Tag: CCO

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program Through Culture: Day 13 – Preventing Retaliation to Improve Culture

Retaliation against a person who speaks up is a pervasive issue that not only creates a toxic work environment but also discourages victims from reporting incidents. This means you must address retaliation and encourage reporting in workplaces. When employees report harassment face severe retaliation, which leads to a loss of trust in the reporting process. This fear of being labeled a “rat” or “gossip” often prevents victims from coming forward and seeking justice. To combat this issue, non-retaliation protocols are crucial to protect individuals and ensure legal compliance.

Non-retaliation protocols must be in place to encourage reporting.  The fear of retaliation is deeply rooted in the perception of being a whistleblower or complainant. Every compliance must have strong policies, consequences for violators, and open workplace conversations to empower bystanders. Bystanders play a crucial role in identifying and reporting harassment, but they often fear retaliation or loyalty conflicts.

Addressing retaliation and encouraging reporting in workplaces requires a multifaceted approach. Strong non-retaliation protocols, open workplace conversations, and the empowerment of bystanders are key factors in creating a safe and inclusive work environment. By prioritizing the well-being of employees and fostering a culture of trust, organizations can effectively combat sexual harassment and ensure compliance with legal and regulatory requirements.

 Three key takeaways:

1. You must have robust policies and procedures against retaliation.

2. A lack of confidential reports will have an impact on culture.

3. Bystanders are the key to a robust culture.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Compliance Through Culture: Day 12 – Fixing an Unsafe Workplace

We continue to look at fostering an ethical culture through psychological safety, using as a starting point the “Fostering Ethical Conduct Through Psychological Safety” whose authors believe that “when psychological safety is lacking, it may be a consequence of the employee having witnessed unethical behavior.” The more unethical behavior a person sees, the more likely they are to feel psychologically unsafe.

The authors basically state the obvious when they write, “It makes intuitive sense that being in a work environment where unethical behavior is prevalent might diminish psychological safety.” Put another way “people are most reluctant to speak up in ethically troubled environments, where we most need them to do so.” This is an important issue for every CCO and business leader. To overcome such a deficiency, they found that “several other factors correlated with strong speak-up behavior, keeping everything else constant: moral engagement, moral attentiveness, and organizational justice combined with clarity of expectations.”

Moral engagement. As a CCO you should endeavor to create an atmosphere where ethical conduct matters, “so that when employees recognize a potentially unethical situation, they will be motivated to do what’s right.”

Moral attentiveness. You can educate employees to recognize the ethical dimensions of situations. You can have managers highlight examples of ethical and unethical behavior with their teams and encourage dialogue on workplace ethics.

Organizational justice. Obviously, talk is cheap and it is actions, not deeds, that matter. The DOJ has made clear in the 2023 Evaluation of Corporate Compliance Programs that the keeper and responsibility of institutional justice sits with the CCO and the authors find that this same concept “is vital to building a reputation of organizational justice.”

Clarity of expectations. CCOs must communicate a clear message to employees so that employees will have “an understanding of organizational standards and are clear about expectations.”

Unethical conduct can remain hidden for a time but is likely to be discovered eventually, causing far more harm than if it were caught and corrected early. Psychological safety thus can help organizations respond and improve quickly instead of allowing misconduct and unethical behavior to fester and further degrade workplace psychological safety, thus triggering a vicious cycle.”

 Three key takeaways:

1. Without psychological safety, corporate culture will suffer.

2. When your CEO engages in illegal behavior, what is the impact on culture?

3. Use moral engagement, moral attentiveness, and organizational justice to foster an improved culture.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Categories
Compliance Into the Weeds

Compliance into the Weeds: OIG Says CCO Should be Independent

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more fully. Looking for some hard-hitting insights on sanctions compliance? Look no further than Compliance into the Weeds! In this episode, Tom and Matt take a deep dive into the recent OIG guidance for healthcare compliance professionals and healthcare compliance programs which notes that CCOs should be independent from the General Counsel’s Office.

The Office of Inspector General (OIG) has recently released guidelines that underscore the importance of independence for compliance officers in the healthcare sector. These guidelines, seen as a significant development in the field, stipulate that compliance should be separate from legal and finance departments, and outline the responsibilities of healthcare compliance officers.

