Press

Compliance Pipeline: The Ethical Side Of Compliance

Doing the right thing when no one is looking can be the most important aspect of self-governance.
By Shari Weiss Compliance Pipeline
July 8, 2005

Do corporate ethics programs make a difference? In a business world reflected in the media as a place where the rich get richer - and sometimes get prosecuted in the process - and where whistleblowers are vilified as tattletales, how does a company promote the ideal and the practice of "doing the right thing"? Can ethical behavior be legislated? Can it be taught?

Many legislators, lawyers, human resource professionals, and others believe that acting in an ethical manner, i.e., "doing the right thing when no one is looking," is, to a great extent, a function of understanding the possibility of how one's day-to-day dealings can negatively impact other individuals, their own organization, and other corporate entities, as well (see case study: Developing An Ethical Company).

And now federal laws mandate ethics and code-of-conduct training, specifically the 2004 Federal Sentencing Guidelines, which require both public and private companies to adopt comprehensive ethics and compliance programs, and to train everyone on the fundamental components of those programs.

The new guidelines make clear that "criminal liability can attach to an organization whenever an employee of the organization commits an act within the apparent scope of his or her employment, even if the employee acted directly contrary to company policy and instructions," according to Paula Desio, Deputy General Counsel, US Sentencing Commission in her article, "An Overview of the Organizational Guidelines."

The guidelines not only make clear that organizations can be held liable for their employees' illegal actions, they also provide a strong incentive for employers to take proactive action to prevent unethical and illegal conduct, according to Michael W. Johnson, a managing director of Brightline Compliance LLC in Washington, DC. Brightline Compliance provides online and instructor-led training on workplace ethics, preventing workplace harassment, conducting internal investigations, and other employment law topics.

"The good news is that organizations that can show they have instituted an effective ethics and compliance program - including an effective training program - can greatly reduce the potential fines and other punishment that they might face," Johnson says. "Conversely, the absence of an effective compliance and ethics program may be used to increase the punishment the organization receives."

The guidelines emphasize that this program cannot be merely set out on paper, but must be communicated to and utilized by employees within an organization, according to Johnson. Section 8B2.1(b)(4)(A) of the 2004 Federal Sentencing Guidelines specifically states: "The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program to [all personnel] by conducting effective training programs and otherwise disseminating information appropriate to such individuals' respective roles and responsibilities."

Companies must do more than just provide one-time training sessions, according to Johnson. "The guidelines state that small organizations (defined as those with fewer than 200 employees) may provide training through informal meetings with staff members, as long as those trainings still effectively communicate the organization's compliance and ethics program and procedures," she says. "However, organizations with 200 or more employees should provide more formally planned and implemented training programs, according to Commentary to the Guidelines."

In an environment where there is no industry standard approach to cultivating ethical corporate cultures, companies seek to learn from one another, share best practices and benchmark processes against peers and industry leaders, according to Tony Miller, executive vice president of LRN, a provider of governance, ethics and compliance management solutions. "Ethics is an area of business where competitive advantage does not apply," he says. "While companies need to tailor courses to the specific needs of their employees, they often seek a best practice approach to building education curriculums. Generally, laws and standards of what is considered ethical workplace behavior are common across companies and industries."

LRN works with more than 175 of the world's largest companies, including DuPont, The Dow Chemical Company, Pfizer, Johnson & Johnson, and Procter & Gamble in the development and implementation of comprehensive and effective ethics and compliance programs. Through the LRN Legal Compliance and Ethics Center, a Web-based online ethics and compliance education solution, companies can access more than 200 courses on a range of legal and ethical topics that inform employees about the corporation policies, values and regulatory requirements that govern their day-to-day decision-making. LRN also develops custom courses that meet unique compliance and ethical requirements of customers.

"Education is about skill building, development, and enrichment, so there is a personal quality; the employee is getting a personal benefit that can be applied in a broader context, not just related to his or her particular job," Miller says. "We believe that companies create and maintain an ethical culture through sensitivity and awareness of underlying laws and their intent. With greater sensitivity and awareness, people will modify their behavior. Most people think they are ethical. We are moving away from 'being ethical' to determining what ethical action is. Training can influence behaviors."

