If you're taking life altering advice from a probabilistic language algorithm, you're pretty well doomed to begin with.

What's worse is that its been deliberately lobotomized on a slew of topics, so at best it's repeating the received knowledge of whatever passes for the mainstream. Which is fickle and frequently inaccurate.

>There are equivalents of SOX compliance across many countries and that everyone in a compliance team would be totally cool signing off on illegal activity is a little strange to assume.

Every USA-based company which does business internationally and "complies" with the FCPA laughs as your optimism. Bribing people in third world to do their job (or to "protect" your business from "accidents") is both illegal and ubiquitous. It's the sort of thing you'd see categorized as "consulting expenses, "travel and entertainment expense", or "risk mitigation expense".

For ransomeware, they'd probably just label it "data recovery expense" or "penetration testing expense" if the accountant had a sense of humor.