Categories
Blog

Empowering Middle Managers: A Compliance Training Guide

A culture where employees feel safe to voice concerns through a speak-up culture is foundational to an ethical and compliant organization. However, fostering this environment is a two-way street; employees must feel encouraged to raise issues and confident that their voices will be heard and respected. Middle managers play a vital role in this process, serving as a bridge between employees and leadership. Training these managers to be effective listeners and supportive leaders is critical to embedding a true speak-up and listen-up culture. Today, I want to provide a comprehensive guide to structuring compliance training for middle managers to empower them in this essential role.

Establishing a Foundation for Openness and Trust

Middle managers are often employees’ first contact when they have questions, suggestions, or concerns. For this reason, the training should prioritize methods to create a welcoming and open environment. Employees are more likely to speak up in a space where psychological safety is present.

Training should focus on helping managers:

  • Set a Positive Tone. Managers can model openness by actively seeking input, acknowledging diverse viewpoints, and demonstrating that they value honest feedback.
  • Practice Respectful Communication. Respect and empathy should be at the core of all interactions. Managers should receive guidance on fostering a culture where positive or critical feedback is welcomed and used constructively.
  • Address Barriers to Speaking Up. Training should include understanding common barriers, such as fear of retaliation or judgment, that might deter employees from sharing their concerns. Managers need to learn techniques to overcome these barriers, assuring employees that feedback is welcomed and issues are handled impartially

Mastering the Art of Active Listening

Active listening is the cornerstone of a listen-up culture. To create a sense of safety and encourage more openness, managers should learn to develop strong listening skills:

  • Concentrate on the Speaker. Active listening involves more than just hearing words; it means being fully engaged and present. Managers should learn techniques to eliminate distractions, maintain eye contact, and show genuine interest in the employee’s concerns.
  • Show Empathy and Support. Employees feel more valued when managers respond with empathy. Compliance training should include exercises to help managers practice empathy in real-time, learn to listen without judgment, and offer support without prematurely reaching conclusions.
  • Utilize Non-Verbal Communication. Body language and facial expressions are powerful communicators. Managers should be trained to become aware of their non-verbal cues, such as maintaining an open posture, nodding, and mirroring, to convey that they are fully engaged and receptive to what the employee shares.

Reinforcing Confidentiality and Non-Retaliation

One of the most significant obstacles to a speak-up culture is the fear of retaliation or breach of confidentiality. Employees need assurance that speaking up will not negatively impact their role or relationships within the company. Training should address these concerns by teaching managers how to:

  • Communicate Non-Retaliation Policies. Emphasize that the organization has a strict non-retaliation policy and that any reports made in good faith will not be used against the employee. Managers should be trained on what this means in practice and how to reiterate this assurance to their team.
  • Model Confidential Handling of Concerns. Managers must understand the importance of discretion and keeping sensitive information within appropriate boundaries. Training should cover practical examples and role-playing exercises to help managers practice discretion when handling real-life scenarios.
  • Know When and How to Escalate. Managers should learn the correct escalation protocols for concerns beyond their control, including when to involve HR, compliance, or other internal functions. This keeps matters within formal channels, allowing for a structured and consistent response to concerns.

Responding to Concerns with Consistency, Integrity, and Fairness

Consistency in handling concerns signals to employees that their voices are valued and treated equally. To encourage this, compliance training should incorporate strategies for managing responses to sensitive issues fairly and respectfully:

  • Role-Playing Scenarios. Managers should engage in simulated situations where they practice responding to different concerns, such as interpersonal conflicts, compliance issues, or ethical dilemmas. By exploring these scenarios, managers can prepare for potential challenges in a controlled environment, making them better equipped to handle real situations confidently.
  • Guided Self-Reflection and Assessments. Managers should regularly evaluate their response styles to ensure they meet company fairness, integrity, and transparency standards. Compliance training can include guided assessments that help managers identify areas for improvement, such as biases or tendencies that may unintentionally affect their responses.
  • Implement Escalation Protocols. Managers must understand that not all concerns can or should be handled independently. Training should include guidance on the importance of escalating certain issues, such as legal or safety concerns, to the compliance department or other designated channels. This structured process ensures consistency, limits liability, and enhances employee trust in it.