Miller pointed to careful communication as a huge source of concern these days. "E-mail must be thoughtfully crafted, and people have to understand what kind of effect it can have on the receiver," he says. "Often times, people will write a top-of-mind, quick response, not necessarily taking into consideration how a recipient will respond."

He also instructed that people need to be aware that with this [e-mail] technology, once you hit "Send," you cannot recover the e-mail or delete it, nor control who it is forwarded to. "Inevitably being thoughtful about your e-mail transcends to other forms of communication both on and off the job."

LRN offers the following 10 Steps to Fostering a More Ethical and Compliant Culture:

1. Reinforce/verify compliance via a Code of Conduct
2. Communicate appropriate "Tone At the Top"
3. Market program internally and make it culturally relevant
4. Assess key risks and map risks to employees
5. Conduct ongoing employee education
6. Certify employee attestation
7. Reward adherence and compliance to "letter and spirit'"
8. Promote self-reporting channels and ensure controls for rapid detection
9. Conduct compliance audits and benchmark results against best practices among peers and across industries
10. Solicit feedback from workforce and refine program moving forward

"One of the biggest challenges impeding the development of ethical corporate cultures is the incentive and reward structures set up by today's companies," Miller says. "Too often substantial bonuses are tied to earnings targets, which are easy to measure, while the ability to foster an open culture where employees are encouraged to use a help line is not so easy to assess. This type of behavior needs to be factored into the performance appraisal process, and people need to be rewarded."

The Effectiveness Of Hot Lines
Hot lines can be very effective as an early warning system for a company, but it is not as simple as putting a phone on a desk, according to Keith Halasy, director of marketing at EthicsPoint, a company that provides a range of corporate governance services from hotline reporting to training to case management systems. "We found that people were rushing to get reporting systems in place after SOX, he says. "The question comes down to how effective is your system to deliver on your objectives. It was easy to meet the letter of the law by just putting in a line on someone's desk, but now that managers have had a chance to digest these systems, they understand the challenges, beginning with employee trust of the voice on the other end of the line."

"This is critical information, like personal information or a company's dirty laundry, and must be kept highly secure," Halasy says. "Managing the process is extremely critical. Reports must be handled on a timely basis because some cases could be extremely urgent or they could involve global problems."

Halasy also says that the perception of whistle blowing as tattletale behavior needs to change. "There are a number of cases where whistleblowers are held up as champions of the organization," he says. "They are acting both for their own individual safety and out of concern for the organization, as well."

But ethical dilemmas often involve job and career threatening decisions. "When you look at ethics on an organization-wide basis, you are talking about specific decisions by a number of individuals," Halasy says. "Wrong decisions on top often cascade down the chain. When people are making decisions, they are faced with pressures, so when you are under pressure, can you stand with your philosophy or will you cave? A lot of times a person's job is on the line and taking an ethical stance may produce a great deal of stress. Creating these systems, however, brings a level of trust that the company should be aiming towards."

An Ethical Corporate Culture Starts At The Top
Both industry sources and statistics agree that an ethical corporate culture reflects the thinking and actions of top management, who must provide appropriate role models as well as instituting training programs. The repercussions of an unethical image, even if it's just internal, can be enormous.

A 2000 KPMG poll showed that 80 percent of employees who believed management would endorse improper conduct would not recommend their companies to recruits.

A Stanford Business School survey in 2004 of more than 800 MBA students from 11 leading North American and European schools found that 97 percent of them would forego significant financial benefits to work for an organization with a better reputation for ethics and corporate social responsibility.

And according to Walker Information, 2001, only six percent of employees who thought that their senior management was unethical were inclined to stay with their companies, while 40 percent who believed their leaders were ethical wanted to stay.

"One of the key factors in establishing an ethical corporate culture is visibility and support at the top of the organization among senior management for the ethics program," says Kirk Jordan, vice-president of research for Integrity Interactive Corp., a Web-based ethics and compliance program provider.

"Employees will get the message that ethics matters when their company leaders communicate this in an ongoing way, from the CEO giving a speech to employees, sending out a letter, providing code of conduct and compliance training programs, identifying resources for more help and information, and imposing discipline on those who break the rules," Jordan says.

