Categories
Popcorn and Compliance

Leadership Lessons from the Island of Lost Souls

I have always loved the classic Universal monster movies from the 1930’s. This month I am exploring one movie each week to mine it for leadership and compliance lessons. For this first entry in this short series on Popcorn and Compliance, I look at the original Island of Lost Souls is a 1932 American pre-Code science-fiction horror film, and the first sound film adaptation of H. G. Wells’ 1896 novel The Island of Dr. Moreau. The film was directed by Erle C. Kenton, from a script co-written by science fiction author Philip Wylie. It stars Charles Laughton, Richard Arlen, Leila Hyams, Bela Lugosi, and Kathleen Burke. The plot centers on a remote South Pacific island where mad scientist, Dr. Moreau, secretly conducts experiments to accelerate evolution in plants and animals, with horrific consequences. Featuring depictions of cruelty, animal-human hybrids, and irreligious ideas, the release of Island of Lost Souls was embroiled in controversy. Banned in some countries for decades, Island of Lost Souls has become an influential film and has acquired cult film status.

Resources

Island of Lost Souls Review

Categories
Daily Compliance News

October 22, 2022 the Managers are Not Alright Edition

In today’s edition of Daily Compliance News:

  • Avoiding corruption in Ukraine reconstruction. (Brookings Institute)
  • Middle managers are not OK. (Bloomberg)
  • Meta continues to seek debarment of FTC chief. (Reuters)
  • Senate asks DOJ to publish white-collar prosecution data. (WSJ)
Categories
GalloCast

Gallocast – Episode 4 – October 2022

Welcome to the GalloCast. You have heard of the Manningcast in football. Now we have the GalloCast in compliance. The two top brothers in compliance, Nick and Gio Gallo, come together for a free-form exploration of compliance topics. It is a great insight on compliance brought to you by the co-CEOs of ComplianceLine. Fun, witty, and insightful with a dash of the two brothers throughout. It’s like listening to the Brothers Gallo talk compliance at the dinner table. Hosted by Tom Fox, the Voice of Compliance. Topics in this episode include:

  • ComplianceLine rebranded to Ethico. How does this reflect the overall products and services of the organization in 2022 and beyond.
  • The Oracle FCPA Enforcement Action. What are some key lessons for compliance?
  • The Monaco Memo. Focus on employee incentives and clawbacks.
  • Employees having two jobs post pandemic. When is it a conflict of interest?
  • Quiet quitting and the opportunity for employee engagement.

Resources

Nick Gallo on LinkedIn

Gio Gallo on LinkedIn

Ethico

Categories
Daily Compliance News

October 21, 2022 the 45 Days of Liz Edition

In today’s edition of Daily Compliance News:

  • British PM resigns after 45 days. (FT)
  • The US says corruption decimated Zimbabwe. (VOA)
  • Mark Lanier opens the UK office. (Reuters)
  • CFIUS to get tougher. (WSJ)
Categories
Presidential Leadership Lessons for the Business Executive

Leadership Lesson from Andrew Jackson and Veto of the Second Bank Charter

In this episode, I consider the leadership lessons which can be drawn from our 7th President, Andrew Jackson. I focus largely on the crisis surrounding the Second National Bank of the United States charter, which played out over 5 years from 1831 to 1836. This conflict pitted Jackson against most of the nation’s political and financial elites, most prominently Nicolas Biddle, the President of the Bank. However, the great politicians of the day, including Henry Clay and Daniel Webster, were also lined up against President Jackson.

The crisis came to a head in the summer of 1832 when the House and Senate passed a bill renewing the Charter of the Second Bank of the US early. Not only did Jackson veto the bill and give one of the most memorable veto addresses of any President, he then took on Biddle directly by removing the first removing persons in the administration and government who were pro-Bank and pro-Biddle. In the coup de grace for the Bank, Jackson, the gold species from the Bank, moved into state banks across the country. Jackson won the battle completely. His actions were not without consequence, as the distribution of the species across the country led to rampant inflation and the Panic of 1837. However, by that time, Jackson had departed the Presidency, and the fallout was left to his successor Martin Van Buren.

