I learned in my undergraduate studies in criminal justice that the most successful deterrents to unlawful behavior are the likelihood of getting caught, the certainty of punishment, and the swiftness of the punishment. In 30 years, that has not changed, whether it involves street crime, white-collar crime, regulatory compliance, or compliance with any other laws, rules, or policies (even Mom’s rule to not skip school!).
In recent decades, we seem to hear more than ever about corporate wrongdoing. Is that because of the continued expansion of media sources and people’s constant connection to those sources? Perhaps. The better question, which is the focus of this article and should be the focus of every company, is how to avoid being the next headline.
Leaders in many corporate organizations, especially smaller companies (defined by the U.S. Federal Sentencing Guidelines as any company with less than 200 employees), lead with a misconception that corporate compliance and ethics training is not a concern for them. They take the position, “I’m a good, law-abiding person, so is my leadership team, and we are surrounded by people just like us. We hired them and we don’t hire bad people.”
The truth is, no company is immune from a bad actor or actors. Wrongdoing can happen at any company, at any time, and very often is led by the person or persons you’d least expect. It could begin as something small, and presumably innocent – recreating a document to cover up an error, “borrowing” a small amount of money until payday, overreporting income to help a customer in need of a loan, and the list goes on. So often it’s these little beginnings that spiral into larger and larger deceit, which becomes harder and harder to conceal, and inevitably results in publicity that the company just does not need. And the publicity is just the beginning. More severe repercussions are the amount of money that is spent to remediate what has occurred and the very real possibility of criminal charges and/or a civil lawsuit.
The first step for every company, regardless of size, is to have a culture of compliance and the highest ethics, from top to bottom. Just having the words on paper or in speeches is not enough; it must be ingrained in each and every owner, manager and employee. It must be real, part of the company’s soul and how the company does business. Remember, the goal is to avoid and prevent compliance concerns, rather than having to react to them when they occur. Additional benefits of good corporate compliance are a better functioning organization and consumer and investor confidence.
How does a company get there? I wish I could tell you that it’s just about hiring and retaining great people, but it’s not. From years of being in the workforce, we all know that there is only so much to be learned about a person in the hiring process. I would also guess that everyone reading this has had an instance where a coworker, someone deeply respected for their work skills and general human goodness, has engaged in some not-so-good behavior. So while a company can, and certainly should, have best practices for hiring and retention in place, no company can rely only on hiring or retention to ensure corporate compliance and high ethics throughout the company.
The 2016 Summer Olympics are now in the history books, and they were once again filled with many inspirational stories. Zahra Nemati, from Iran, who was a black belt taekwondo competitor until she was paralyzed in a car accident in 2003, competed in archery in Rio. U.S. runner Lopez Lomong was abducted at age 6, escaped from a Sudanese prison and spent 10 years in a refugee camp before coming to the U.S. in 2001 (he was later reunited with his mother, and in 2009 brought his younger brothers to the U.S.). And the Refugee Olympic Team, made up of 10 athletes who participated in various events throughout the Olympics, showed the world that there is hope and opportunity for refugees. In reading about these athletes, what came to my mind was how they each had to thoughtfully craft and implement a plan to get to and compete in the 2016 Summer Olympic Games. It’s that kind of tenacity, heart and soul that companies need to put into crafting and implementing a compliance program.
Companies must conduct a thorough compliance audit to develop customized policies and practices for the company. Those policies and practices must be uniformly enforced at all levels and become the bedrock of the company. Preferably, a third-party vendor will be engaged to assist key persons at all levels of the company with the compliance audit and the development of compliance policies and practices. We all know that an honest and unbiased eye is the best way to ensure that the hardest questions will be asked and the most difficult situations explored. If a company is simply going to download another company’s code of conduct or policies from the Internet, that company may be better off not starting down the road to crafting and implementing a corporate compliance program.
While some facets of compliance will be the same or similar for all businesses, each industry has its own risks and standards to consider. For example, automobile dealers are heavily regulated, both by state and federal agencies. So is the oil and gas industry. Certainly, an oil and gas company would not simply want to change the names on an automobile dealer’s compliance documents and implement those. Similarly, the compliance program for an automobile dealer with one dealership will be much different than one for a dealer with 20 dealerships. Establishing and implementing a compliance program takes time and thought; there is no one size fits all.
Speaking of time, for internal individuals engaged in crafting and implementing a compliance program, this assignment cannot just be an additional task piled onto their already existing responsibilities. An honest assessment of how much time will be devoted to this process must be made, and the individuals tasked with assisting in crafting and implementing a compliance program must be freed of other responsibilities so they can devote sufficient time and resources to the compliance effort. Doing otherwise will either result in the compliance taking a backseat to regular work or being done at a mediocre level.
In the implementation phase, providing employees with written resources and training are key. Ongoing training is also recommended. And, at least annually, but in some instances maybe more frequently (quarterly, monthly, weekly, daily) a company must ask, “What has happened that requires new standards?” This could be new laws or regulations becoming effective, a recent court decision, or some other technology concern that has erupted.
Companies should also consider having outside counsel involved in the process. There will be many sensitive things discussed throughout the brainstorming and drafting sessions, and even in implementation. Keeping outside counsel in the room and on communications will assist in keeping these discussions and draft documents protected by attorney-client privilege.
I always hope that the main impetus for crafting and implementing a corporate compliance program is that a company genuinely cares about and has a goal of high ethics and complete compliance. What I know is that having a robust compliance program in place and being enforced serves as a deterrent to instances of noncompliance. Additionally, a compliance program can serve to mitigate penalties in the event of a noncompliance event. The U.S. Federal Sentencing Guidelines, which are the largest influence on the design and implementation of compliance programs, allow for penalty mitigation if a company’s corporate compliance program meets the following thresholds:
1. Establish compliance standards and procedures to detect criminal conduct.
2. Have high-level management and oversight of the program.
3. Opt for responsible authority delegation.
4. Take steps to communicate standards and procedures.
5. Monitor and audit the evaluation practices to achieve compliance and ensure program sufficiency.
6. Provide for discipline, incentives and enforcement actions.
7. Take organizational responses to misconduct that are aimed at preventing future misconduct.
Whatever is a victory for your company, to really win in this game, your company’s culture, planning, implementation, ongoing review and attention to compliance are key. As my high school softball coach told me repeatedly, whether I was batting or fielding, don’t take your eye off the ball.
Published September 1, 2016.
