Decision making is a critical skill for any Chief Compliance Officer (CCO) or compliance professional. Continuous monitoring and continuous improvement are now accepted as standard components of any table stakes compliance program. The Department of Justice (DOJ), in the 2020 Update to the Evaluation of Corporate Compliance Programs, made clear the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”
Indeed, the 2020 Update posed the following questions that the DOJ might ask a company under a Foreign Corrupt Practices Act (FCPA) investigation, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?”But one question not posed is around your decision-making process in when to move from continuous monitoring to continuous improvement. I was therefore interested in a recent FastCompany.com article, entitled “3 Steps Navy SEALs Use to Make Decisions”, by Stephanie Vozza. Vozza quotes former Navy SEAL and Chief Executive Officer (CEO) of ADS, Inc., Ryan Angold who said, “With so much information out there, a lot of people get analysis paralysis. You want to do your research and you want to access all the resources you have so you can make the right decision. But you can’t sit in analysis paralysis forever. Ultimately, there’s no 100% perfect decision.”
For her piece she also interviewed former Navy and current VMWare Chief Digital Transformation Officer Mike Hayes and author of the book, Never Enough: A Navy SEAL Commander on Living a Life of Excellence, Agility, and Meaning, who laid out a framework he used as an active SEAL for decision making.
- Gather Input
When you are a CCO or compliance professional in a corporate compliance function, you most probably have created experiences from which you can draw. Angold noted, “The requirement in SEAL teams is that you have you’ve gone through multiple different scenarios, you’ve trained for the most extreme environment, the most challenging environment, the worst-case scenarios. These reference points are helpful. You can say, ‘Okay, we’ve seen something like this before.’ Maybe this isn’t the exact scenario—it never is. But you’ve learned how the team works and can make quick decisions.”
Both Jonathan’s from the award-winning Everything Compliance gang, Jonathan Armstrong and Jonathan Marks, talk about not simply crisis and scenario planning but practice as well. Such practice not only gives you the muscle memory of what to do when a true crisis appears but also provide the types of experiences that Angold references that the SEALs then use in missions.
Hayes added that you should listen to difference voices or inputs, noting, “Too often, we tend to seek out like-minded input. Artists tend to hire artists and engineers hire engineers. By getting input from people who don’t think like us and by having a culture that celebrates differences and raising other ideas, you help people be comfortable saying things like, ‘Hey, sir, I don’t think that’s a great idea. Here’s how I would do it.’ That framework enables the best possible decisions.” Note that Hayes’ remarks also illuminate the importance and benefits of a true “Speak-Up Culture”.
- Decide When to Decide
Most interestingly, the first thing you have to determine is when to make your decision. Hayes said, “The first decision is when to make your decision. That’s the thing that most people get wrong.” Obviously in combat your decision-making window can be quite short, but the same principle applies in the corporate world. Here Hayes noted, “At some point, the value of those extra inputs in your input streams costs more than the time associated with getting more inputs. At that inflection point is when you want to make your decision. You start losing value by waiting longer.”
But this point is where experience can become more paramount. In the corporate compliance world, you will likely get information, which is both quantitative and qualitative, particularly through continuous monitoring. Do not become paralyzed at this point, and you can rely on your gut or, as Hayes said, “there are other times where you need to operate in instinct. Instinct is really a set of experiences that you can’t quite crystallize, but that you extract logic from.”
- Be Willing (and ready) to Course Correct
Here a key CCO and compliance professional soft skill, that of humility, both “intellectual and real will help you get to the right decision.” Do not let your ego get in the way or start considering your sunk costs. You may garner new information which gives new input. Even John Maynard Keynes said, “When my information changes, I alter my conclusions. What do you do, sir?”
Hayes said this is “the ultimate sign of leadership because it’s a sign of comfort in your own skin and not needing to look good in front of an organization. Instead, you’re putting the organization before self and doing the right thing.” Angold phrased it as “It takes a lot of humility for someone to be able to recognize it was the wrong call,” he says. “That’s where the communication is important and having that transparency with your team. You can gain a lot of additional trust from your team, when you acknowledge a wrong decision.”
Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program. By using this three-step approach, you can best determine how to move from the monitoring to the improvement phase.
