Tag: continuous monitoring

Categories
Blog

Transforming Culture: Part 5 – Ongoing Monitoring and Continuous Improvement of Culture

Boeing is not the first company to find itself amid a massive scandal. You can think of Siemens’ bribery and corruption scandal, the VW emissions-testing scandal, the Wells Fargo fraudulent accounts scandal, or any other myriad of corporate scandals where culture failed and created a toxic culture. The question for any organization in such a situation is how to transform its culture. Currently running on the Culture Crafters podcast on the Compliance Podcast Network is a 5–part of podcast series with myself and Sam Silverstein, the most trusted voice in America on accountability. (The Culture Audit™ is the sponsor of this blog post series.)

In this companion, 5-part blog post series, we have looked at how a company in the depths of such a toxic culture can begin to make a comeback by planning and taking concrete steps to turn around and rebuild its culture. In this concluding Part 5, we show why you must not simply stop after implementation but must monitor your culture continuously and work to improve it continuously. It is an ongoing work in progress, and you can always continue working on your corporate culture.

Ongoing monitoring is not something compliance professionals are unaware of or have never heard about. This concept must be used in your culture management strategy as well. You must assess how your culture management strategy is doing continuously. This is one of the power outcomes of The Culture Audit™ (the sponsor of this blog post series). Not only have you created a baseline of where your culture is at any point in time, but through ongoing use of the Culture Audit, you can measure your specific indices of culture on a go-forward or ongoing basis. You can then continually work to update as appropriate. If your organization needs greater trust, you can put further work into this through your speak-up culture.

Creating an organization’s speak-up culture is essential for fostering open communication, transparency, and employee trust. Such a culture encourages individuals to raise concerns, flag potential issues, and contribute to a safer and more accountable work environment. By prioritizing a speak-up culture, companies can proactively address challenges, prevent safety risks, and promote a culture of continuous improvement.

The significance of a speak-up culture must be balanced as a critical factor in ensuring organizational success and psychological safety. Silverstein emphasized the need for employees to feel safe, valued, and empowered to voice their opinions without fear of reprisal. He highlighted the role of trust and psychological safety in enabling individuals to speak up, noting that a culture that supports open communication leads to better decision-making processes and overall performance. The insights shared underscored the pivotal role of a speak-up culture in shaping a positive and proactive organizational environment.

Accountability in leadership is fundamental in setting the tone for organizational culture and fostering a sense of responsibility and integrity among team members. Leaders who demonstrate accountability model desired behaviors and create a culture where individuals take ownership of their actions and outcomes. By holding themselves and others accountable for their commitments and decisions, leaders cultivate a culture of trust, respect, and ethical conduct.

Leadership will always have a transformative impact on organizational dynamics. Emphasizing that accountability is a way of life rather than a mere task demonstrates leaders’ profound influence in shaping the values and norms within their teams. There must be consistency and fairness in holding individuals accountable. Leaders play a pivotal role in setting expectations and driving cultural change. The discussion underscores the critical role of leadership accountability in fostering a culture of integrity and excellence within organizations.

Changing organizational culture is a complex and multifaceted endeavor that requires a deliberate and strategic approach. Organizations seeking to shift their culture must assess the existing norms, values, and behaviors that shape their environment. By identifying areas for improvement and aligning cultural practices with desired outcomes, companies can embark on a journey of cultural transformation that enhances employee engagement, performance, and overall organizational success.

Companies can initiate meaningful change by defining and measuring the current culture, investing in training and education, and holding individuals accountable for upholding cultural values. You must align cultural initiatives with business objectives and ensure that cultural transformation efforts are embedded in every aspect of the organization. Organizations face challenges and opportunities when navigating cultural change, highlighting the critical role of leadership in driving lasting transformation.

The crucial role of leadership in shaping organizational culture provided valuable insights into the steps leaders can take to create a positive and thriving workplace environment. By prioritizing values, fostering open discussions about culture, and making data-driven decisions, organizations can pave the way for long-term success and employee well-being.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 9 – Continuous Monitoring and Continuous Improvement

Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward change in risk due to working locations, new risks in the form of geopolitical, supply chain, and export control, as well as increased risk due to social media, continue to impact compliance programs.  Your compliance program must be ready to respond to whatever those risks might be going forward.

