home or elsewhere (Hawaii vacation). I myself tried last month at Knoxville and yes it worked, but made sure to just get 60% RTO compliance so I do not get caught, but surprised to see many doing it without any fear.

Question: Why did Gunjan approved this ineffective 60% RTO compliance by our D-MB SEVP-HR with IP tracking as performance metric? What were she thinking? Is Gunja equally D-MB - like the CXO suite mocks her?

US House of Representatives
SELECT COMMITTEE ON THE CHINESE COMMUNIST PARTY
548 Cannon House Office Building Washington, D.C. 20515
(202) 225-6002

May 2, 2023

Mr. John Donahoe
President, and Chief Executive Officer Nike, Inc.
One Bowerman Drive Beaverton, OR 97005

Dear Mr. Donahoe,

On March 23, 2023, the House Select Committee on the Strategic Competition between the United States and the Chinese Communist Party (CCP) held a hearing entitled, "The Chinese Communist Party's Ongoing Uyghur Genocide." At the hearing, we heard first-hand witness accounts about the CCP's concentration camps and expert testimony regarding the perpetration of genocide. We also received written testimony in which an expert assessed that "American companies are financing the state-sponsored forced labor programs in the Uyghur Region."1 We seek additional information regarding this matter.

The U.S. Department of State has determined that the CCP is committing genocide against Uyghurs and other minority groups in Xinjiang. 2 In response to the CCP's atrocities, Congress passed the Uyghur Forced Labor Prevention Act (UFLPA) with bipartisan support. On December 23, 2021, the UFLPA was signed into law. The UFLPA prohibits the "importation of any goods made with forced labor, including those goods mined, produced, or manufactured wholly or in part in the Xinjiang Uyghur Autonomous Region."

1. We received expert testimony which revealed that products made by Uyghurs in forced labor camps are still entering the United States. 4 One expert told the Select Committee that Nike is "sourcing garments made not only from cotton from the Uyghur Region but also viscose, lyocell, polyester, leather, and linen from the region."5 Continuing to import goods produced in part with

1 The Chinese Communist Party's Ongoing Uyghur Genocide: Hearing before the Select Comm. on Strategic Competition between the U.S. and CCP, 118 Cong. (Mar. 23, 2023) (Written Testimony ofNury Turkel) ("CCP's Uyghur Genocide Hearing").
2 Edward Wong & Chris Buckley, U.S. Says China's Repression of Uighurs Is 'Genocide', N.Y. TIMES (July 27,
2021).
3 Uyghur Forced Labor Prevention Act, H.R. 6256, I 16th Cong. (2021).
4 CCP's Uyghur Genocide Hearing (Written Testimony ofNury Turkel).
5 Id; According to a Sheffield Hallam University study, Nike is at high risk of having Xinjiang cotton in its supply chain due to its relationship with international intermediary manufacturers and Chinese textile companies sourcing

the forced labor of Uyghurs potentially violates the UFLPA and creates the conditions in which the CCP is able to continue committing genocide.
We would like to offer Nike an opportunity to respond to these serious allegations and to provide information regarding its compliance with the UFLPA. We therefore request that you respond to the following questions by May 16, 2023:

1. Do any garments imported into the United States by Nike contain inputs sourced from Xinjiang and/or inputs made with forced labor ofUyghurs?
2. Please provide a detailed description of the steps Nike has taken since the UFLPA took effect to examine its supply chains with respect to forced labor risk in the manufacture of its products. How do these steps differ, if at all, from the methods utilized before the UFLPA took effect?
3. Please provide a detailed description of the steps Nike has taken since the UFLPA took effect to ensure garments it sells that are made from cotton, viscose, lyocell, polyester, leather, and linen are not manufactured using forced labor by Uyghurs or other minority groups who are subjugated by the CCP.
4. Please provide a detailed description of the steps Nike has taken to examine its other supply chains to ensure that other products it sells are not produced by forced labor undertaken by Uyghurs or other minority groups who are subjugated by the CCP.
5. Do any of Nike's garment suppliers use fabric and/or yarn from any of the following corporations (including their subsidiaries): Jiangsu Lianfa Group, Luthai Textile, Huafu Fashion, Texhong Textile, or Weiqiao Textile?
6. Is fabric and/or yarn made by any of the corporations referenced above used in the production of Nike clothing sold in the United States? If so, please list each corporation whose fabric and/or yarn is used in the manufacture of Nike clothing sold in the United States.
7. If fabric and/or yarn from one of the corporations referenced above is used in the production of Nike clothing sold in the United States, what specific steps does Nike take to ensure that none of this material is made in, or contains cotton from, Xinjiang?
8. Has Nike contractually obligated all its garment suppliers to ensure that no inputs from Xinjiang are used in the manufacture of its clothes sold in the United States? Please provide all relevant documents to support such obligations.