Using Feedback Loops to Promote Continuous Improvement

For a speak-up culture to thrive, there should be an ongoing feedback and improvement process. Regular communication and consistent messaging from middle managers are essential to reinforcing this culture:

  • Creating a Culture of Continuous Dialogue. Managers should be encouraged to check in with their teams regularly rather than wait for annual reviews or structured feedback sessions. This open, continuous dialogue builds familiarity and trust, making it easier for employees to speak up when they have concerns.
  • Leveraging Digital Communication Tools. Managers can integrate compliance reminders, policy updates, and reinforcement of ethical standards into digital platforms where employees frequently engage. For example, using intranet channels or corporate social media platforms allows periodic messages, reminders, and success stories to be shared, helping employees internalize compliance messages over time.
  • Self-Assessments for Managers. Incorporate periodic self-assessment exercises, where managers reflect on their actions and impact on the speak-up culture. This can include anonymous feedback from employees, allowing managers to gain insight into their perceptions and identify improvement areas. Regular self-assessments reinforce accountability and ensure that managers remain aligned with the company’s compliance goals.

Instilling the “Listen-Up” Culture in Managerial Training

A listen-up culture goes hand-in-hand with a speak-up culture. For managers to effectively handle the concerns brought forward, they must receive dedicated training on what it means to listen up:

  • Developing Emotional Intelligence. Managers should be trained to be aware of their emotions and biases. Emotional intelligence is crucial in handling sensitive topics, as it allows managers to approach discussions with patience, empathy, and a genuine willingness to understand employees’ perspectives.
  • Creating Safe Spaces in Daily Operations. Rather than waiting for formal review sessions, managers can be trained to set aside dedicated time during team meetings to allow employees to voice questions or concerns. Encouraging open discussions in a safe environment reinforces that the company values and listens to employee feedback on compliance issues.

A Continuous, Proactive Approach to Compliance Culture

By empowering middle managers to build trust, actively listen, and foster an open dialogue, a company can lay the groundwork for a resilient compliance culture. The speak-up and listen-up approach is about avoiding ethical or legal breaches and creating a workplace where employees feel valued and respected, leading to better overall engagement and performance. Compliance training that encourages middle managers to foster this culture of openness is an investment in the company’s ethical foundation and its long-term success. Ultimately, a strong compliance culture is only as robust as those who support and enact it, and middle managers are a critical part of that foundation.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – 5 Keys to Compliance Communication

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we consider 5 keys to building a culture of trust and engagement in your organization.

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the full 3-book series, The Compliance Kids, on Amazon.com.

Categories
Blog

5 Keys to Compliance Communication: Building a Culture of Trust and Engagement in Your Organization

When it comes to corporate compliance, transparent and effective communication is non-negotiable. Your employees are not only the first line of defense but are also the customers of your compliance program. A well-communicated compliance function can shift the perception of compliance from a bureaucratic formality to a valued corporate asset. To establish this, compliance professionals must adopt a 360-degree communication approach emphasizing openness, interactivity, and alignment with company values.

Here are five keys to building a robust compliance communication framework within your organization:

Start with Clear Objectives: Define the “Why”

The first step to any successful compliance communication strategy is clarity of purpose. Before launching any campaign or distributing messaging, ensure you know why you are communicating in the first place. Some key questions include: Are you aiming to educate employees about new policies?

  • Does it reinforce the importance of ethical behavior? Prompt employees to report potential issues.
  • Will each goal shape your message and each audience within your company? Tailored messaging is required to understand the importance and relevance of your compliance program from the board of directors to the newest hires (from the boardroom to the shop floor).

If you aim to increase awareness of anti-corruption policies, your communication might center around the organization’s stance on integrity and honesty. However, if you encourage a speak-up culture, the message might emphasize confidentiality, support, and the importance of reporting misconduct. Ensuring your message has a clear and measurable objective can affect how it is received and whether employees take action.

Know Your Audience: Tailor Your Message for Maximum Impact

A single compliance message may only resonate with some in your organization. In any corporation, there are multiple audiences, including employees, senior leadership, middle management, external partners, and board members, all of whom have varying levels of familiarity with compliance topics. Recognizing and addressing these differences can significantly boost your messaging’s effectiveness.

For example, your frontline employees may need a straightforward explanation of policies and accessible reporting channels. Meanwhile, senior management may focus on the high-level implications of compliance initiatives on business strategy. A one-size-fits-all approach is less effective; instead, communicate with your audience in mind, considering their needs, knowledge level, and preferred communication channels.

Embrace Two-Way Communication: Build a Culture of Trust and Feedback

One of the most crucial aspects of compliance communication is creating an open line of dialogue, both up and down the chain. Employees should feel comfortable receiving compliance information, asking questions, seeking clarification, and providing feedback. Compliance should not be a one-way street; organizations must encourage interaction and feedback to build an authentic culture of ethics and accountability.

Integrating feedback mechanisms, such as surveys, focus groups, or town hall meetings, allows you to gauge employees’ understanding of compliance topics and uncover areas for improvement. But always remember that in compliance, we are only limited by our imaginations. Dun & Bradstreet CCO Louis Sapirman implemented a “Chatter Jam” for all company employees several years ago. It was a real-time discussion on an internal platform where employees shared their views on compliance topics like the company’s Code of Conduct. This open dialogue allowed the compliance team to hear employee concerns directly and make real-time adjustments.