Continuous improvement runs the gamut in a best practices compliance program, from risk assessments to policies and procedures to periodic testing and review.

Three key takeaways:

1. How have your company’s risks changed over the past year, and how will they change in 2024?

2. What is your process for continuous monitoring and improvement?

3. What sources of information do you use that come from outside your organization?

Categories
Blog

It’s The Great Pumpkin Charlie Brown – Lessons in Process Validation Through Continuous Monitoring

Halloween is almost upon us, and we celebrate the greatest Halloween cartoon in the history of the world, “It’s the Great Pumpkin, Charlie Brown,” which premiered in 1966. As usual, the story revolves around the Peanuts gang, who are preparing for Halloween. Linus writes his annual letter to the Great Pumpkin despite Charlie Brown’s disbelief, Snoopy’s laughter, Patty’s assurance that the Great Pumpkin is a fake, and even his sister Lucy’s violent threat to make her brother stop. On Halloween night, the gang goes trick-or-treating. On the way, they stop at the pumpkin patch to ridicule Linus for missing the festivities, just as he has done every year. Undeterred, Linus is convinced that the Great Pumpkin will come and even persuades Charlie Brown’s little sister, Sally, to remain with him to wait. At 4:00 AM the following day, Lucy wakes up and notices that Linus is not in his bed. She finds her brother asleep in the pumpkin patch, shivering. She brings him home and puts him to bed. Later, Charlie Brown and Linus are at a rock wall, commiserating about the previous night’s disappointments. Although Charlie Brown attempts to console his friend, admitting he has done stupid things, Linus angrily vows that the Great Pumpkin will come to the pumpkin patch next year.

The compliance lesson from Linus’ adventure is process validation. Unlike Santa Claus, whom we have been repeatedly told, “Yes, Virginia, there is a Santa Claus,” there has been no process validation for the Great Pumpkin. Linus faints when he thinks he sees the Great Pumpkin rising from his pumpkin patch; unfortunately, it is only Snoopy. In the compliance world, process validation comes through oversight. Two of the seven compliance elements in the 1992 US Sentencing Guidelines call for companies to monitor, audit, and respond quickly to misconduct allegations. The 2020 FCPA Resource Guide, 2nd edition, mandates ongoing monitoring to update and improve your compliance program continually. The Department of Justice’s 2020 Update to the Evaluation of Corporate Compliance Program made clear that monitoring your compliance program through reviewing data and looping it back into your system is the bare minimum for an effective compliance program.

Many companies fall short of effective monitoring. This can sometimes be attributed to the differences between monitoring and auditing. Monitoring is a commitment to reviewing and detecting compliance programs in real-time and reacting quickly to remediate them. A primary goal of monitoring is to identify and address gaps in your program on a regular and consistent basis. Auditing is a more limited review that targets a specific business component, region, or market sector during a particular timeframe to uncover and evaluate certain risks, mainly as seen in financial records. However, it would be best if you did not assume that because your company conducts audits, it is effectively monitoring. A robust program should include separate functions for auditing and monitoring. While unique in protocol, the two parts are related and can operate in tandem. Monitoring activities can sometimes lead to audits. For instance, if you notice a trend of suspicious payments in recent monitoring reports from Indonesia, it may be time to audit those operations to investigate the issue further.

Your company should establish a regular monitoring system to spot and address issues. To do effective monitoring, you need to use a consistent set of protocols, checks, and controls that are based on the risks your company faces to find and fix compliance issues regularly. To address this, your compliance team should check in routinely with local finance departments in your foreign offices to ask if they’ve noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries they manage. Additionally, the global compliance committee should meet or communicate as often as every month to discuss issues as they arise. These ongoing efforts demonstrate your company is serious about compliance.

I hope that you have the chance to watch It’s the Great Pumpkin, Charlie Brown again this year (even if it’s criminally behind the Apple Paywall). I did. When you watch, think about the compliance implications. Will anyone ever set a ‘second set of eyes’ on the Great Pumpkin? If not, will it ever be validated? I hope that if you are trick-or-treating tonight, you will be safe and dry.