cotton and employing state-sponsored labor transfers from the Uyghur Region. Most of the Chinese textile companies identified in the study have subsidiaries in Xinjiang that have employed state-sponsored labor transfers. See, Laura T. Murphy et al., Laundering Cotton: How Xinjiang Cotton Is Obscured in International Supply Chains, SHEFFIELD HALLAM UNIVERSITY (Nov. 2021).

1. What specific methods, other than mere written or verbal assurance from a garment supplier, does Nike use to verify that the supplier is not using inputs from Xinjiang?

I 0. What audit methods does Nike use to verify that suppliers in China-in and outside of Xinjiang-are not exploiting Uyghurs through state-sponsored labor transfers, given that workers in China cannot speak to auditors about forced labor without fear of government retaliation? Please provide all policies, guidelines, requirements, reviews, assessments, analyses, audits, PowerPoint or other presentations, or other documents that describe, govern, implement, or report conduct, processes, or results (without regard to the title of a given document) that are relevant to the conduct of such audits, as well as copies of any communications pertaining to any incident involving actual, alleged, or anticipated noncompliance with the UFLPA.

1. Has Nike conclusively identified every supplier of fabric, cotton, and yarn in its global supply chain for products sold in the United States? If yes, please provide documents and evidence to substantiate Nike's conclusive identification of such fabric, cotton, and yarn suppliers, including any documents evidencing Nike's methodology with respect to this determination. If not, please provide a detailed explanation of how Nike assesses whether its clothing imports comply with the UFLPA, including any documents describing Nike's methodology with respect to such assessments.

2. Does Nike allow cotton and/or other inputs produced in Xinjiang to be used in the manufacture of Nike clothing sold in markets outside of North America?

3. In 2020, reporting revealed that hundreds of Uyghur laborers worked in a factory that manufactures 8 million pairs ofNikes each year.6 Nike claims to have verified that this factory-owned by a leading Nike Supplier, TKG Taekwang-no longer uses Uyghur forced labor. Given its track record of using forced labor, how did Nike verify that TKG Taekwang no longer uses forced labor? And why does Nike still consider TKG Taekwang to be a suitable business partner?

4. Please provide a detailed description of the steps Nike is taking to examine and monitor its supply chains on an ongoing basis. Please provide all policies, guidelines, requirements, reviews, assessments, analyses, audits, PowerPoint or other presentations, or other documents (without regard to the title of a given document) that describe, govern, implement, or report conduct, processes, or results relevant to the conduct of such examination and monitoring.

5. Please provide a detailed description of your audit and compliance plan(s), and the steps taken thus far to implement controls to ensure that Nike products are not produced by forced labor and that all Nike products are obtained and sold in compliance with the requirements of the UFLPA. Please provide all policies, guidelines, requirements, reviews, assessments, analyses, audits, PowerPoint or other presentations, or other documents (without regard to the title of a given document) that describe, govern,

6 Anna Fifield, China compels Uighurs to work in shoefacto,y that supplies Nike, WASH. POST (Feb. 29, 2020).

implement, or report conduct, processes, or results relevant to Nike's audit and compliance plan(s).

The House Select Committee on the Strategic Competition between the United States and the Chinese Communist Party has broad authority to "investigate and submit policy recommendations on the status of the Chinese Communist Party's economic, technological, and security progress and its competition with the United States" under H. Res. 11. Upon your receipt of this letter, please maintain and preserve all hard copy and electronic documents, including electronic communications, related to the subject matter of these questions.

To make arrangements to deliver a response, please contact Select Committee majority and minority staff at (202) 226-9678 and (202) 225-2489, respectively.

Thank you for your attention to this important matter and prompt reply.