In addition to these formal feedback channels, informal communication should be encouraged. Ensure employees know they can speak up without fear of retaliation. In doing so, you’re promoting compliance and creating an environment where ethical concerns can be discussed openly, ultimately preventing small issues from becoming major risks. 

Consistency and Frequency: Keep Compliance Top-of-Mind

Effective compliance communication is not a one-off event but a continuous conversation. Reminders and reinforcements must be consistent and frequent for employees to internalize compliance principles. Use multiple communication channels to keep compliance messages front and center. This can include periodic emails, newsletters, short videos, or even social media-style updates on internal platforms.

Consistency doesn’t mean redundancy; it’s about finding fresh ways to reinforce fundamental compliance principles. For example, the DOJ’s 2020 FCPA Resource Guide, 2nd edition, emphasizes that regular communication about compliance expectations helps companies demonstrate their commitment to ethics and compliance. Even brief reminders can have a lasting impact. Remember Morgan Stanley’s case, where they sent 35 compliance reminders over seven years to reinforce anti-bribery policies. The company’s diligence in maintaining consistent messaging resulted in receiving a declination from the DOJ when one of its managing directors was involved in misconduct.

Regularly communicating compliance expectations also helps create a sense of normalcy around compliance issues, positioning compliance as a natural part of everyday operations rather than an occasional reminder or, worse, a reactive measure only brought up after an incident occurs.

Foster Engagement Through Storytelling and Real-World Examples

Human beings are naturally drawn to stories, so it is no surprise that storytelling is one of the most effective ways to communicate compliance issues. Sharing real-world examples of positive and negative outcomes can help employees better understand the importance of compliance and the risks associated with unethical behavior. When employees see real-life scenarios, they can more easily relate to how compliance impacts their roles and the company’s success.

Using case studies from your industry to illustrate the potential consequences of non-compliance. Highlighting scenarios where similar companies faced penalties due to lapses in compliance can make the risks feel more tangible. Conversely, sharing success stories within your organization, such as how a well-trained team prevented a potential compliance breach, can reinforce the value of compliance.

Storytelling also applies to compliance champions within the organization. Showcase individuals or teams who have exemplified ethical behavior and contributed positively to the compliance culture. Celebrate these “compliance heroes” publicly, whether in internal newsletters, company meetings, or digital screens throughout the office. Recognizing and celebrating compliance efforts in this way can have a ripple effect, inspiring others to follow suit.

Bringing it All Together: The 360-Degree Compliance Communication Model

Incorporating these five keys into your communication strategy will help establish a 360-degree approach to compliance that keeps the program visible, relevant, and actionable across the organization. It’s about more than simply sending information; it’s about creating a dynamic, two-way exchange that reinforces compliance as an integral part of your company culture. When compliance communication is objective-driven, audience-centered, interactive, consistent, and engaging, you build trust and accountability within the organization.

A robust compliance communication strategy positions your program not as a barrier to business but as an ally, helping employees navigate ethical challenges confidently. By adopting these five keys, compliance leaders can shift the perception of compliance from a mandatory obligation to a trusted, positive influence on the company’s success. It’s a win-win for employees and the organization, promoting ethical conduct while protecting its reputation and bottom line.

In the end, remember this: compliance communication is not simply about conveying rules and policies. It is also about building a culture where employees feel supported, informed, and engaged in upholding the company’s values. The real measure of success in compliance communication is when employees understand, embrace, and live out these values in their daily work.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Board Questions and Metrics for 3rd Party Risk Management

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we consider what questions a Board of Directors should ask a CCO and the types of metrics they should ask for in their role of overseeing the compliance program.

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the full 3-book series, The Compliance Kids, on Amazon.com.

Categories
Great Women in Compliance

Great Women in Compliance – Reflections and Resilience Through a Compliance Career with Karen Bertha

Welcome to the Great Women in Compliance podcast with Hemma Lomax and Lisa Fine, sponsored by Corporate Compliance Insights.   In today’s episode, Lisa speaks with Karen Bertha, who has built world-class programs throughout her career, most recently at V2X.   She has significant acquisition and post-acquisition due diligence expertise, including at V2X.  After that acquisition, she was at a crossroads and needed time to take stock and pause.

Karen reflects on her work with due diligence, including how and when compliance should be involved in due diligence.  They also discuss strategies for post-integration, even if compliance is brought at some point later.  Karen has worked in highly regulated industries, such as government contracting, and those not in highly regulated industries. She shares her experiences and lessons learned.