Doug Cornelius Responds:

Are you trying to say that the Great Pumpkin is not real?

Just wait ’til next year, Tom Fox. You’ll see!

Next year, at this same time, I’ll find a real sincere pumpkin patch! And I’ll sit in that pumpkin patch until the Great Pumpkin appears. He’ll rise out of that pumpkin patch, and he’ll fly through the air with his bag of toys.

The Great Pumpkin will appear! And I’ll be waiting for him!

I’ll be there! I’ll sit in that pumpkin patch… and see the Great Pumpkin. Just wait and see, Tom Fox. I’ll see that Great Pumpkin.

I’ll see the Great Pumpkin!

Just wait, Tom Fox.

Categories
31 Days to More Effective Compliance Programs

Day 2 – Continuous Monitoring and Continuous Improvement

Continuous monitoring and improvement are two of the most important phrases for any compliance program. These twin concepts were perhaps the biggest modifications in the 2020 Update to the Evaluation of Corporate Compliance Programs. In 2021 and 2022, all companies’ risks changed as we moved from Working From Home to Return To Office and now a hybrid work model. Of course the great resignation has also played a part.These changes in our basic work location drove home perhaps the most prescient comment I heard during the pandemic, which was by Jed Gardner, who said, “We have moved from disaster recovery to business continuity to business as usual.” This means that risks will change in ways you may not see at speeds you do not anticipate. Your compliance program must be ready to respond to whatever those risks might be going forward.

In the 2020 Update, the DOJ began to address this from the compliance program perspective with several questions. “Is the risk assessment current and subject to periodic review? Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions? Has the periodic review led to updates in policies, procedures, and controls? Do these updates account for risks discovered through misconduct or other problems with the compliance program?”

The next area for continuous monitoring and improvement was an area of compliance that is not normally associated with those concepts, Policies, and Procedures. Here questions included “When was the last time your policies and procedures were updated? Perhaps more importantly, under the 2020 Update, what was your process for doing so? Was there any rigor around your process? Did that rigor include incorporating information and data collected through continuous monitoring, real-time monitoring, or continuous access to operational data and information across functions?”

The final area in the 2020 Update for consideration is called Continuous Improvement, Periodic Testing, and Review. The question included the following, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular risk areas are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based on lessons learned from its misconduct and/or other companies facing similar risks?”

Three key takeaways:

1. How has your company’s risks changed over the past year?
2. What is your process for continuous monitoring and improvement?
3. What sources of information do you use that come from outside your organization?

Categories
Innovation in Compliance

Corporate Case Management in the Era of the DoJ’s Monaco Memo: Episode 5 – Data Drives Prevention

Welcome to a special podcast series, Corporate Case Management in the Era of the DoJ’s Monaco Memo, sponsored by i-Sight Software Solutions. Over this five-part podcast series, I visit with Jakub Ficner, Director of Partnership Development at i-SIght. This series considers how the Monaco Doctrine and Monaco Memo have impacted compliance in several key areas. In this concluding Part 5, we consider how data and data analytics are even more critical after the Monaco Memo and how using data can drive prevention and detection.

Highlights include:

  • How does ongoing monitoring lead to continuous improvement, and how does it relate to investigations?
  • How your investigative protocol can supplement ongoing monitoring.
  • How the outlays for your investigative process are a critical step going forward.
  •  Employing root cause analysis, corrective actions, and preventative action recommendations can provide valuable data from a holistic perspective.

For more information, check out i-Sight here.

Categories
Greetings and Felicitations

Great Structures Week V: The Tacoma Narrows Bridge Failure and Preventing Failure in Your Compliance Program

Welcome to the Greetings and Felicitations, a podcast where I explore topics that might not seem directly related to compliance but influence our profession. In this special series, I consider many structural engineering concepts are apt descriptors for an anti-corruption compliance program. In this concluding episode 5, I consider the Tacoma Narrows Bridge failure and preventing failure in your compliance program. Highlights include:

  • Why and how did the Tacoma Narrows Bridge fail?
  • What are the key lessons it provides to compliance professionals?
  • Why are 3rd parties still the greatest risk to any compliance program?
  • What steps can you take to manage third parties most effectively?
  • Why is continuous monitoring key to managing risk?

