Categories
Excellence in Training

Establishing Your Program Design Objectives

At GM, we came up with ten design objectives that we felt were important for our training program:
1. Aligned to GM’s top compliance risks. In various guidance documents, you see the term “risk-based.” It’s critical that you design your program to directly address the risks your company faces. We’ll talk more about having a risk-based training program in future podcasts.
2.Professionally designed. Face it, compliance training is not pleasant. But it can be even worse if its quality is substandard. Unfortunately, in my career, I’ve had to take some pretty ugly courses. I’m sure many of us can relate. We’ve seen courses that are nothing more than a PowerPoint presentation with some stock images. If we’re lucky, we might have some narration. We wanted more than that with our online courses. We wanted our courses to be visually appealing. We wanted them to be very organized. We wanted them to be professionally narrated. We wanted them to be interactive.
3. Applicable to adult learners. There is a lot of debate about “adult learning theory” and strategies that appeal to various demographics. We wanted the courses to speak intelligently to a sophisticated and experience professional audience. Companies have different cultures, different styles, and different tastes. At GM, we wanted to be formal, but conversational. We wanted to be serious, but not stuffy. We didn’t want our learners to feel like we were talking down to them or treating them like children.
4. Standardized. There are some things that really irritate learners. One of those is a lack of standards between course offerings. Learners don’t want to have to learn how to use different navigation techniques in different courses. This is as simple as standardizing on look-and-feel, location of forward and back buttons, location of resources, types of test questions. One of the advantages of using a training vendor is that it promotes standardization between courses. This is a quick win. If all your courses have a standard look-and-feel, similar learning exercises, and similar kinds of knowledge checks, they spend the time learning rather than trying to figure out how to move through the course. We also wanted to come up with a set of standard languages, and we wanted the courses to reflect GM’s branding guidelines.
5. Strategically Planned. A company the size of GM has many risks that could be covered in a compliance training program. In our online training portfolio we have dozens of topics that we need to cover. But you just can’t require dozens of courses each year. There is such thing as training overload. So we decided to map out or risk coverage strategically over a three-year timeframe. Some stakeholders feel like their specific risk is so important that it has to be required every year. We had to get past that and reassume them that they weren’t going to be ignored, but that they needed to accept the fact that their specific topic would be fairly represented in the program over time.
6. Engaging. By engaging, I mean that we wanted the courses to hold the audience’s attention. We want them to be interesting. We want the courses to be relevant to the audience’s situations. We want them to make the learner think.
7. Frequently updated. One of my personal pet peeves, both as a training professional and as a learner, is being required to take the EXACT same course over and over again. I agree that some topics are so important that they have to be repeated. However, that doesn’t mean you can’t keep the courses fresh with different scenarios, different approaches to the risks, different videos, different learning checks. This became one of my cardinal rules. If you are going to repeat a topic in the training program, you’re going to refresh the course. I personally think it’s insulting when I’m asked to take a course twice. To me, nothing screams “check the box” program than requiring the identical course year over year.
8. Non Legalistic. How many times have you been in a training session where the instructor starts out by saying something like, “The five elements of the FCPA are…” The only people that kind of an approach appeals to are the lawyers in the room. I always say that I don’t care if my learners know how to spell FCPA. We aren’t trying to create mini-lawyers. (Do you really want your audience to be making legal decisions?) We are trying to help businesspeople understand how to perform their jobs ethically and within the bounds of company policies and the laws. We try to make sure that our courses speak the language of the business, not the language of the lawyers. (It’s a constant struggle.)
9. Optimized to Eliminate Redundancy. When you require multiple courses in the same year, there’s bound to be some redundancy. As important as a non-retaliation policy is, do you really need to cover it as a learning objective in every single course? Perhaps you can cover non-retaliation in your Code courses, and then just do a short pop-out reminder that we don’t retaliate in the other courses. Your overall goal is to cover the topics adequately while minimizing seat time to respect the employee’s time and company resources.
10. Flexibility
Finally, we wanted our program to be designed for flexibility. For example, it’s very possible that you will get an unexpected requirement to address a risk in year that you had not planned for that risk. A three-year plan can be designed to be flexible and adaptable to a changing risk environment.
Conclusion
Your company might value other things besides those I’ve talked about in this podcast. But if you think about your design objectives early in the planning phase, it will make your program implementation easier. It is also helpful to have these design objectives in hand before you start talking to the vendors who want your training business. You’ll be more likely to find a vendor that will meet your requirements if you go into the discussions with a vision of what you want them to provide.
Categories
FCPA Compliance Report

