This essay reviews the contributions to deterrence theory that Tom Baker and Sean Griffith make in Ensuring Corporate Misconduct (2010) and argues that their work highlights the limits of deterrence theory for shaping corporate conduct. Baker and Griffith extend the deterrence framework to account for the mediating effect of third-party institutions, like insurers, on deterrence calculations, and they suggest how corporate governance decisions, such as what type of insurance coverage to purchase, encode signals about corporations' compliance motivations and capacity. Although these insights might prove useful for enhancing the efficacy of deterrence regimes aimed at white-collar crime and other types of corporate misconduct, they suggest the difficulty of shaping corporate conduct that is influenced not only by the norms embodied in securities law, but also by the alternative normative system of shareholder value maximization. I discuss the failure of deterrence theory to address adequately noncompliant behavior that springs not solely from material self-interest, but from adherence to an alternative set of norms, and I explore the possibility of viewing corporate compliance as a norm-change project.