Resources

 “Understanding the World’s Greatest Structures: Science and Innovation from Antiquity to Modernity”, taught by Professor Stephen Ressler from The Teaching Company.

Categories
Blog

Note Navy Seals Way: Moving from Continuous Monitoring to Continuous Improvement

Decision making is a critical skill for any Chief Compliance Officer (CCO) or compliance professional. Continuous monitoring and continuous improvement are now accepted as standard components of any table stakes compliance program. The Department of Justice (DOJ), in the 2020 Update to the Evaluation of Corporate Compliance Programs, made clear the need for continuous improvement in any compliance program. It stated quite succinctly, “One hallmark of an effective compliance program is its capacity to improve and evolve. The actual implementation of controls in practice will necessarily reveal areas of risk and potential adjustment. A company’s business changes over time, as do the environments in which it operates, the nature of its customers, the laws that govern its actions, and the applicable industry standards. Accordingly, prosecutors should consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.”

Indeed, the 2020 Update posed the following questions that the DOJ might ask a company under a Foreign Corrupt Practices Act (FCPA) investigation, “How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?”But one question not posed is around your decision-making process in when to move from continuous monitoring to continuous improvement. I was therefore interested in a recent FastCompany.com article, entitled “3 Steps Navy SEALs Use to Make Decisions”, by Stephanie Vozza. Vozza quotes former Navy SEAL and Chief Executive Officer (CEO) of ADS, Inc., Ryan Angold who said, “With so much information out there, a lot of people get analysis paralysis. You want to do your research and you want to access all the resources you have so you can make the right decision. But you can’t sit in analysis paralysis forever. Ultimately, there’s no 100% perfect decision.”

For her piece she also interviewed former Navy and current VMWare Chief Digital Transformation Officer Mike Hayes and author of the book, Never Enough: A Navy SEAL Commander on Living a Life of Excellence, Agility, and Meaning, who laid out a framework he used as an active SEAL for decision making.

  1. Gather Input

When you are a CCO or compliance professional in a corporate compliance function, you most probably have created experiences from which you can draw. Angold noted, “The requirement in SEAL teams is that you have you’ve gone through multiple different scenarios, you’ve trained for the most extreme environment, the most challenging environment, the worst-case scenarios. These reference points are helpful. You can say, ‘Okay, we’ve seen something like this before.’ Maybe this isn’t the exact scenario—it never is. But you’ve learned how the team works and can make quick decisions.”

Both Jonathan’s from the award-winning Everything Compliance gang, Jonathan Armstrong and Jonathan Marks, talk about not simply crisis and scenario planning but practice as well. Such practice not only gives you the muscle memory of what to do when a true crisis appears but also provide the types of experiences that Angold references that the SEALs then use in missions.

Hayes added that you should listen to difference voices or inputs, noting, “Too often, we tend to seek out like-minded input. Artists tend to hire artists and engineers hire engineers. By getting input from people who don’t think like us and by having a culture that celebrates differences and raising other ideas, you help people be comfortable saying things like, ‘Hey, sir, I don’t think that’s a great idea. Here’s how I would do it.’ That framework enables the best possible decisions.” Note that Hayes’ remarks also illuminate the importance and benefits of a true “Speak-Up Culture”.

  1. Decide When to Decide

 Most interestingly, the first thing you have to determine is when to make your decision. Hayes said, “The first decision is when to make your decision. That’s the thing that most people get wrong.” Obviously in combat your decision-making window can be quite short, but the same principle applies in the corporate world. Here Hayes noted, “At some point, the value of those extra inputs in your input streams costs more than the time associated with getting more inputs. At that inflection point is when you want to make your decision. You start losing value by waiting longer.”

But this point is where experience can become more paramount. In the corporate compliance world, you will likely get information, which is both quantitative and qualitative, particularly through continuous monitoring. Do not become paralyzed at this point, and you can rely on your gut or, as Hayes said, “there are other times where you need to operate in instinct. Instinct is really a set of experiences that you can’t quite crystallize, but that you extract logic from.”