Tom views this as a clear call for compliance officers to be independent and report directly to the CEO and the board. He suggests that this trend towards independence may extend beyond healthcare. Matt echoes this sentiment, highlighting the OIG’s strong endorsement of the independence of compliance officers. He believes this aligns with the emphasis on independence and autonomy that leading voices in the regulatory world have been advocating for. Join Tom Fox and Matt Kelly as they delve deeper into this topic in this episode of the Compliance into the Weeds podcast. 

Key Highlights:

  • The Importance of CCO Independence in Compliance Programs
  • The role of a healthcare CCO
  • Do you need a Law Degree to be a CCO in Healthcare Compliance
  • The Growing Significance of CCO Independence

Resources:

Matt’s blog post in Radical Compliance

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Compliance Through Culture: Day 11 – Psychological Safety in the Middle

Advancing ethical culture through psychological safety can be a powerful tool. But how can you determine the state of psychological safety in your organization? Once again using the article “Fostering Ethical Conduct Through Psychological Safety” as a starting point, “there are a number of things organizations can do to make it more likely that people will speak up when they observe unethical behaviors.” But one key is psychological safety, defined by co-author Edmondson as “a shared belief held by members of a team that the team is safe for interpersonal risk-taking” — or, put another way, that “we can say what we think” or “be ourselves around here.”

There is a non-siloed nature of psychological safety at the workplace. Ethics, risk management, legal and compliance functions, plus HR all share an interest in fostering such an environment. This mandates a cross-functional approach as an essential requirement of molding an organization’s culture to include psychological safety. The authors believe, “Managers throughout a company must become aware of the blind spots created by a psychologically unsafe environment, along with the associated risk of underreported misconduct.” They also caution that a formal program such as a reporting hotline “may capture only a fraction of the problematic behaviors that occur.” This leads the authors to posit that gauging psychological safety “may help companies determine whether misconduct is being reported and, in turn, enhance the effectiveness of their formal speak-up programs.”

The authors also confirmed a greater problem which is that “in a global context, psychological safety is not uniform across nations.” Survey respondents from “the Americas and Europe tended to score higher on psychological safety than respondents from Asia.” This suggests to the authors that “the potential effectiveness of tailoring interventions that promote speaking up in order to address the specific circumstances of different groups of employees.” Moreover, “global organizations that seek to build psychological safety must assess its various region-specific drivers and derailers to adjust their activities to specific seniorities and cultures.”

 Three key takeaways:

1. How can you determine the state of psychological safety in your organization?

2. Psychologically safety at the workplace is non-siloed.

3. Middle managers are critical.

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program Through Culture: Day 9 – Fostering Culture with Psychological Safety

How can you improve corporate culture through speaking up? In an MIT Sloan Management Review, Summer edition, entitled “Fostering Ethical Conduct Through Psychological Safety” authors Antoine Ferrère, Chris Rider, Baiba Renerte, and Amy Edmondson asked such questions as “How do organizations encourage people to speak up about ethical breaches, whether inadvertent or deliberate?” and “Why do some employees choose to remain silent when others report misconduct?” Additionally, they “analyzed the perceptions of those who report misconduct against those of “silent bystanders” to help “better understand both the drivers and derailers of speaking up — and revealed insights into how leaders and compliance officers can encourage employees to make such reports.’”

The authors believe today, “it is more essential than ever that when misconduct happens or difficult problems arise, there is a strong ethical climate for surfacing information so leaders can respond quickly and appropriately. An environment in which employees feel comfortable reporting such issues is also vital to preventing future misconduct.”

The authors believe that a “healthy organizational culture is one in which speaking up and listening go hand in hand, reinforcing ethical standards. If concerns are expressed, changes can be made promptly.” This is important because it moves from the detect prong to the prevent prong, which is by far the most important and effective prong in any compliance regime. Further ideas or innovations, rather than simply reporting untoward actions, can make a company more efficient and more profitable. This means a company can receive far more benefits than monetary fines or penalty avoidance if psychological safety exists.

 Three key takeaways:

  1. How a speak-up culture improves your culture.
  2. What is the role of psychological safety in improving culture?
  3. What is the role of externals in your corporate culture?

Do you want to improve your culture? How can you assess your culture and develop a strategy to improve it going forward? In this free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program Through Culture: Day 6 – Attributes of a Toxic Culture

Corporate culture is finally being acknowledged as a key ingredient in a successful business, particularly one that operates ethically and in compliance. But what are some indicia of good culture and more importantly what are some indicia of a toxic culture? A recent article in the MIT Sloan Management Review provided some guidance. In Why Every Leader Needs to Worry About Toxic Culture, the authors posited that by pinpointing the elements of toxic culture in a company, its leaders focus on addressing the issues that lead employees to disengage and quit. These ideas have significant importance for the compliance function as it navigates corporate culture, both in assessing and improving it.

Moreover, the Chief Compliance Officer and corporate compliance function were identified in the 2023 3 Evaluation of Corporate Compliance Programs as the keepers of institutional justice and institutional fairness. This means recognizing and then preventing a toxic culture from spreading and infecting your entire organization squarely in the compliance wheelhouse. The article lays out key red flags for every CCO and compliance professional to look for in assessing culture. Finally, for any company with a toxic culture, the chances are much greater to be defrauded by its own employees or to defraud others through bribery and corruption by violating such laws as the Foreign Corrupt Practices Act (FCPA).

The authors identify behaviors that they call “the Toxic Five attributes”, being “disrespectful, noninclusive, unethical, cutthroat, and abusive – poison corporate culture in the eyes of employees. While organizational culture can disappoint employees in many ways, these five elements have by far the largest negative impact on how employees rate their corporate culture and have contributed most to employee attrition throughout the Great Resignation.” As a CCO or compliance professional you need to be on the watch for them and take steps to remedy them if you see or hear about them.

 Three key takeaways:

1. Are the attributes of a toxic culture present in your organization?

2. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the compliance lead this effort.

3. Does your organization have abusive behavior?

Check the free webinar on the new tool, The Culture Audit with Tom Fox and Sam Silverstein on Tuesday, November 28, 12 CT. For more information and registration, click here.

Categories
Compliance Into the Weeds

Compliance into the Weeds – Remediation During an Enforcement Action

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode, Tom and Matt take a deep dive into the issue of how and whether you should remediate during an enforcement action.

The importance of early and continuous remediation of compliance issues cannot be overstated. It is a critical aspect of maintaining a healthy relationship with regulators and ensuring effective strategies are in place to address any uncovered issues. Tom firmly believes in the necessity of initiating the remediation process as early as possible, even during the investigation phase. He emphasizes the importance of regular communication with regulators and the potential risks of delaying remediation.

Matt echoes Fox’s sentiments. He highlights the confidence that early remediation brings to compliance officers and the increased likelihood of successful resolution. Join Tom Fox and Matt Kelly as they delve deeper into this topic in this episode of the Compliance into the Weeds podcast.

 Key Highlights:

  • Proactive Remediation for Effective Compliance Management
  • Navigating Personnel Matters During Remediation
  • Logical and Consistent Employee Discipline Compliance
  • Remediation Strategies for Confident Compliance Officers

 Resources:

Matt on Radical Compliance

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

GWIC Roundtable: The Importance and Challenges of Compliance in Corporate America

The compliance profession plays a crucial role in ensuring ethical practices and maintaining regulatory compliance within corporate America. In a recent episode of the Great Women in Compliance Podcast, Lisa Fine and Ellen Hunt, a former Chief Ethics and Compliance Officer, chief Audit Officer and Chief Privacy Officer, and currently Principal Consultant and Advisor with Spark Consulting;  hosted Gwen Hassan, Deputy Chief Compliance Officer at Unisys (and host of the award winning Hidden Traffic podcast) and Kim Yapchai, currently a board member of Direct Women, which is a nonprofit focused on promoting women to be public company board members and expert in a variety of corporate areas including ESG, corporate governance, M&A, compliance and Supply Chain. They discussed the importance and challenges of the compliance profession in today’s corporate landscape.

One of the key challenges highlighted by Yapchai is the struggle for recognition and resources within organizations. Compliance professionals often report to the General Counsel (GC) rather than the CEO, which can hinder their ability to have a seat at the table and influence decision-making processes. Additionally, limited access to data and budget constraints can further impede the effectiveness of compliance programs.

Yapchai see Compliance 1.0 as “being the police. Compliance 2.0, looking at culture and working with HR. Compliance 3.0 I think is really the type of ESG role that I had in my last role and reported to the CEO as part of the executive leadership team.” She believes this is another step in the compliance function being changed. It has moved to “to revenue protector, brand protector incorporating know and it is the people that drive everything. And all of this leads to better profits, it’s better risk management.”

To overcome these challenges, the speakers emphasize the need for compliance professionals to build key relationships, understand the nuances of the business, and effectively communicate the value of compliance programs. Hassan suggests that speaking the language of the business, using terms like return on investment (ROI), and showcasing the financial impact of compliance efforts can help gain traction and support from the C-suite and the board. By demonstrating the value of compliance in dollars, compliance professionals are more likely to capture the attention of business leaders who think in terms of profit margins and ROI.

The speakers also stress the importance of continuous growth and adaptation in the compliance profession. As the business landscape evolves, compliance professionals must stay abreast of new challenges, such as ESG (Environmental, Social, and Governance) and AI (Artificial Intelligence). They need to actively seek opportunities to expand their roles beyond traditional compliance functions and become revenue protectors and brand protectors. By incorporating culture and working closely with HR, compliance professionals can contribute to better risk management and overall profitability.

However, the speakers caution against complacency and the risk of devaluing the work of compliance professionals. Hassan believes that if the profession fails to grow and adapt, it could contribute to the moral decline of corporate America. Compliance professionals have a unique opportunity to shape the values and impact of organizations, not just in terms of financial success but also in making the world a better place for all stakeholders. By embracing a holistic view of what a company represents, compliance professionals can help drive positive change and ensure ethical practices.

Hassan went on to say she has ‘tempered optimism’ for the compliance profession. She believes that employees know what our intent and what we are trying to do. She notes that the compliance profession has “done herculean work in some particularly crazy times, especially over the last ten to 15 years.” Yapchai agreed and related that “when I started, the concept of a compliance officer and a compliance function was something that was brand new and really a heavy lift when talking to companies about compliance because it was almost unheard of to have a separate compliance department and a separate compliance team and report into the board.” In many ways compliance was seen as an  “offshoot of what the law department was already doing” but there has been much improvement in that view.  The status of the profession has been elevated and there are now colleges and law schools that are now teaching separate programs in compliance. This means that Gen Z and Millennials are studying compliance as a specific degree.

Creating a supportive community, or what the speakers refer to as a “Blue Zone,” is also crucial in combating the stress and loneliness that can come with the compliance profession. It helps people live longer and healthier, but the concept that you can create your own right with your surroundings and the way your daily habits and other things you can create your own. All of the speakers feel that it is important for ethics and compliance professionals to have their blue zone or their network or their support group by connecting with peers and sharing experiences, compliance professionals can find support and inspiration to navigate the challenges they face.”

In conclusion, the compliance profession in corporate America is of utmost importance in ensuring ethical practices and regulatory compliance. However, it faces challenges such as limited resources, lack of recognition, and the need to continuously adapt to a changing business landscape. By building relationships, understanding the business, and effectively communicating the value of compliance programs, compliance professionals can overcome these challenges and contribute to the success and ethical standing of their organizations.

Categories
Blog

SEC, Solar Winds and Compliance

The recent SEC lawsuit against SolarWinds Corp and its CISO, Tim Brown, following the 2020 data breach, has brought the issue of executive liability in cybersecurity disclosures to the forefront. This case sheds light on the culture of deception within SolarWinds, where lower-level employees struggled to communicate the severity of cybersecurity issues to management. The lawsuit raises important questions about the personal liability of senior executives for inaccurate risk disclosures and has potential implications for other industries.

The 2020 breach, orchestrated by Russian hackers, targeted SolarWinds’ software, Orion, and exposed highly sensitive information. The hackers gained access to SolarWinds and planted spyware into the Orion program. SolarWinds then distributed an update to its corporate customers, unknowingly spreading the Russian spyware. This allowed the hackers to gain access to the highest levels of the US government and major corporations.

The SEC’s lawsuit against SolarWinds and Tim Brown focuses on the poor disclosures about the company’s information security throughout 2018, 2019, and 2020. While SolarWinds publicly claimed to have good cybersecurity, internal communications revealed that employees were aware of the company’s cybersecurity issues and considered them a mess. This discrepancy between internal knowledge and external disclosures forms the basis of the SEC’s allegations.

The SEC complaint alleges that SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments, including a 2018 presentation prepared by a company engineer and shared internally, including with Brown, that SolarWinds’ remote access set-up was “not very secure” and that someone exploiting the vulnerability “can basically do whatever without us detecting it until it’s too late,” which could lead to “major reputation and financial loss” for SolarWinds. Similarly, as alleged in the SEC’s complaint, 2018 and 2019 presentations by Brown stated, respectively, that the “current state of security leaves us in a very vulnerable state for our critical assets” and that “[a]ccess and privilege to critical systems/data is inappropriate.”

The case raises important questions about the responsibility and liability of senior executives for misleading disclosures. In this instance, the focus is on the former CISO, Tim Brown, who is facing civil penalties and potential trial. The SEC is seeking to bar him from serving at publicly traded companies. However, the case also raises questions about the CEO’s potential liability. In SolarWinds’ case, the former CEO, Kevin Thompson, who did not have a cybersecurity background, may have relied on assurances from the CISO regarding the company’s cybersecurity risks and disclosures.

The issue of executive liability in cybersecurity disclosures is complex. Should senior executives be held accountable for inaccurate assurances provided by their subordinates, especially in areas where they may not have expertise? Security is a complex matter, and executives may rely on the expertise of others to make informed decisions. However, this case highlights the potential consequences of such reliance and the need for executives to ensure accurate and transparent disclosures.

The SEC’s lawsuit against SolarWinds and Tim Brown also raises broader questions about the liability of executives in charge of risk, such as compliance officers. If executives are given assurances that turn out to be incorrect, where does the liability lie? This case could have implications beyond the cybersecurity realm and may impact how executives approach risk disclosures in various industries.

Balancing the need for accurate risk disclosures with the challenges of understanding complex cybersecurity issues is a tradeoff that executives must navigate. The case highlights the importance of fostering a culture of transparency and effective communication within organizations. It also emphasizes the need for executives to stay informed and engaged in areas of risk, even if they do not have direct expertise.

Moving forward, organizations should consider implementing the NIST framework for cybersecurity to effectively defend against cyber threats. This framework provides a comprehensive approach to managing and mitigating cybersecurity risks. By following best practices and ensuring accurate risk disclosures, organizations can reduce the likelihood of facing legal action and protect their stakeholders.

In the SEC Press Release Gurbir S. Grewal, Director of the SEC’s Division of Enforcement said “We allege that, for years, SolarWinds and Brown ignored repeated red flags about SolarWinds’ cyber risks, which were well known throughout the company and led one of Brown’s subordinates to conclude: ‘We’re so far from being a security minded company. Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls environment, thereby depriving investors of accurate material information.” Finally,  “Today’s enforcement action not only charges SolarWinds and Brown for misleading the investing public and failing to protect the company’s ‘crown jewel’ assets, but also underscores our message to issuers: implement strong controls calibrated to your risk environments and level with investors about known concerns.”

In conclusion, the SEC’s lawsuit against SolarWinds and Tim Brown brings executive liability in cybersecurity disclosures into focus. The case highlights the importance of accurate and transparent risk disclosures and raises questions about the responsibility of senior executives. Executives must balance the need for accurate disclosures with the challenges of understanding complex cybersecurity issues. By fostering a culture of transparency and implementing best practices, organizations can mitigate risks and protect their stakeholders.

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program Through Culture: Day 3 – Compliance and Corporate Principles in Today’s World

For corporations, navigating the political landscape has become an increasingly difficult task. While being admonished to ‘stay in their lane’ by some, businesses are just like their stakeholders, impacted by the ever-changing political miasma. When this new reality is coupled with the new levels of transparency in companies, which are only amplified by social media, a company can be embroiled in public controversies with one or more stakeholder groups. As these situations occur, CCOs and compliance professionals will be called upon to help companies navigate this fraught process.

How can compliance help a company navigate through all of this? To make and implement the best strategic choices in this environment, leaders will have to

  1. develop principles to guide strategic choices,
  2. address ethical issues early on,
  3. consistently communicate and implement their choices,
  4. engage beyond the industry to shape the context and
  5. learn from mistakes to make better choices in the future.

This is a process that the corporate compliance function can facilitate. If you work through these steps, you should be able to prepare your organization for the next major shock.

 Three key takeaways:

1. Why a company can no longer simply ‘stay in its lane’.

2. Compliance should lead the way to develop robust principles to guide cultural choices.

3. Even in culture, continuous improvement is a mandate.