FCPA Compliance Report-Episode 433, Sean Freidlin on the Current State of Internal Investigations

In this episode I visit with Sean Freidlin, the Senior Product Marketing Manager, Compliance at Hanzo. We take a deep dive into the state of compliance investigation in 2019, focusing on the impact of the Evaluation of Corporate Compliance Programs on investigations. For more information, Hanzo has published the following work, “THE 2019 GUIDE TO INTERNAL INVESTIGATIONS FOR COMPLIANCE-An eBook on Planning, Protocols, Data Collection, Triage, and Remediation” on which I collaborated. (The eBook was sponsored by Hanzo.) The eBook provides the compliance professional with multiple tools, strategies and tactics for the entire lifecycle of investigations; from initial intake through remediation. I know that you will find it incredibly useful. You can download it here.
Categories
Daily Compliance News

Daily Compliance News: June 26 2019-the TechnipFMC settles edition

In today’s edition of Daily Compliance News:

  • Recidivist TechnipFMC settles FCPA enforcement action. (FCPA Blog)
  • Merrill Lynch settles market manipulation charges. (WSJ)
  • We want to comply but can’t. (Washington Post)
  • US chip companies still selling to Huawei. (NYT)
Categories
Compliance Into the Weeds

Compliance into the Weeds: Bonus Episode-Reflections on KPMG with Francine McKenna

Compliance into the Weeds is the only weekly podcast which takes a deep dive into a compliance related topic, literally going into the weeds to more fully explore a subject. In this episode, Matt Kelly (the coolest guy in compliance) and I take things in a different direction as we welcome Francine McKenna, reporter at MarketWatch. And blogger extraordinaire at Re: The Auditors. After one full week of writing, thinking and talking about the SEC enforcement action against KPMG, we provide our initial reflections.
McKenna discusses:

  • Is the total fine only Starbucks money for KPMG?
  • Why no one had an inkling of this cheating scandal in addition to the PCAOB scandal.
  • Why will the SEC will go out of its way not to put KPMG out of business?
  • What are the federal government audit assignments KPMG currently holds?
  • How should recalcitrant KPMG employees be disciplined?
  • Can the KPMG culture be turned around?

Kelly discusses:

  • Who will be the monitor and what will be their scope? What will they do?
  • How do you hold accounting firms accountable?
  • Channeling his inner Dean Wormer, Kelly asks if KPMG is now on a double Cease and Desist Order?
  • Can KPMG keep public confidence going forward?
  • Did Jay Clayton’s summer 2018 comments include any knowledge of the cheating scandal?

Fox discusses:

  • Was it negligent or intentional conduct involved?
  • How heavy is the shadow of Arthur Anderson in this matter?
  • Why the government will use all means possible not to put KPMG out of business?
  • KPMG in currently involved in multiple scandals, in at least 3 separate continents. Where and when will it end?
  • Is it time to break up the Big 4?
  • Is this fine really even a meaningful sanction?

For additional reading,  check out the following resources:
You should start with McKenna’s great piece on the scandal in MarketWatch, “The KPMG cheating scandal was much more widespread than originally thought
Matt’s blog post-Questions on the KPMG Ethics Fiasco
Tom’s blog post-Day of Reckoning for KPMG-Failures in Ethics
 

Categories
Trekking Through Compliance

Trekking Through Compliance-Episode 25-Errand of Mercy

In this episode of Trekking Through Compliance, we consider the episode Errand of Mercy which aired on March 16, 1967, Star Date 3194.8.
Compliance Takeaways:

  1. In an investigation, trust but verify.
  2. If your subsidiary’s financial statements are too complicated to decipher, you have a problem.
  3. Do you know how far down your TPIs extend?
Categories
Trekking Through Compliance

