Over the past decade, compliance has blossomed into a thriving industry, and the compliance department has emerged, in many firms, as the co-equal of the legal department. Compliance is commonly headed by a Chief Compliance Officer (CCO) with a staff, in large firms, of hundreds or thousands. Moreover, although the CCO reports to the board, compliance is not wholly subordinate to the board. Boards cannot neglect the compliance function or choose not to install and maintain the function on par with industry peers. Furthermore, once compliance officers generate information through monitoring and surveillance, it is beyond a reasonable board’s authority to stop them. Compliance is thus under the board, but its authority comes from somewhere else.