Compliance is its own discipline
Originally posted on LinkedIn on April 21, 2026
I've been passed over for roles I was qualified for because I didn't have a JD.
Not informally nudged out. Formally excluded—roles where the credential was a listed requirement, where my MA in Applied and Professional Ethics and CCEP and fifteen years of building programs that actually worked weren't enough to get me into the applicant pool. Two letters I didn't have outweighed six that I did.
I've made peace with it. I'm not telling this story because I'm looking for a role—quite the opposite, frankly. I'm telling it because it happened to me, and I know it's happened to others, and I think it says something worth saying about how the field selects its leadership.
The assumption worth examining
There's a default in compliance hiring—especially at the leadership level—that the JD is the signal. That legal training is the proxy for the expertise the job requires.
I understand where it comes from. Compliance sits close to Legal on the org chart. It deals with regulation, risk, and occasionally things that end up in front of a judge. The instinct to want a lawyer in the room makes a certain kind of sense.
But instinct and evidence aren't the same thing. And the evidence—in the form of what compliance work actually requires—points somewhere different. Nobody requires internal audit leadership or enterprise risk management to hold a JD. The risk profile of those functions isn't meaningfully different.
What the job actually requires
Legal training and compliance expertise overlap in places. But the core skills of compliance work—behavioral design, cross-functional communication, understanding why people don't follow rules even when they know them—aren't law school outputs. They're a distinct discipline, built through different experiences.
Compliance done well draws on behavioral science, operational design, and the ability to translate between functions that don't naturally speak the same language. The practitioner who's good at it has developed a specific set of muscles—pattern recognition, systems thinking, the ability to meet people where they are and design environments where doing the right thing is also the path of least resistance.
Those aren't incidental skills. They're the whole job.
A legal orientation asks: does this hold up? A compliance orientation asks: will this work? Both questions matter. But only one of them changes behavior. And changing behavior is what compliance is actually for.
On regulations and knowing when to call Legal
Here's the pushback I anticipate: compliance requires reading and interpreting regulations. Doesn't that require a lawyer?
Sometimes. And good compliance professionals know exactly where that line is.
Reading a regulation and understanding what it means for how your business operates is a compliance skill. Knowing when the interpretation has gotten complex enough that you need legal review? That's also a compliance skill. The judgment about when to call Legal, and what question to hand them, is part of the job.
Legal training does contribute something real here (think: careful regulatory reading, precise language, understanding how rules are constructed). Those are valuable skills in compliance work. They're also skills that experienced compliance professionals develop. Law school is one path to them. It's not the only one.
What isn't part of the job is requiring every employee to navigate that complexity themselves. The compliance function exists precisely so they don't have to. Nobody should need to go to law school to understand which printer their company is allowed to purchase under the FAR. They should be able to do their job, follow clear guidance, and trust that someone has already done the translation work between the regulatory requirement and their daily reality.
That translation work—taking what the regulation actually says and making it operable for the people it applies to—is one of the most undervalued skills in compliance. It's not a legal skill. It's a communication skill, an operational skill, and a design skill. It requires understanding both the rule and the human who has to follow it.
Most compliance professionals do this every day. They just don't always get credit for it.
Some organizations route compliance work through Legal specifically to obtain attorney-client privilege protection—risk assessments, investigation reports, internal audits. The assumption is that this work is inherently legal work. It isn't. Attorney-client privilege has its place, but it isn't a requirement for effective compliance. And the reflex to use it can actually work against the function—making compliance less transparent internally, harder to operationalize, and more defensive in orientation than it needs to be.
What I'm not saying
I want to be precise here, because this argument is easy to misread.
I'm not saying lawyers can't do this job. They can, and many do it exceptionally well. Legal training doesn't disqualify anyone from being an effective compliance leader—and the ones who are effective have usually built the operational and behavioral muscles the job requires, whether or not law school gave them those directly.
What I'm saying is that the JD requirement narrows the pool in exactly the wrong direction. When you filter for a legal credential, you filter out—by default—the people who came up through operations, behavioral science, organizational design, ethics, or communications. The people who think like the employees they're trying to reach, not like the regulators they're trying to satisfy.
You end up with a function that looks like what you hired for. Make it look like Legal, and it will think like Legal. That's not a criticism of Legal. It's just not the same job.
A word on insecurity
I've been told that saying "...but I'm not a lawyer" signals insecurity. There's probably some truth in that.
But I'd offer a different frame: when an entire field has been structured around a credential that doesn't map to the job, the people who don't hold it have been given a reasonable amount of evidence that the room wasn't built for them. That's not insecurity. That's pattern recognition.
The more useful question isn't whether non-lawyers in compliance feel confident enough. It's whether the organizations doing the hiring are asking the right questions about what they actually need.
What this means if you're building
If you're a founder or operator putting compliance infrastructure in place for the first time, how you think about who should own it matters.
The question isn't whether your candidate has a JD. It's whether they think like an operator. Whether they can translate between your legal team, your HR function, your frontline managers, and your leadership. Whether they're asking "will this work" at least as often as "does this hold up."
Those are the skills that determine whether your program changes behavior or sits in a shared drive.
If you're a compliance professional who came up without a JD—who built your expertise through experience, through certification, through doing the actual work—this is your reminder that the credential was never the point. The discipline is the point. And you're in it.
…
The field is narrowing its own talent pool. It doesn't have to.
⛰️⛰️⛰️