Sincerely,

-
Mike Gallagher
Chairman

Ranking Member

How strict is VG on the background check for licensed client facing roles?

• Clean U4
• Clean credit 820+ score
• Don’t drink/do dr-gs
• No felonies
• 2 misdemeanors that were dismissed. One was for stopping payment on a check b/c merchant delivered broken goods. Went to court judge ordered me to pay the amount of the check to the merchant, and the merchant had to deliver working goods. After that was done, judge dismissed.

Other misdemeanor was an as--ult charge. Where I live Sheriff can file without grand jury and did. Judge ruled no probable cause at initial hearing and threw it out with prejudice after admonishing the Sheriff and DA for wasting the courts time.

Fidelity, UBS, Chase had no issues, Merrill and USAA did.

USAA has a policy that all new roles are in office. Remote employees that post for new roles must move to an office location if they want a new role. It also has a policy that all roles are posted for at least 5 business days. This does not appear to apply to all people. Good ole boys get special treatment. The bank just hired a new chief compliance officer and the role was not posted. The new chief compliance officer is also remote and does not appear to have moved to an office location. What gives? Why is there special treatment for certain people while the rest of us remote employees are stuck in our roles unless we are willing to move?

They are hiding Compliance and other areas of Corporate Risk headcount numbers from regulators.

We remain unethical and shady.

Has anyone noticed that the new FAQs about time tracking don't state punishments for low compliance?

A new job has been posted, they are looking to hire someone to develop AI to take processes, procedures, analysis, etc out of the hands of current workers and into the bowels of AI. The worst part is that the job description includes making the AI in compliance with audit standards and SOX public standards. All while following the rules of controls and separation of duties? How can this be taken seriously? Trusting that data is properly handled, accounting is done up to high standards, and that our financial statements are accurate in the hands of newly developed AI? More layoffs coming to FP&A if this job gets filled? Whoever takes this job will be a yes-man and completely wreck our financial accuracy.

The company doesn’t believe or care about Work Life Balance anymore. To the company it’s all about compliance reports.

Great article regarding the 7 years of CMS non compliance - all under Gail, Fiona and Gloria’s watch. Be clear this is not a difference of opinion on what it takes to be CMS compliant, I believe there were decisions made that it was easier to just fake it and see what they could get away; it was cheaper to risk non compliance than to spend the money to get the data in order. Why won’t they let Pete testify? Doesn’t sound transparent or ethical and it is not good leadership. The Board members who weren’t part of the FA stage need to hold those that were accountable and make some changes cause they are about to enter the FO stage.

https://www.healthcare-brew.com/stories/2026/05/04/elevance-estimates-935m-avoid-CMS-sanctions

Too bad they dont have CS on the board of Microsoft so we can all get the Microsoft 365 reminder to "integrate copilot into your workday to prevent yourself from falling below 3 days a week!"

RTO has become AITO

Your notices go out May 1!

Mandatory voluntary compliance for AI user metrics...Now someone tell me AI is not a bubble

Block laid off 984 California employees in its recent job cuts. This represents about one-fourth of its total global workforce reduction. The company attributed these layoffs to its adoption of artificial intelligence tools. Block initially faced noncompliance issues with state WARN Act filings. The company is now largely compliant with the California EDD.

Oakland, California

https://www.sfexaminer.com/news/technology/california-takes-big-hit-in-blocks-massive-layoffs/article_3bb72b47-4305-49de-bb80-9dae9f52c7c3.html

Just please lets all look out for each other, and do what we are told. It's awful but working in an office beats getting fired for non-compliance and then not having one to work in at all...

After all, it's what we all make of it.

It appears that the majority of the doctors were fired and now we can't meet client commitments - or even basic compliance requirements in many cases. Does anyone know what the plan is for EviCore?

How is this model sustainable? We're going to lose major clients if this keeps going on.

22 days x .60 =13.2.

To hit 60 percent, we have to hit at least 14 days or get written up for non compliance????

For months conversations have swirled around a changing risk environment @PNC and today, unfortunately several folks in Risk, Compliance and i believe the change office were displaced after an organizational realignment. This comes on the heals of FirstBank and the BAM's. Sadly, it seems like this is just the beginning, not just with PNC, but banking in general. The financial landscape is drastically changing...it feels like 2008 all over again.