Categories
Blog

Great Structures Week V – The Tacoma Narrows Bridge Failure and Preventing Failure in Your Compliance Program

I conclude my Great Structures Week with a focus on structural engineering failures: suspension bridges and the challenges of wind in their construction and maintenance. I am drawing these posts from The Great Courses offering, entitled “Understanding the World’s Greatest Structures: Science and Innovation from Antiquity to Modernity”, taught by Professor Stephen Ressler. In his chapter on suspension bridges he notes that the “Tacoma Narrows Bridge was the third longest span in the world when it opened to the world, this month of July in 1940.” Yet it collapsed only four months later, in one of the most famous visual images of a bridge’s collapsing. This is due to the “inherent flexibility of cable as a structural form”. A bridge can move in longitudinal vibration, that is up and down and in torsion, where it twists from side-to-side.

Most people recognize unstiffened suspension bridges as old as man and engineering itself. It was not until the 1820s that serious study was brought to bear on the issue of wind-related collapse of suspension bridges. The initial solution was to simply use more weight to reinforce the span. However, while that solution did bring some stability, it reinforced damage as the structure became a textbook example of Newton’s Second Law of Motion, which states that the acceleration of an object is dependent upon two variables – the net force acting upon the object and the mass of the object; meaning that once a heavy weight is in motion, it is more resistant to deceleration.

Yet it was scientific methodology that led to the disaster with the Tacoma Narrows Bridge. An engineer named Leon Moisseiff had developed a theory that long spanned suspension bridges were heavy enough that they did not require stiffening trusses because “their mass stabilized them against wind-induced vibrations.” However, this theory failed to take into account how air flows around a bridge and the “dynamic response of the structural system.” Ressler concludes this section by stating, “this case has become a classic symbol of the dangers of arrogance born of overconfidence in science-based design methods, and belt-and-suspenders engineering has made a bit of a comeback.”

I thought about the catastrophic failure of the Tacoma Narrows Bridge in the context of one of the greatest risks in Foreign Corrupt Practices Act (FCPA) compliance; that being third parties. Many non-compliance corporate employees assume that if a third party passes due diligence muster; they are in the clear. After all, you cannot stop a third party from making a bribe or other corrupt payment. Fortunately, the Department of Justice (DOJ) does not take such a myopic view as many business types. Under the FCPA, a company is responsible for the actions of its third-party representatives.

The real work around your third-party compliance program begins after the contract is signed and it is in the management of the third-party relationship. While the FCPA Guidance itself only provides that “companies should undertake some form of ongoing monitoring of third-party relationships”. Diana Lutz, in “Global anti-corruption and anti-bribery program best practices”, said, “As an additional means of prevention and detection of wrongdoing, an experienced compliance and audit team must be actively engaged in home office and field activities to ensure that financial controls and policy provisions are routinely complied with and that remedial measures for violations or gaps are tracked, implemented and rechecked.”

Carol Switzer, writing in the Compliance Week magazine, set out a five-step process for managing corruption risks, which I have adapted for third parties.

  1. Screen – Monitor third party records against trusted data sources for red flags.
  2. Identify – Establish helplines and other open channels for reporting of issues and asking compliance related questions by third parties.
  3. Investigate – Use appropriately qualified investigative teams to obtain and assess information about suspected violations.
  4. Analyze – Evaluate data to determine “concerns and potential problems” by using data analytics, tools and reporting.
  5. Audit – Finally, your company should have regular internal audit reviews and inspections of the third party’s anti-corruption program; including testing and assessment of internal controls to determine if enhancement or modification is necessary.

Additionally, there several different functions in a company that play a role in the ongoing monitoring of the third party. While there is overlap, I believe that each role fulfills a critical function in any best practices compliance program.