Integrity Interactive advocates a story-based approach where both appropriate and inappropriate behavior is modeled. "People relate to stories because they are real and not abstract," explains Jordan. "We have told each other stories for thousands of years. We use a number of characters at a fictional company; by modeling bad behavior, we can show employees what to steer clear of, how they can avoid crossing the line and still do their job in an aggressive and competitive manner. Employees want to know what they can and cannot do day-to-day on their jobs."

"Business and the statutory and case law framework is increasingly complex; it becomes increasingly difficult for an employee to understand where their behavior may run counter to those laws," says Jordan. "They have to be made aware of those risks on a continuing basis. One thing that shouldn't surprise me any more, but still does, is the relatively low level of appreciation for the risk of compliance failures faced every day; for example, how many salespeople don't realize that simply chatting with a competing salesperson can lead to a felony that can lead to them spending time in prison."

Technology Facilitates Training
"While technology is at the heart of many ethical and legal problems, it is also a vehicle for many compliance-related training solutions," said David Simon, founder and president of WeComply Inc., which develops and delivers online compliance training. In addition to providing an economic way to reach corners of even the most geographically dispersed company, computer-based training allows a company to customize training to be industry and company specific, according to Simon.

"Cookie-cutter, one-size-fits-none content will be regarded as less relevant and engaging to employees and may not qualify as 'effective' for mitigation or affirmative-defense purposes," Simon advises. "Ethics training will evolve to become more simulation-based, enabling employees to practice applying pertinent legal and ethical principles to typical workday situations in a 'virtual' workplace that mirrors their own."

Simon pointed out a few more ways that technology will help companies manage the challenges of monitoring and administering ethics-related activities: Administration of training and other compliance functions can be integrated with a company's HR system for such activities as course assignments, user-tracking, policy management, and annual certificates of compliance. In addition, compliance information and awareness-raising reminders can be distributed through periodic e-mail messages. And in the future, ethics-related information will be assembled in a searchable format and made accessible on a just-in-time basis.

ROI for Effective Ethics Training Programs
A third of employees witness unethical conduct in the workplace, according to a study from the Ethics Resource Center in a 2001 article by Joshua Joseph, "Integrating Ethics and Compliance Programs: Next Steps for Successful Implementation and Change. "Where organizations did not have ethics programs, more than 20 percent of employees admitted that they felt pressure to compromise their ethical standards in the workplace, according to Joseph. But where ethics programs were in place, only 13 percent expressed the likelihood of committing unethical actions.

What if a company does nothing to train its employees? The primary risks are three-fold, according to Shanti Atkins, CEO and president of ELT, which offers online, interactive workplace compliance training, including comprehensive harassment and ethics training for entire organizations.

"First, the employer risks significantly increased penalties should legal/ethical violations occur," Atkins says. "Effective and comprehensive training helps to limit fines and damages. This is explicitly stated in the Federal Sentencing Guidelines, which are applied in both the criminal and civil context."

The Guidelines state that "the potential fine range … can be significantly reduced - in some cases up to 95 percent - if an organization can demonstrate that it had put in place an effective compliance and ethics program."

"Second, the employer risks a general lack of awareness among its workforce about ethical standards and legally compliant behavior," Atkins continues. "As demonstrated by the recent alleged ethical violations at Boeing and Bank of America, employees, managers and executives who engage in inappropriate behavior are often unaware of their transgressions. These people are not engaging in malicious, intentional conduct. Rather, they simply have not embraced a higher standard of accountability and transparency."

"Third, the employer risks damage to its reputation, both internally to employees and externally to the public, clients, shareholders, and future employees," says Atkins. "In the post-SOX workplace, a clear expectation is being placed upon employers to engage in high quality, proactive efforts to ensure ethical behavior, to prevent wrongdoing and to encourage and enable reporting of suspected misconduct. The really critical thing to understand is that these laws apply to everyone, and front line employees need education at least as much as the top managers. The entire organization must be appropriately trained.

"The risk of executives going to jail, corporations being liable for huge fines, and employees bringing lawsuits rises dramatically without effective ethics and compliance education. To truly impact behavior, facilitate cultural change and reduce risk, it's imperative that every employer adopt a comprehensive ethics and compliance training program that engages employees, simulates real-life situations, and goes beyond simply communicating policies."