From the outside, compliance is often seen as laws, policies, prohibitions, and mandates—what has to be done or mustn’t be done. But every rule, policy, procedure, and decision has a human impact.
Compliance lapses, or even just miscalculations, can lead to damaged reputations, lost opportunities, and financial downturns that erase pensions or eliminate jobs. In the most tragic cases, poor planning, incomplete or incoherent protocols, and ineffective communications—all issues that compliance efforts address—cause harm on an entirely different scale.
Compliance expert Tom Fox, who lives in the Texas Hill Country, experienced the catastrophic Guadalupe River flood on July 4, 2025, as a local, personal tragedy. His latest book, “Deluge Before Dawn: Heartbreak, Survival and Resilience After the Guadalupe River Raged,” recounts both the events of that horrific night and the community’s effort to remember, restore, and rebuild. Fox draws from his professional expertise to find actionable lessons that could prevent future heartbreak in the Hill Country and beyond.
Lesson 1: The best time to make decisions and develop plans is before an urgent situation unfolds. Systems, processes, and protocols ensure better decision-making, coordination, and resource allocation, and their absence can be catastrophic.
The Guadalupe River rose with remarkable speed, and the system in place wasn’t up to the moment. Needed data wasn’t available, and information came in incoherent fragments. Individuals tasked with crisis oversight weren’t available, and no one had been properly deputized to take decisive action and prioritize in the wake of competing, life-threatening crises. The full picture didn’t become clear until numerous harm-reduction strategies were already out of reach.
All organizations will face challenging times. As Fox notes, “Systems that function under stress are almost never invented during the crisis. They are activated.” Compliance officers can minimize harm and create opportunity by taking a systems approach that ensures essential data is gathered, decision-makers are identified and prepared, and systems are in place to provide essential support.
Lesson 2: Risk planning must consider both historical trends and evolving conditions. Establish bright lines, and hold them.
After the tragic events of July Fourth, people naturally questioned what went so wrong; how could so many little ones have been placed in harm’s way? And the truth was damning: “The answers led back to decisions made years earlier.” Camp Mystic had been in operation for almost a century, weathering countless storms along the way. When FEMA maps indicated that cabins were in a potential flood area, the directors, drawing on their historical knowledge, felt comfortable making the business decision to contest the maps. They appealed, and it was approved. Because someone allowed the lines to be redrawn, Camp Mystic continued to operate, and even built new structures. Although fully compliant, they were a disaster waiting to happen.
All leaders have a duty of care, but compliance officers, in particular, have an obligation to evaluate decisions vis-à-vis both potential legal ramifications and the organization’s values. Identify and speak up for the potential human impact of business decisions.
Lesson 3: Crises don’t come at convenient times, and they often arrive together.
There were many factors that made the Independence Day Flood particularly devastating. It happened in the middle of the night, so many people were sleeping as their window of opportunity for escape closed, forcing others to navigate in darkness. It was a holiday, so local leaders were away, and there were visitors in town who were less aware of the dangers inherent to the region. The storm eroded cell service, which was already spotty in the region. Evacuation routes became impassable as floodwater overtook them. These were not isolated crises: One set of problems (like lost time) birthed another (unusable escape routes), and a single root cause (catastrophic rainfall) created a raging wall of water that wreaked havoc while knocking out the cell system that could have warned those in its path.
“Risk compounds through interactions; planning must treat it as a connected system,” Fox concludes. When preparing for crisis, assume multisystem failure rather than unique challenges that can be addressed independently. Imagine and plan for the worst of circumstances happening simultaneously.
Lesson 4: Trust must be earned before it is needed.
In Kerr County, trust in both individuals and organizations has been foundational to post-flood rebuilding. Grounded in decades of the “unglamorous work [of] grant reviews, board governance, donor stewardship, and relationship-building,” the local Community Foundation’s “accumulated credibility became infrastructure.” Strong processes and good governance systems enabled the local Community Foundation to stand up a dedicated fund within hours; inspire potential donors to become benefactors; and leverage existing partnerships to deliver funds to the groups that would do the most good, as quickly as possible.
Trust comes from openness and consistency, from countless decisions (large and small) to share hard truths, to admit and correct mistakes, to live up to promises made. Recognize and lean into good governance and transparency as the operational vehicles of trust-building in organizations.
Lesson 5: Crisis and tragedy can—and should—seed meaningful change.
The aftermath of a tragedy, or any kind of crisis, presents an opportunity and a mandate to tell the stories, find the root causes, and do better moving forward. It can seem impossible to work through grief, continue to move, yet keep fresh and urgent the painful truth, so that the long work of thoughtful recovery and more intentional rebuilding, even if it is costly and challenging, takes place.
Although the July 4th Flood felt unprecedented in its speed and destruction, there were warning signs the year before. A catastrophic storm in 1987 led to the deaths of ten children. Unfortunately, the will to make change didn’t endure, and that tragedy became more remote, as both a lived experience and a harbinger. “Forgetting invites tragedy anew,” Fox warns, “Yet memory alone is not enough. It must be joined to action, to preparedness, to stewardship, and to the kind of civic resolve that turns suffering into a determination to protect those who come after us.”
Organizations in crisis, whether from a public scandal or a significant fine, have—and should use—the opportunity to reflect, analyze, and spur meaningful change.
Perhaps the greatest and most critical lesson we can learn from the Hill Country Flood of 2025 is this: We honor those lost when we have the courage to learn and the will to change things for the better. Fox and his community remind us that, “To remember the dead is to refuse to let them be reduced to numbers. To remember acts of courage is to preserve examples of grace under pressure. To remember failures, gaps, and hard lessons is to offer the living a chance to do better. And to remember together is to resist the erosion that time can bring.”