Karen left V2X after the acquisition when she needed time for herself and other parts of her life.  She talks about how the “power of the pause” has been helpful to her.  She talks about reflecting on her work in the Ethics & Compliance profession, increasing her learning, specifically in compliance-adjacent fields like Human Resources and audit, with time to focus.  She also shares what she has enjoyed during this time, which we at #GWIC hope can inspire those thinking about your next steps or between roles.

Join the Great Women in Compliance community on LinkedIn here.

Categories
Blog

Board Oversight of Third-Party Risk Management: Key Questions and Metrics for Effective Governance

The Telephonica Venezuela FCPA enforcement action reminds us that third-party risk management is one of the most critical components of a corporate compliance program. From suppliers and distributors to agents and joint venture partners, third parties can expose a company to significant compliance risks, including bribery, data security breaches, and regulatory violations. For a Board of Directors, effective oversight of third-party risk management is essential to fulfill its fiduciary duties and ensure that the organization mitigates these potential threats.

For boards, the responsibility involves more than just reviewing policies or compliance assessments. It requires a proactive approach, regularly engaging with the Chief Compliance Officer (CCO) and demanding specific information to confirm that third-party risks are effectively managed. Today, we will consider some key questions a board should ask and key metrics that boards should track to ensure their oversight of third-party risk management.

Key Questions a Board Should Ask About Third-Party Risk Management

To provide effective oversight, board members should ask the CCO a series of targeted questions that illuminate the strengths and weaknesses of the organization’s third-party compliance efforts. These questions can guide discussions around key areas such as due diligence, monitoring, training, and incident response.

  • What is our Third-Party Risk Profile?

This foundational question helps the Board understand the scope of the organization’s third-party network and the inherent risks involved. The CCO should be able to explain how third-party risk is assessed, classified, and prioritized. This includes geographic, industry, and transactional risks that may be more prevalent in high-risk regions or industries such as defense, oil and gas, and healthcare.

  • What Due Diligence Processes are in Place?

The Board should ask about the specific due diligence processes for third parties. This includes initial onboarding assessments, background checks, and ongoing monitoring. Understanding the due diligence process, including who is responsible, the standards used, and whether enhanced due diligence is conducted for high-risk third parties, is critical for oversight.

  • How Do We Ensure Continuous Monitoring of Third Parties?

It is not enough to perform due diligence only once. Continuous monitoring is essential to detect a third party’s risk profile changes. The Board should ask about the tools and technologies used for monitoring, the frequency of updates, and how compliance continuously evaluates third parties for new risks, such as changes in ownership, regulatory status, or financial stability.

  • How Do We Address Identified Risks?

A key component of third-party risk management is having procedures to address identified risks. The Board should inquire about the company’s approach to risk mitigation, including risk-adjusted measures for different risk levels. Are high-risk third parties subject to contract clauses or specific compliance obligations? Does the organization maintain a system to monitor the ongoing effectiveness of risk mitigation efforts?

  • What Training and Awareness Programs Do We Have in Place?

The Board should ask how compliance trains third parties on relevant laws, policies, and expectations, especially concerning anti-corruption, data protection, and ethics. Additionally, internal stakeholders involved in third-party management, such as procurement and finance, should receive specialized training to help them recognize red flags.

  • What is Our Process for Reporting and Escalating Third-Party Compliance Issues?

Knowing that issues will inevitably arise, the Board should ask how the organization reports and escalates third-party compliance concerns. Does the CCO have direct access to the Board in case of serious compliance violations? Is there a protocol for handling third-party incidents that could affect the company’s regulatory standing or reputation?

  • How Do We Measure the Effectiveness of Our Third-Party Risk Management?

The effectiveness of the third-party compliance program is a priority for the Board. Asking for metrics and other objective measures helps ensure that the program is well-designed and functioning as intended. The Board should proactively seek quantitative and qualitative evidence of effectiveness.

Key Metrics for Third-Party Risk Management Oversight

Metrics are invaluable for Board members seeking to monitor the compliance program’s health. The CCO should be able to provide regular updates on the following metrics, each offering insight into specific aspects of third-party risk management.

  • Number of Third Parties by Risk Category

This metric breaks down the organization’s third parties by risk level (e.g., low, medium, high). This provides the Board with a snapshot of the company’s risk exposure and helps them assess whether the program is appropriately resourced to manage the volume of high-risk third parties.

  • Percentage of Third Parties with Completed Due Diligence

Tracking this metric shows whether the company is adhering to its compliance policies. Ideally, 100% of third parties should undergo due diligence before onboarding, and any gaps here could signal significant compliance weaknesses.