  1. Be Willing (and ready) to Course Correct

Here a key CCO and compliance professional soft skill, that of humility, both “intellectual and real will help you get to the right decision.” Do not let your ego get in the way or start considering your sunk costs. You may garner new information which gives new input. Even John Maynard Keynes said, “When my information changes, I alter my conclusions. What do you do, sir?”

Hayes said this is “the ultimate sign of leadership because it’s a sign of comfort in your own skin and not needing to look good in front of an organization. Instead, you’re putting the organization before self and doing the right thing.” Angold phrased it as “It takes a lot of humility for someone to be able to recognize it was the wrong call,” he says. “That’s where the communication is important and having that transparency with your team. You can gain a lot of additional trust from your team, when you acknowledge a wrong decision.”

Continuous improvement through continuous monitoring or other similar techniques will help keep your compliance program abreast of any changes in your business model’s compliance risks and allow growth based upon new and updated best practices specified by regulators. A compliance program is in many ways a continuously evolving organism, just as your company is. You need to build in a way to keep pace with both market and regulatory changes to have a truly effective anti-corruption compliance program. By using this three-step approach, you can best determine how to move from the monitoring to the improvement phase.

Categories
Everything Compliance

Episode 94, the National Archives Edition


Welcome to the only roundtable podcast in compliance. The entire gang was also recently honored by W3 as a top talk show in podcasting. In this episode, we have the full gang of Jonathan Marks, Karen Woody, Jonathan Armstrong, Tom Fox, Matt Kelly and Jay Rosen. We discuss a potpourri of issues. We conclude with our fan favorite Shout Outs and Rants.

  1. Karen Woody reviews the recent HeadSpin SEC enforcement action, explaining how the SEC has jurisdiction over a private company, the significance of an enforcement action with no fine or penalty and the corporate governance issues involved. Karen shouts out to the Super Bowl Halftime show for throwing love on 90s music and musical stars.
  1. Jay Rosen discusses the recently released Commission on Combatting Synthetic Opioid Trafficking Report. Rosen shouts out to celebrity chef Jose Andreas for creating the Gazpacho Police in the 1990s long before Marjorie Green Taylor accused Nancy Pelosi of doing so and for inviting Rep. Taylor to join, provided she is vaccinated and wears a mask to the restaurant.
  1. Matt Kelly looks at the Joe Rogan and Spotify imbroglio, focusing the attempts of Spotify CEO Daniel Ek to focus the spotlight on Rogan and not Spotify. Kelly shouts out to that unknown US criminal enforcement agency, the National Archives which raided Mar-A-Lago where the former President had purloined some 15 boxes of Presidential papers and materials. He also gives a minor shout out to New York Times columnist Maggie Haberman who in an upcoming book reported the former President flushed documents down the toilets at the White House.
  1. Jonathan Marks discusses continuous controls monitoring and continuous auditing as best practices for compliance, risk management and fraud prevention programs. Marks shouts out to the Philadelphia 76ers for getting rid of Ben Simmons who refused to play for them. He implores Simmons to get a new agent for his disastrous handling of the entire situation.
  1. Jonathan Armstrong discusses the civil verdict for HP in its case against Autonomy and the Extradition Order delivered by the Home Secretary for Mike Lynch to go to America to stand for a US criminal trial. Armstrong shouts out to Queen Elizabeth II for her 70-year reign on the English throne.
  1. Tom Fox has a melancholy shout out to the University of Michigan School of Law and greater legal education profession, which lost two stalwart professors recently; Yale Kamisar, Father of Miranda and Terrance Sandalow, former Dean of the Law School. 