Relationship Manager

There should be a Relationship Manager for every third party which your company does business. The Relationship Manager should be a business unit employee who is responsible for monitoring, maintaining and continuously evaluating the relationship between your company and the third party.

Compliance Professional

Just as a company needs a subject matter expert (SME) in anti-bribery compliance to be able to work with the business folks and answer the usual questions that come up in the day-to-day routine of doing business internationally, third parties also need such access. A third party may not be large enough to have its own compliance staff so I advocate a company providing such a dedicated resource to third parties. This role can also include anti-corruption training for the third party, either through onsite or remote mechanisms. The compliance practitioner should work closely with the relationship manager to provide advice, training and communications to the third party.

3rd Party Oversight Committee

A company can have a Third-Party Oversight Committee review documents relating to the full panoply of a third party’s relationship with the company. It can be a formal structure or some other type of group, but the key is to have the senior management put a ‘second set of eyes’ on any third parties who might represent a company in the sales side. In addition to the basic concept of process validation of your management of third parties, as third parties are recognized as the highest risk in FCPA or Bribery Act compliance, this is a manner to deliver additional management of that risk.

After the commercial relationship has begun the Third-Party Oversight Committee should monitor the third-party relationship on no less than an annual basis. This annual audit should include a review of remedial due diligence investigations and evaluation of any new or supplement risk associated with any negative information discovered from a review of financial audit reports on the third party. The Third-Party  Oversight Committee should review any reports of any material breach of contract including any breach of the requirements of the Company Code of Ethics and Compliance. In addition to the above remedial review, the Third-Party Oversight Committee should review all payments requested by the third party to assure such payment is within the company guidelines and is warranted by the contractual relationship with the third party. Lastly, the Third-Party Oversight Committee should review any request to provide the third party any type of non-monetary compensation and, as appropriate, approve such requests.

 Audit

A key tool in managing the relationship with a third-party post-contract is auditing the relationship. I hope that you will have secured audit rights, as that is an important clause in any compliance terms and conditions. Your audit should be a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which your compliance terms and conditions are followed.

Perhaps now you will understand why I say that managing the relationship of your third party’s is where the real work of your FCPA compliance program comes to the fore. It also demonstrates a key difference in having a paper compliance program and doing compliance. Having a paper compliance program is simple but doing compliance is not always easy; you have to work at it to maintain an effective program.

I hope that you have enjoyed this week’s offering based around some of the world’s greatest structures, their engineering concepts and innovations and how they all related to a best practices compliance program. I am a huge fan of The Great Courses offerings and if you are interested in learning in a great many areas it is one of the best resources available to you.

Categories
Hidden Traffic Podcast

Germany’s Supply Chain Due Diligence Act (SCDDA) with Aditi Wanchoo

Aditi Wanchoo is Senior Manager of Human Rights at Novartis, based in Basel, Switzerland. Novartis is a leading global medicines company using innovative science and digital technologies to create transformative treatments in areas of great medical need. Aditi joins host Gwen Hassan to discuss Germany’s recent Supply Chain Due Diligence Act (SCDDA) and how it’s going to help with human trafficking prevention.

 

 

In order to tackle any change, whether it’s better labor and human rights protection for supply chain workers or addressing human trafficking, there needs to be an ecosystem response. Governments, businesses, and civil society must consistently work together to address and overcome these challenges. Having had the opportunity to work with three multinational companies in diverse sectors, Aditi believes companies can be and are a force for good to bring about social and environmental change.

Though human trafficking prevention, in particular, has improved in the last few decades, there is still much left to be done. Germany’s Supply Chain Due Diligence Act (SCDDA), which was passed in 2021 and will enter into force on January 1st, 2023, is an important step forward in this regard. The act’s core expectation is to develop a corporate risk management system to identify and address human rights and environmental risks. Companies that fail to do this will be subject to substantial administrative fines.