  • Average Time to Complete Due Diligence

This metric reveals the efficiency of the due diligence process. Long turnaround times can delay critical partnerships and increase risk exposure, while excessively fast times may suggest that due diligence needs to be sufficiently thorough. Boards should look for a balanced metric that reflects both efficiency and comprehensiveness.

  • Incidents of Non-Compliance Among Third Parties

The Board should be regularly informed of compliance incidents involving third parties. This metric could be broken down by type of violation (e.g., anti-bribery, data privacy, labor practices) and severity. Tracking these incidents over time helps the Board evaluate the program’s effectiveness and whether additional resources are needed.

  • Percentage of High-Risk Third Parties Monitored Regularly

Continuous monitoring is vital to effective risk management, particularly for high-risk third parties. This metric provides insight into how often high-risk third parties are reassessed, which can inform the Board about the level of vigilance being applied to higher-risk partners.

  • Training Completion Rates for Third Parties and Internal Teams

Effective third-party risk management requires third parties and the internal teams who work with them to understand the compliance risks and policies. This metric tracks how many third-party representatives and relevant employees have completed compliance training, an essential factor in reducing risk.

  • Average Time to Resolve Third-Party Compliance Issues

This metric measures the organization’s responsiveness to third-party compliance concerns. Quick resolution times may indicate an efficient and effective response system, while delays might suggest resource constraints or procedural bottlenecks. Boards should look for a metric that balances speed and thoroughness.

  • Costs of Third-Party Compliance Program

The Board should also monitor the financial investment in third-party compliance to assess if the program is adequately funded. This includes costs for due diligence, continuous monitoring, training, and compliance technology. Comparing these costs against third-party risk levels can help determine if the program is appropriately resourced.

Leveraging Metrics for Continuous Improvement

By tracking these metrics, Boards ensure that third-party risks are being effectively managed and can drive continuous improvement in the compliance function. Over time, trends will emerge, highlighting areas where the program may need reinforcement. For instance:

  • Increasing compliance incidents among third parties could indicate a need for enhanced due diligence or more stringent onboarding criteria.
  • Declining training completion rates suggest a lack of engagement from third parties, potentially due to ineffective communication or training methods that must be revisited.
  • Prolonged resolution times for compliance issues might signal the need for process optimization or additional staff in the compliance team.

The Board should encourage the CCO to use these insights to fine-tune the program and prioritize high-impact initiatives. Additionally, boards should expect the CCO to present metrics and narrative insights, offering a holistic view of the third-party compliance landscape and how specific metrics relate to broader compliance goals.

Fostering a Culture of Accountability and Compliance

Board oversight of third-party risk management is no longer a mere checkbox—it’s a crucial part of protecting the organization’s reputation, ensuring regulatory compliance, and building a resilient corporate structure. By asking the right questions and tracking key metrics, Boards can proactively ensure that third-party risks are managed effectively.

An engaged Board that emphasizes the importance of third-party compliance sends a powerful message across the organization and beyond. When Boards hold the compliance function accountable and demand robust third-party oversight, they not only mitigate potential risks but also foster a culture of integrity and accountability that resonates with employees, partners, and stakeholders alike. This, in turn, strengthens the entire organization, building a foundation of trust and resilience that will serve it well in any compliance landscape.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – CCOs Reporting to the Board

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we consider what a CCO needs to tell a Board of Directors.

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the full 3-book series, The Compliance Kids, on Amazon.com.

Categories
Blog

What Should a Chief Compliance Officer Report to the Board of Directors?

The Chief Compliance Officer (CCO) role is essential in building an organization that meets regulatory standards and upholds a robust ethical culture. But what should the CCO be reporting to the Board of Directors to ensure they understand the full scope of the company’s compliance landscape? This post will consider the essential elements of an effective Board report from the CCO. These elements will help foster transparency, trust, and accountability between the compliance function and the highest levels of corporate oversight.

  • Overview of Compliance Program Structure and Key Updates

An essential part of a CCO’s responsibility to the Board is to ensure they understand how the compliance function is structured and resourced. This includes an overview of the compliance team, its reporting lines, and any recent structural changes. The CCO should also emphasize that the compliance function has the independence, resources, and support to operate effectively.

For example, it is useful to discuss whether additional resources are needed—such as an increased budget, training for compliance staff, or investments in new technology to improve monitoring. Even more crucial is regularly informing the Board about fundamental personnel changes in the compliance team, including new hires or departures. This assures the Board that the compliance team is fully staffed and led by individuals with the experience and knowledge necessary to accomplish the organization’s compliance goals.

  • Risk Assessment and Emerging Compliance Risks

One of the CCO’s primary duties is to ensure that the Board is aware of the organization’s compliance risks. An annual or quarterly update on the status of these risks—mainly if there are high-priority or emerging risks—is critical. The CCO should discuss the results of any recent risk assessments, including:

  1. The top risks currently facing the organization.
  2. Risks associated with new business ventures or geographic expansion.
  3. Changes in geo-political or regulatory landscapes that may impact risk exposure.