Trekking Through Compliance-Episode 24-Devil in the Dark

In this episode of Trekking Through Compliance, we consider the episode Devil in the Dark which aired on March 9, 1967, Star Date 3196.1.
Compliance Takeaways:

  1. What is your root cause analysis?
  2. Have you analyzed your internal controls from the compliance perspective?
  3. Simply because something is different doesn’t means its wrong or illegal. Is there a business justification?
Categories
Innovation in Compliance

Foundational Data Security with Chris Hoose


In this episode of the Innovation in Compliance Podcast, Tom Fox has a discussion about data security for smaller companies with the president of Choose Networks: Chris Hoose.  
Choose Networks is described on its website as Chris Hoose’s youngest child – and that’s something many entrepreneurs can relate to. The idea of family, however, is very important to the culture of Choose Networks. Maintaining that kind of family culture, where you have friends at work, and even in terms of how you think about your clients and vendors is a major priority for Chris – and a key element in how they provide a consistent product to their client. This matters because they really serve as an extension of their clients’ staff – the IT department.

Small Businesses are Tempting
The biggest reason hacking is an issue for small companies is that they often have access to the databases of much bigger companies. A small business can be a tempting target for a hacker, who thinks of them as an easy way into a much bigger organization.
Small companies can demonstrate that their systems are secure, and in compliance with all relevant regulations to communicate to large clients that they’re on top of and careful about, security. The technical requirements are the easy part – more difficult is behavior, and making sure that teams are adhering to policy.
Passwords are Still Key
It’s important to be careful with your passwords – believe it or not, many people still have to be told not to write them down and stick them to your monitor! Adding 2-factor authentication methods takes security one step further, and can be valuable for organizations who have access to sensitive information. Still – the number one thing to do to prevent cyber threats is to educate their employees about how to be mindful.
Storing Information on the Cloud
Cloud storage is everywhere – and it’s great in terms of ease of access, but relying on someone else to protect your data can be risky. On the other hand, they’re often much better at protecting things than you are. Choosing the right provider is important: you don’t want to trade security for convenience.
Have you Updated Your OS?
Vulnerabilities in operating systems are one of the most common ways for hackers to gain access to sensitive information. Since companies don’t know what the vulnerabilities are when they release an OS, they release security patches as they are discovered. At a certain point, the creators of Operating Systems have to stop producing security patches for their software – and when that happens, it’s open season. Update your OS on a regular basis – and upgrade it when it’s getting too old to protect.
When you’re dealing with teams that work remotely, your cloud provider is the most important data security consideration – and another major one is who owns the hardware your team uses. If your employees use their own equipment, you need to make sure you have certain privileges on them – like monitoring any recording, and remote wiping.
Resources:
ChooseNetworks.com
ChrisHoose.com

Categories
Daily Compliance News

Daily Compliance News: June 25, 2019, the cheating on tests edition

In today’s edition of Daily Compliance News:

  • Daimler shares fall on allegations it manipulated diesel tests. (WSJ)
  • CTFT awards $2.5MM whistleblower award. (FCPA Blog)
  • Chinese bank faces ‘death penalty’ sanctions. (Washington Post)
  • Airbus shuts down business unit in bribery scandal. (The Guardian)
Categories
Trekking Through Compliance

Trekking Through Compliance-Episode 23-This Side of Paradise

In this episode of Trekking Through Compliance, we consider the episode This Side of Paradise which aired on March 2, 1967, Star Date 3417.3.
Compliance Takeaways:

  1. What are the unknown talents of your staff?
  2. Failure to continuously monitor can lead to disaster.
  3. What is the role of all your team members?
Categories
Daily Compliance News

Daily Compliance News: June 24, 2019, the company you keep edition

In today’s edition of Daily Compliance News:

  • Just who are your friends and why does it matter.(FT)
  • Networking for newbies. (Washington Post)
  • Who are your friends (Part Duex). (NYT)
  • Ex-head of Interpol pleads guility to corruption in Chinese court. (BBC)