 

Resources

Aditi Wanchoo on LinkedIn

 

Categories
Life with GDPR

Meta Fined €405 million by Irish Data Protection Commission

Jonathan Armstrong and Tom Fox return for another episode of the award-winning Life with GDPR. In this episode, we discuss the recent fine by the Irish Data Protection Commission levied against Meta €405 million for Instagram Data Protection Infringements. Some of the highlights  include:

1.     What is the background of the case?

2.     What was the basis for the fine?

3.     What happens next?

4.     What did other national agencies and commissions, particularly the EDPB say?

5.     What are the lessons learned?

Resources

For more information on the issues raised in this podcast, check out the Cordery Compliance News Section. For more information on Cordery Compliance, go to their website here. Also, check out the GDPR Navigator, one of the top resources for GDPR Compliance, by clicking here.

Categories
Daily Compliance News

October 20, 2022 the Lamentable Edition

In today’s edition of Daily Compliance News:

  • Don’t work for KPMG Saudi Arabia. (FT)
  • Elizabeth Holmes asks for a new trial. (NYT)
  • Goldman claims whistleblower allegations ‘lamentable’. (Reuters)
  • Vietnam has yet another anti-corruption push. (WaPo)
Categories
Blog

Great Structures Week IV –  Gothic Cathedral and Compliance Incentives

I continue my Great Structures Week with focus on great structural engineering and its innovations in the medieval world – that being the Gothic Cathedral. I am drawing these posts from The Great Course offering, entitled “Understanding the World’s Greatest Structures: Science and Innovation from Antiquity to Modernity”, taught by Professor Stephen Ressler. When it comes to Gothic Cathedrals, Ressler notes that they are a rich case study in the development of “architecture and the limits of empirical design, literally written into the walls of the buildings.”

The innovation of the Gothic Cathedral was to use elements of the Roman basilica but to add “height and light, featuring ever taller naves, pierced by ever-larger clerestory windows, and delineated by ever-more-slender engaged columns”. The first innovation came with the pointed arch followed by ribbing on the columns to help stiffen and strength them more effectively. However, the truly dynamic innovation was the creation of flying buttresses, which were huge additional columns outside the structure yet were designed to become load-bearing members so the highest point inside the cathedrals could be filled by light through ornately stained glass windows. Two of the finest examples of these Gothic Cathedrals are both found in France. They are the Cathedral of Our Lady at Chartres and Cathedral of St. Stephens at Bourges.

Just as the medieval world built up the structural engineering techniques from their forebears, as your compliance regime matures you can implement more sophisticated strategies to make your Foreign Corrupt Practices Act (FCPA) compliance program a part of the way your company does business. Using an article from the MIT Sloan Management Review, “Combining Purpose with Profits, as a basis, I have developed six core principles for incentives, for the compliance function in a best practices compliance program.

