The Trump Administration has suspended FCPA enforcement for the foreseeable future. What does that mean for compliance professionals? Hui Chen has suggested that this is an opportunity for compliance, but to do so, “It’s time to up your game . . . Instead of selling insurance for FCPA enforcement, become leaders that help your organizations perform.” Based on this challenge by perhaps the most imminent compliance commentator around, this week I devoted all my blog posts to ways compliance professionals can indeed up their collective game. Today, I want to end by laying out a Roadmap for you to use going forward. LRN Corporation laid it out in its Ethics and Compliance Program Effectiveness Report (Effectiveness Report).
The report details four key findings symptomatic of an operationalized compliance program. Susan Divers, then Senior Advisor at LRN and now an Advisor at Ethena, noted the overarching theme is that ethics and compliance:
… programs centered on values are more effective than ones that aren’t. A values-based approach toward shaping culture emphasizes and sets expectations, not just about what can and cannot be done according to rules, but what should and should not be done in alignment with core beliefs. In rules-based environments, everyone’s job is to do the next thing right—to act correctly. In values-based environments, in contrast, everyone’s job is to do the next right thing—to act morally.
It is this drive to burn compliance into the DNA of an organization that fully operationalizes compliance. Think of any recent scandal, Boeing, Wells Fargo, Uber, Facebook, or you name the scandal, where if an employee had done the right thing instead of the illegal action, how much better off a company would have been? The four findings were:
The most effective E&C programs are embedded in business operations. Divers pointed out that a company must have thinkers, compliance, and values as part of its brand.” By doing so, each level in a company will understand its role from now on, from the Board of Directors, senior management, middle management, and the employee base. The company will train, develop, and promote an ethics and compliance program at each level. Divers provided an insightful example:
If I were to use one word to characterize all of them together, it would be holistic. The first one is embedding your E&C programs in your business ops. One big piece of that is your brand. For example, Volkswagen used to have a fantastic brand. When you thought of Volkswagen, you thought of basically a green car and one that was well engineered. Now, it’s a massive fraud. One headline I saw called it Hoaxwagen.
The most successful E&C programs use a variety of channels to convert guidance into practice. An effective compliance program will continuously communicate the corporate E&C values through multiple ongoing channels throughout the company. This speaks not only to upward and downward communications within an organization but also to inbound and outbound to the company. But more than simply saying there should be communication, the Effectiveness Report also assesses how communications occur through inquiring into the clearness and conciseness of messages and whether an organization uses more effective communication techniques such as shorter, more frequent training models or facilitated workshops as opposed to rote one-hour lectures from lawyers.
Communications can be made in other, more subtle manners. Consider the actual behaviors that the conduct shows. Divers said that at LRN:
We’re not so fond of the tone at the top here. We’re fonder of actions at the top because tone can be one thing, and actions are another. Whether managers’ ethical behavior counts regarding promotion and bonuses is where the rubber meets the road in many places, and that makes a huge difference. Another aspect of that is making middle managers accountable for ethics and compliance in their business, and the good programs coach people in that aspect. Those are some key aspects of how you embed it in business ops.
High-performing programs proactively convert regulatory guidance into practice. This was not often discussed enough as many compliance practitioners struggle to convert DOJ pronouncements, comments, or lessons learned from FCPA enforcement actions into practical guidance. As the Effectiveness Report notes, “The most effective programs internalize such guidance and continuously improve.” Here, one might consider an example torn from the headlines: when the Walmart corruption scandal in Mexico broke, I called one CCO the next day who told me he had already put a PowerPoint presentation in front of his senior management about the perils of finding your corporate name splashed across the front page of the New York Times alleging your organization of bribery and corruption.
Divers considered this finding from another perspective. She stated:
You have to look for the actual challenge the people view in the company, whether that’s sales force or other disciplines. There are many different and positive ways, not just negative ones. One of the things we did was that we didn’t just tell people that serious actions meant this; we looked at actual business cases where people had done the right thing and made the right choices to comply with regulations, and that’s very powerful for modeling. Another aspect of that is how you embed your Code of Conduct. Do you just put it on the website and say, “Great, here it is. Read it,” or do you have a discussion? Those are more effective.
High-performing programs spread their impact broadly, recognizing that the entire organization needs to be engaged in ethics. This finding considers whether an organization has moved away from a “silo-based approach to ethics and compliance.” It did so by reviewing how the different corporate functions work as catalysts for imbuing your organization’s values in their specific corporate discipline. Here, Divers related, “High-performing programs aren’t sitting in a closet somewhere; they are only visited when there’s an ethics issue. High-performing programs are out there. They work across the corporation with human resources, internal audit, legal, and even sales and marketing, as well as finance and accounting, to ensure that ethics are a part and parcel of business operations.”
We have considered a variety of compliance innovations. I have often said that a compliance program must be strengthened to meet new or updated risks, opportunities, or regulations. Innovation is one of the best ways to boost it. Finally, and perhaps most importantly, as a compliance practitioner, remember you are only limited by your imagination. As Hui Chen noted, this is a great opportunity for compliance.