In Compliance and we had some layoffs. We were told there were more coming. Any other groups get hit today?

On April 15, 2026, every file-based Citrix license stops working. The new License Activation Service (LAS) is a cloud-based control mechanism.
No more on-premises static license files - install and forget - but external cloud dependency, connectivity testing, failover validation, etc. In some highly regulated business, it creates an architectural problem requiring more effort.
And LAS does not work with older versions of Citrix products: some big organizations have to upgrade their entire Citrix stack, and install all kind of patchs, sometimes provoking problems of ... license expiration.

I see customers complaining about the lack of support, probably overwhelmed by requests to solve the problems created by this new LAS.
And also customers questioning the costs of this LAS migration, that is imposed to them, for more constraints and no tangible benefit. Mandatory stay on supported versions. Citrix telemetry to verify usage data. Compliance checking. And wondering if the effort to migrate to another platform would not be better.

Sometimes I think that Citrix management is doing all they can to lose customers. Customers layoffs I suppose.

How many months in a row can someone be out of compliance before an action is taken? What's the sequence of events that follows?

Is it legal to suddenly change this RTO performance policy metrics and make people noncompliant? Previously, under 11 day RTO attendance, I was at 100% compliance. However, now that they changed their metrics calculation method, I am noncompliant. By them retroactively changing my compliant reports to noncompliant reports from Nov 2025 to March 2026, wouldn’t that be considered data manipulation by the company, which is illegal? They also failed to disclose IP usage to monitor which is also illegal.

So do we think those that are now showing under 60% the last 5 months are going to be fired? Doesn't seem ethical to change it and then use it against us. I was hitting 11 days but that isn't hitting this new 60% goal.

Heard Privacy moving to Compliance. Anyone else hear anything?

It’s updated and now shows me as non compliant. They clearly changed the expectations. I’m surprised there isn’t any communication on this from the company.

Nothing says ‘competitive advantage’ like posting the Permian well logs, 1533’ core spacing, and perforation clusters. This is what winning looks like.

Thank you ST for posting that to LinkedIn

Flowers in the townhall: “We are not going to stop focusing on risk. On the contrary. We will continue to focus on risk management.”

Also Flowers: “Pick up co-pilot. Use it. Experiment. Get familiar with it. It is our future”

lol. How many people are using co-pilot to knowingly or unknowingly sp-t out nonsense right now. These banks are highly regulated. Zero controls in place for how outputs are being used. Most managers are reviewing nothing. No one has a clue hoo o w often people are using AI or where.

I’ve seen people submit so much gibberish to me over the past month. Clearly AI outputs.

Good job guys. Not only is RCSA a joke in terms of quality but now we are layering in more risk to every process without understanding the impact.

What could go wrong?

By being secretive and not spooking the shareholders on the depth of the layoffs -- 18%--is Oracle management being too cute by half?

By not filing WARN (over 50 employees at one location) or information under OWBPA (Older Workers Benefit Protection Act, which applies when employees over 40 years old are laid off) they are laying themselves wide open for a barrage of lawsuits.

  Why is it everyday we are instructed to lie about what we do? Manager and GM both tell me to Customer Exception cars in my work order reporting today and blame the customer for cars not getting spotted because we didn't have crews to pull the unit train that was blocking the industry. I question it and get told do it so they don't take "hits" on ISP numbers and that Failure to Comply is an option. So I have to lie and potentially get fired or not lie and potentially get fired. 

Look's like Gainwell has new problems. DOJ said they can be liable for a $500 million medicaid fraud that it ignored. And Treasury has set up a new medicaid fraud task force that we can report to.

And Bloomberg is still investigating I think.

https://news.bloomberglaw.com/us-law-week/medicaid-contractor-gainwell-can-be-held-liable-for-fraud-doj-says

Here is the task force info for Treasury.

The Treasury is interested in Medicaid/ Medicare fraud and they are willing to pay for your cooperation. Good luck! Do you think this is what RI has in mind? Cha Ching if you can provide proof!
https://nationaltoday.com/us/mn/bloomington-mn/news/2026/03/29/treasury-launches-whistleblower-rewards-to-crush-health-care-fraud-schemes/

Noticed they’ve separated onshore and offshore Datadog access.