  1. Compliance incentives don’t have to be elaborate or novel. The first point is that there are only a limited number of compliance incentives that a company can meaningfully target. Evidence suggests the successful companies are the ones that were able to translate pedestrian-sounding compliance incentive goals into consistent and committed action.
  2. Compliance incentives need supporting systems if they are to stick. People take cues from those around them, but people are fickle and easily confused, and gain and hedonic goals can quickly drive out compliance incentives. This means that you will need to construct a compliance function that provides a support system to help them operationalize their pro-incentives at different levels, and thereby make them stick. The specific systems which support incentives can be created specifically to your company but the key point is that they are delivered consistently because it signals that management is sincere.
  3. Support systems are needed to reinforce compliance incentives. One important form of a supporting system for compliance incentives “Is to incorporate tangible manifestations of the company’s pro-social goals into the day-to-day work of employees.” Make the rewards visible. As stated in the FCPA Resource Guide 2nd edition, “Beyond financial incentives, some companies have highlighted compliance within their organizations by recognizing compliance professionals and internal audit staff. Others have made working in the company’s compliance organization a way to advance an employee’s career.”
  4. Compliance incentives need a “counterweight” to endure. Goal-framing theory shows how easy it is for compliance incentives to be driven out by gain or hedonic goals, so even with the types of supporting systems it is quite common to see executives bowing to short-term financial pressures. Thus, a key factor in creating enduring compliance incentives is a “counterweight”; that is, any institutional mechanism that exists to enforce a continued focus on a nonfinancial goal. This means that in any financial downturn compliance incentives are not the first thing that gets thrown out the window and if my oft-cited hypothetical foreign Regional Manager misses his number for two quarters, he does not get fired. The key is that the counterweight has real influence; it must hold the leader to account.
  5. Compliance incentive alignment works in an oblique, not linear, way. The authors state, “In most companies, there is an implicit belief that all activities should be aligned in a linear and logical way, from a clear end point back to the starting point. The language used — from cascading goals to key performance indicators — is designed to reinforce this notion of alignment. But goal-framing theory suggests that the most successful companies are balancing multiple objectives (pro-social goals, gain goals, hedonic goals) that are not entirely compatible with one another, which makes a simple linear approach very hard to sustain.” What does this mean in practical terms for your compliance program? If you want your employees to align around compliance incentives, your company will have to “eschew narrow, linear thinking, and instead provide more scope for them to choose their own oblique pathway.” This means emphasizing compliance as part of your company’s DNA on a consistent basis — “the intention being that by encouraging individuals to do “good,” their collective effort leads, seemingly as a side-effect, to better financial results. The logic of “[compliance first], profitability second” needs to find its way deeply into the collective psyche of the company.”
  6. Compliance incentive initiatives can be implemented at all levels. Who at your company is responsible for pursuing compliance incentives? If you head up a division or business unit, it is clearly your job to define what your pro-social goals are and to put in place the supporting structures and systems described here. But what if you are lower in the corporate hierarchy? It is tempting to think this is “someone else’s problem,” but there is no reason why you cannot follow your own version of the same process.

Looking for some specific compliance obligations to measure against? You could start with the following examples of compliance obligations that are measured and evaluated.

 For Senior Management

  • Lead by example in your own conduct and in the decisions you take, to the resources and time you commit to compliance.
  • Facilitate and proactively practice in day-to-day activities the key compliance competencies, both internally and externally.
  • Support specific initiatives from the Chief Executive Officer (CEO), legal and compliance functions. 

 For Middle Management

  • Demonstrate, facilitate and proactively practice in day-to-day activities the key compliance competencies, both internally and externally.
  • Support specific initiatives from the legal and compliance functions.
  • Ensure that all employees, agents and contractors directly or indirectly reporting to you fully complete all required training and communications in a timely manner.
  • Provide full cooperation with investigations conducted by the compliance or legal functions of any alleged violation of compliance policies.
  • Include the Chief Compliance Officer (CCO) or another legal or compliance function representative in your management meetings at least twice per year, per geography.
  • Identify instances of non-compliance and support compliance monitoring and reporting systems. Partner with compliance in resolving compliance issues.

 For Business Development or Company Sales Representatives

  • Certify that all employees, agents and contractors directly or indirectly reporting to you have fully reported all sales and marketing interactions with all government officials in a timely manner.
  • Certify that all employees, agents and contractors directly or indirectly reporting to you have fully, promptly and accurately reported all expenses with third party sales representatives have occurred.

The Gothic Cathedral is one of the greatest structural engineering feats mankind has ever created. It combined a dimension of height not surpassed for nearly 1000 years with an ingress of light not previous seen in structures. This use of light facilitated the development of the artistry of stained-glass windows and directly led to the continued beauty and relevance of these magnificent structures.

Join us tomorrow as we conclude our series by looking at the Tacoma Narrows Bridge Failure and preventing failure in your compliance program.