For instance, if the company is expanding operations in a high-risk country for bribery or data privacy, this development should be highlighted, along with any steps the compliance team is taking to mitigate the risk. The goal here is not to overwhelm the Board with excessive detail but rather to provide a clear view of where the most significant vulnerabilities lie and what strategies are in place to address them.

The Board should leave these discussions to understand the nature and scope of the company’s compliance risks and the level of oversight being applied to manage those risks. This will reassure them that the company is not only aware of potential threats but is proactively addressing them.

  • Status of Key Compliance Initiatives and Program Enhancements

Board members must see that the compliance program is not static but a dynamic, continuously improving function. The CCO should regularly report on ongoing compliance initiatives and any recent improvements to the program. This can include initiatives such as:

  1. Enhancing third-party risk processes.
  2. Implementing new training programs.
  3. Developing better monitoring and auditing capabilities.

These initiatives should align with the company’s strategic goals, and the CCO can emphasize how compliance supports and reinforces these objectives. For example, if the company has adopted a new code of conduct or revised anti-corruption policies, the CCO should detail how these updates are being rolled out, communicated, and embedded into the organization’s culture.

Additionally, metrics that measure the success of these initiatives are invaluable. For example, sharing compliance training completion rates, results from employee feedback surveys on compliance topics, or the reduction of hotline reports in specific areas can help the Board understand the program’s impact and areas that may need further attention.

  • Compliance Investigations and Response to Issues

Transparency about compliance investigations and their outcomes is fundamental to the Board’s oversight responsibilities. The CCO should provide a high-level overview of significant compliance incidents, particularly those that pose a financial, operational, or reputational risk to the company. This discussion should include:

  1. The nature of the issue or alleged violation.
  2. The investigative steps taken.
  3. Any corrective actions or disciplinary measures implemented.

The CCO should also clearly explain how these issues were detected—whether through internal audits, whistleblower reports, or monitoring activities—demonstrating that the compliance function effectively catches and addresses problems early. It’s important to note that the Board does not need the names of individuals involved or granular details. Instead, they should receive summaries on patterns, issues encountered, and root causes.

Discussions on trends emerging from investigations—such as recurring issues in specific geographies or business units—can provide the Board with valuable insights into potential vulnerabilities. This information also equips the Board to ask strategic questions about how the company’s compliance efforts address these trends, thus bolstering their understanding and oversight of the compliance program.

  • Compliance Program Metrics and KPIs

Measurable data points—such as Key Performance Indicators (KPIs)—are crucial to effective board reporting. Metrics help the Board understand how well the compliance program is performing and identify areas for potential improvement. Examples of relevant compliance metrics include:

  1. Training effectiveness rates across the organization.
  2. Number of hotline calls and resolution time.
  3. Frequency and outcomes of internal audits.
  4. Employee survey results on compliance culture and awareness.

It is helpful to present these metrics in a clear, accessible format, perhaps in the form of dashboards or visual aids, so the Board can quickly grasp the current state of the compliance program. By monitoring trends in these metrics over time, the Board can see the program’s evolution and any areas where additional focus or resources may be needed.

  • Status of the Compliance Culture and “Tone from the Top”

Building a culture of compliance starts at the top, and the Board plays a critical role in establishing this tone. The CCO should regularly report on the company’s compliance culture, noting any shifts or improvements. This could include:

  1. Results from employee surveys on attitudes towards compliance.
  2. Observations from site visits or engagement with various departments.
  3. Feedback from middle management on employee engagement with compliance.

If the company’s compliance culture has gaps, this is the ideal time to discuss closing steps. The CCO can use this section of the report to highlight the role of senior leaders and managers in reinforcing compliance messages. For instance, showcasing how top executives have engaged in recent compliance campaigns or have visibly supported compliance initiatives demonstrates a commitment to ethical conduct and can serve as a model for others.

  • Resources and Budget: Ensuring Adequate Support

One of the most significant concerns the Board should be aware of is whether the compliance function is adequately resourced. The CCO should use this portion of the report to discuss additional needs, such as funding for new technology, more staff to support compliance efforts in high-risk regions or enhanced training programs.

If budget constraints have affected the compliance program, this is also the time to discuss those challenges with the Board. Clear communication about resource needs can help the Board advocate for the compliance function, ensuring it has the tools to mitigate risks effectively. Adequate funding and resources were mandated in the 2024 Evaluation of Corporate Compliance Programs, and CCOs need to explain to the Board their responsibility to ensure this mandate is met.