Is this a response to concerns around PHI and PII exposure offshore? Or is there another operational or compliance reason driving the change?

If anyone in leadership has context on what prompted this decision, it would be great to understand the thinking behind it. Increased data controls are always worth discussing, especially would shape on/offshore future hiring pattern.

Anyone following the scandal with the company called Delve? Apparently they were smart guys who used AI and India to provide compliance for companies. You’ll never guess but the Indians just made stuff up and issued fake SOC reports, allegedly. So smart that we are moving work to India.

Veradigm filed a Form 12b-25 saying it could not file its annual report on Form 10-K for the year ended Dec. 31, 2025 by the deadline without unreasonable effort or expense. The company said prior financial statements for 2021 and certain interim periods in 2021 and 2022 should no longer be relied upon due to revenue misstatements tied to internal control failures. It also said its 2020 financial statements should no longer be relied upon because of misstatements identified during audit procedures. Veradigm said it has not filed multiple periodic reports for 2023 through 2025, including the 2024 Form 10-K and quarterly reports for 2025. The company said Nasdaq delisted its common stock after determining it remained noncompliant with filing and annual meeting requirements.

I know we have an exit survey but is there something called compliance questions?

Been at the company for 9 years and after the past few months, it opened my eyes and realized I need to get out. Over the past 3 years, my team has underwent so many reductions, this month 7 are leaving to a new department and I somehow managed to dodge all of it. Essentially the team will be cut in half next month and I’d be doing the work of two people- two different roles.

Last week I put in my resignation, I found another job with a different company. I’m nervous and excited. I’ve been so paranoid about losing my job that I’m on edge that it’ll happen with this new company. This is not healthy. Hopefully I’ll be able to get over it.

The only thing I've figured is that non-customer-facing roles will get hit hardest, especially compliance and data analysis. Anyone know more?

Curious if others have seen low RTO compliance percentages explicitly referenced in their performance reviews and whether it impacted ratings. It feels like RTO adherence should be managed separately and not evaluated alongside tangible performance output.

RSCA was a paperwork fiasco. weeks of meetings where managers were bullied into nonsensical compliance tasks that don't manage an iota of risk.

Reward: Promotion to CAO!

Well, so much for 2026 efficiency gains. Maybe AI will hallucinate the answers.

A I-9 audit is in progress. Gainwell is doing their due diligence to ensure all onshore employees are legally employable. Could be setting themselves up for a future sale.

Mandatory now in your training!! . But they can not tell who you are, but know if you have completed it and the data it returns..

I worked for Anthem, Inc. (now Elevance Health) for about 10 years. In 2020 during the pandemic, I accepted another remote job with about a 30% pay increase and put in my two weeks.

While transitioning my work, I attempted to upload some personal files (tax docs and school work) from my company laptop to Dropbox after being told I could remove personal data from the device before leaving. The system flagged it as a potential PHI upload, even though no PHI was transferred.

I met with IT Security, explained everything, and signed a disclosure stating no PHI was uploaded and that it would be treated as a first-offense warning.

The next day I was unexpectedly called into HR and terminated on the spot and told I’d be placed on a “do not rehire” list. It felt like a complete bait-and-switch after being told it would only be a warning.

I started my new job shortly after and have now been there almost 6 years, gaining more experience and completing security and PHI compliance certifications.

Now that I’m applying again (including to companies like Cigna, Optum, and Molina Healthcare), I’m wondering:
• Are “do not rehire” lists internal, or can other companies somehow see them?
• Do background checks reveal that type of HR status?
• After ~7 years, would it be worth contacting Elevance Health to ask if my rehire eligibility could be reconsidered?

Would especially appreciate insight from anyone in HR or healthcare compliance who has seen how this works behind the scenes.

HouseCalls leadership is setting the program up to fail. At a time when MA risk-adjustment coding is under the highest scrutiny it’s ever been and risk scores are still one of the main revenue drivers, they keep adding more internal metrics and efficiency targets that make accurate documentation harder, not easier. There’s a clear inverse relationship between coding to the level of specificity now required and pushing APC, completion %, and daily volume. You simply can’t maximize quality, compliance, and productivity all at the same time. Something will give. Right now it feels like leadership wants all three, which isn’t realistic in the current regulatory environment. This is exactly how programs end up with compliance problems.