The members of the Everything Compliance are:

  • Jay Rosen– Jay is Vice President, Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com
  • Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu
  • Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com
  • Jonathan Armstrong –is our UK colleague, who is an experienced data privacy/data protection lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com
  • Jonathan Marks is Partner, Firm Practice Leader – Global Forensic, Compliance & Integrity Services at Baker Tilly. Marks can be reached at marks@bakertilly.com

The host and producer, ranter (and sometime panelist) of Everything Compliance is Tom Fox the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

Categories
31 Days to More Effective Compliance Programs

Day 24 | Updates and feedback

One of the critical elements found in the 2020 Update is the need to use the information you obtain, whether through risk assessment, root cause analysis, investigation, hotline report or any other manner to remediate the situation which allowed it to arise. Your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks, and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with local finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries in which they manage. These ongoing efforts demonstrate that your company is serious about compliance.
It is a function of the CCO to reinforce the vision and goals of the compliance function, where assessment and updating are critical to an ongoing best practices compliance program. If you follow this protocol, you will put a mechanism in place to demonstrate your company’s commitment to compliance by following through on intentions as set forth in your strategic plan. What should you do with this information? Put a strategic plan in place ready to implement your findings of continuous improvement, by using the following:

  • Review the goals of the strategic plan. This requires that you arrange a time for the CCO and team to review the goals of the Strategic Plan, which the CCO should lead to determine how this goal in the Plan measures up to its implementation in your company.
  • Design an execution plan. The KISS method (Keep it Simple Sir) is the best to move forward. This would suggest that for each compliance goal, there should be a simple and straight forward plan to ensure that the goal in question is being addressed.
  • Put accountabilities in place. In any plan of execution, there must be accountabilities attached to them. This requires the CCO or other senior compliance department representatives to put these in place and then mandate a report requirement on how the task assigned is being achieved.
  • Schedule the next review of the plan. There should be a regular review of the process. It allows any problems which may arise to be detected and corrected more quickly than if meetings are held at a less frequent basis.

Continuous monitoring is a key step but it is only the first step. It is not simply that you tested your compliance program but that you did something with the information you obtained to improve your program.
Three key takeaways:

  1. Innovation can come through a new way to think about and use data going forward.
  2. Have a plan in place to use the information garnered in your monitoring incorporated back into your compliance program.
  3. Always remember that Document Document Document is critical if the regulators come knocking.
Categories
31 Days to More Effective Compliance Programs

Day 2 | Continuous Monitoring and Continuous Improvement


I want to next focus specifically on the tactical steps of moving towards both continuous monitoring and continuous improvement of your compliance program. These twin concepts are perhaps the biggest modifications in the 2020 Update. The changes began in Section 1- Risk Assessments. The question-by-question analysis begins with “Is the periodic review limited to a “snapshot” in time or based upon continuous access to operational data and information across functions?” Do you have access to continuous and real time transactional data at your organization? How about across silos within your organization. Most likely the answer to both is “no”. This means you no longer have a best practices compliance program at this point in time. How can you garner such information?
While there is only one question in the Lessons Learned section, it is a compound question. It not only inquiries about data you may have obtained through your own work but also from other company’s in your industry operating in the same geo-region. Without commenting on the potential anti-trust aspects of this issue, if there is public source information available to you (and there always is), how are you using this information in your compliance regime. But this can be simply having your fully operationalized employee base keeping their eyes and ears open at trade show or any other gatherings of industry employee.
The next area for continuous monitoring and continuous improvement was in an area of compliance which is not normally associated with those concepts, Policies and Procedures. The final area in the 2020 Update for consideration is appropriate called Continuous Improvement, Periodic Testing and Review and is found in the subsection monikered Evolving Updates. It reads:
How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Has the company undertaken a gap analysis to determine if particular areas of risk are not sufficiently addressed in its policies, controls, or training? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries? Does the company review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks?
Similar to the language under Risk Assessment, this compound question considers the adaptation of a compliance program from your own lessons learned but also from other companies. The distinction now is that phrase is “other companies facing similar risks”? Think about how this language would apply to any company operating in China, West Africa or any other high-risk region in the globe. I would interpret this to mean every Chief Compliance Officer (CCO) and compliance practitioner needs to stay abreast of international anti-corruption enforcement actions where your company may be doing business.
Three key takeaways:

  1. What is your process for continuous monitoring?
  2. What is your process for continuous Improvement?
  3. What source of information do you use that are outside your organization?