  • Regulatory Updates and External Trends

Keeping the Board informed of the latest regulatory developments is also crucial. This includes new or evolving laws that could impact the business, industry trends in compliance and enforcement actions against companies in similar sectors. For example, if a new data protection law exists in a region where the company operates, the CCO should outline how the compliance team is preparing to address it.

This part of the report ensures the Board is aware of potential compliance-related challenges on the horizon and provides context for any new initiatives or policy updates the compliance team may propose in response to regulatory changes.

  • The CCO’s Essential Role in Equipping the Board

The relationship between the CCO and the Board is one of the cornerstones of an effective compliance program. By providing a comprehensive, transparent, and strategic report, the CCO empowers the Board to fulfill its oversight responsibilities, making informed decisions that support and enhance the company’s commitment to compliance and ethical conduct.

An effective board report is about more than compliance updates; it is an opportunity to reinforce the importance of compliance, highlight the program’s successes, and communicate any challenges that lie ahead. By keeping these eight core elements in mind, CCOs can ensure their reports inform and engage the Board, fostering a culture of accountability that permeates the entire organization.

Categories
Blog

Why the 2024 ECCP Update is a Game-Changer for Compliance

In the DOJ’s 2024 update to the Evaluation of Corporate Compliance Programs (2024 ECCP), compliance professionals face new expectations that could reshape how we approach compliance programs. In this latest update, the DOJ strongly emphasizes data-driven insights, focusing on compliance culture, employee engagement, and organizational trust. This means that compliance programs must now focus on policies and procedures and prove that these practices are embedded into the company culture and yield measurable outcomes.

The implications of these new standards extend across every aspect of compliance, from audits to employee training and risk assessments. In this post, we’ll explore the key areas of the 2024 ECCP, discussing why the DOJ’s new focus on data and culture is significant and how compliance professionals can adjust their strategies to align with these expectations.

A New Focus on Data: The Backbone of Modern Compliance

One of the most critical shifts in the 2024 ECCP is the DOJ’s call for data-backed evidence of a company’s compliance culture. The DOJ now expects organizations to establish a culture of compliance and document and track its effectiveness over time. Compliance professionals are no longer tasked with simply implementing policies; they must now demonstrate that these policies have a real impact.

For example, it is no longer enough to state that employees are encouraged to report misconduct. Now, organizations must gather data to prove employees feel safe and supported when they report issues. This could include metrics such as hotline usage rates, anonymous survey responses, and feedback on trust in leadership. By collecting data on these and other elements, compliance teams clearly understand how well the compliance culture is functioning.

The DOJ’s new data-driven approach means compliance professionals must focus on metrics that reflect the health of their programs. This might include engagement levels, response times for reports of misconduct, and employee feedback on how accessible and transparent compliance processes are. Tracking these metrics not only helps compliance teams spot trends and identify areas of improvement but also provides concrete evidence of a commitment to compliance that can be shared with regulators.

The Role of Culture Audits: A Window into Organizational Health

With the DOJ’s increased focus on culture, culture audits have become an indispensable tool for compliance professionals. A culture audit goes beyond policy checks and evaluates the organizational attitudes and behaviors that define the company’s ethical framework. This includes measuring employee engagement, trust in leadership, and perceptions around compliance practices. By regularly conducting culture audits, compliance teams can identify weaknesses, reinforce strengths, and monitor shifts in compliance culture over time.

A robust culture audit can answer the DOJ’s fundamental questions: Are employees engaged in compliance efforts? Do they feel comfortable reporting concerns? Do they trust that their leaders are committed to ethical behavior? For instance, if a culture audit reveals that only 60% of employees feel confident using the company’s whistleblower hotline, it clearly indicates that improvements are needed to make employees feel safe in reporting issues.

The data gathered from culture audits provides compliance officers with actionable insights that can be used to enhance training programs, increase communication around compliance expectations, and address gaps in trust or engagement. Additionally, regular culture audits help to create a benchmark, enabling organizations to track changes over time and prove to the DOJ that their compliance culture is consistently improving.

Practical Steps for Compliance Professionals

The 2024 ECCP serves as a roadmap for compliance professionals, outlining practical ways to elevate their compliance programs to meet new expectations. Here are some key steps that can help compliance teams align with these enhanced standards:

  1. Implement Regular Culture Audits. Regular culture audits provide a structured way to assess compliance culture and identify trends in employee engagement, trust, and ethical behavior. Compliance teams can establish a baseline and track improvements over time by conducting these audits at least annually. Regular audits also help identify areas where further training or communication may be necessary, ensuring that compliance culture remains dynamic and responsive.
  2. Prioritize Data Collection and Analysis. In the era of data-driven compliance, tracking and analyzing metrics is essential. Compliance teams should focus on data points that reveal insights into the effectiveness of their programs. This could include metrics on employee trust in reporting mechanisms, hotline usage rates, participation in compliance training, and overall engagement in compliance initiatives. By collecting and analyzing this data, compliance professionals can comprehensively view their program’s impact.
  3. Enhance Transparency and Communication. One of the DOJ’s central themes in the 2024 ECCP is transparency. Compliance professionals should ensure that employees at all levels understand the company’s commitment to ethical behavior and know how to access compliance resources. Regular communication on compliance issues, successes, and updates from leadership reinforces the importance of compliance culture and can help build trust among employees.
  4. Integrate Compliance with Performance and Incentives. Companies should align performance reviews and incentive structures with compliance goals to truly embed compliance into the organizational culture. For instance, recognizing and rewarding employees who demonstrate a commitment to compliance reinforces the message that ethical behavior is valued. This alignment also signals to employees that compliance is part of the path to career advancement and success within the organization.
  5. Document, Document, Document. If there’s one takeaway from the DOJ’s update, it’s the importance of documentation. In the DOJ’s eyes, if it’s not documented, it didn’t happen. Compliance teams should maintain thorough records of all culture audits, data findings, responses to feedback, and improvements over time. This documentation provides a clear data trail demonstrating ongoing efforts to strengthen compliance culture, which can be invaluable in a regulatory review or investigation.

Data Is a Game-Changer for Compliance Programs

The 2024 ECCP update is a milestone for compliance programs, marking a shift toward a more holistic, data-focused approach. By placing emphasis on data, the DOJ effectively requires companies to provide concrete proof of their compliance efforts, making it clear that ethical behavior is no longer just a set of policies—it’s a measurable, evolving part of the corporate culture. This represents a major change for compliance professionals, as they must now develop skills in data analysis, culture assessment, and strategic planning.

The DOJ’s increased focus on compliance culture and data-backed metrics aligns with the broader trend toward accountability and transparency in corporate governance. Compliance professionals who embrace this shift will be able to strengthen their programs, foster a more ethical workplace, and reduce their organization’s risk of regulatory scrutiny. By taking proactive steps to meet these new standards, compliance teams can also build trust with employees, investors, and regulators, creating a foundation of integrity that benefits the entire organization.

Turning Compliance into a Competitive Advantage

The DOJ’s 2024 ECCP update is not simply a set of new requirements but an opportunity for compliance professionals to elevate their programs, demonstrate value, and create a culture where ethical behavior is embedded into the organizational DNA. By focusing on data, conducting regular culture audits, and aligning compliance with incentives, compliance professionals can turn these new standards into a competitive advantage.

For compliance professionals, the ECCP update provides a clear framework for fostering a dynamic, responsive compliance culture that meets and exceeds regulatory expectations. By staying ahead of these changes, compliance professionals protect their organizations and position themselves as strategic leaders who understand the evolving nature of compliance. In an era where regulators demand proof of ethical culture, data is no longer just a tool; it is the future of compliance, and those who embrace it are setting their organizations up for long-term success.

Categories
Adventures in Compliance

The Casebook of Sherlock Holmes – Investigative Lessons from The Adventure of The Mazarin Stone

In this new season of Adventures in Compliance, host Tom Fox takes a deep dive into the Sherlock Holmes collection The Case-Book of Sherlock Holmes  by Arthur Conan Doyle. It is a final set of twelve Sherlock Holmes short stories by Arthur Conan Doyle, first published in the Strand Magazine between October 1921 and April 1927. In this episode, we consider the story, the Adventure of the Mazarin Stone. In this story, Sherlock Holmes investigates a case involving a master jewel thief and Holmes investigative techniques. This story provides several valuable investigative lessons for the 21st century compliance professional.

Fox explores how the investigative brilliance of Sherlock Holmes can be applied to modern corporate compliance. Fox translates Holmes’ detective methods into valuable compliance strategies. He discusses how creative investigative techniques, effective witness handling, and quick resolution tactics from Holmes’ era can benefit today’s compliance professionals. With reference to the 2024 updates to the DOJ Whistleblower Financial Incentive Program, Fox emphasizes the importance of timely action, collaboration with external authorities, and attention to detail.

Highlights Include:

  • Holmes’ Clever Tactics and the Jewel Thief
  • Internal Investigative Lessons for Compliance Professionals
  • Maintaining Control in Tense Situations
  • Staying Focused on Objectives
  • Gathering Evidence Discreetly
  • Handling Key Witnesses

Resources:

The New Annotated Sherlock Holmes

Sherlock Holmes FAQ by Dave Thompson

For an audio/video version of the Compliance Kids book, Speaking Up is AWESOME, contact Tom Fox. 

Connect with Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn