Compliance Perspectives

By Adam Turteltaub

Here’s a terrifying thing I just learned: the average ecommerce website has 66 third-party tags on the page. That’s according to our podcast guest, Rui Ribeiro, CEO of Jscrambler. The tags, pixels and scripts control everything from the video to payment processing to the consent wall to the chat function. And, guess what: they may all be collecting user data, and, quite possibly, more data than they should.

So what’s a compliance officer to do, other than lose sleep over the issue? First, make sure there’s an inventory on all those tags, pixels and pieces of JavaScript running on your site and what data they are collecting. While you’re doing it, don’t just ask what’s being run at HQ. There may be regional variations.

Next, spend time with all the departments that touch the site to see what they truly need and that data isn’t being accessed without good reason.

Then change your thinking around GDPR. It’s not about just getting consent to collect data, it’s time to use it as a warning to focus on knowing who the data is being collected from and why.

Once you have that squarely in mind, you can find the right tools to control the data flow and ensure your organization and its third parties are only collecting essential data, not everything you can.

Listen now

By Adam Turteltaub

What have you done?

What have you achieved?

Have you forgotten?

Did you succeed?

What were your goals?

Were they ever reached?

What about your firewall?

Was it ever breached?

Jisha Dymond took inspiration from Dr. Seuss

An annual tradition to give kids a boost.

Take the time to note what you have done.

It will be illuminating, and may even be fun.

This is a podcast you truly must hear.

It may change your outlook for many a year.

Listen now

By Adam Turteltaub

In April 2024 the US Equal Employment Opportunity Commission released an update to the Enforcement Guidance on Harassment in the Workplace. This was the first update since 1999.

Stephen Paskoff, the President and CEO of ELI, explains that the guidance now treats LGBTQIA+ harassment similar to other forms of harassment.

The document now also addresses behavior outside of the workplace, making it clear that employers need to train and be more sensitive to behavior beyond the factory gates.

Listen in to learn more about what is new in the EEOC Enforcement Guidance on Harassment in the Workplace.

Listen now

By Adam Turteltaub

Document retention is one of those persistent issues that comes with a great deal of complexity. As Michael Kearney (LinkedIn), Head Solution Architect, Redgrave Data explains in this podcast, organizations have to deal with a dizzying array of rules. HIPAA has one set of requirements, state laws for medical records another, financial documents have a third, employment records a fourth and on and on it goes.

In addition, there are business needs for retaining and disposing of records.

So, what’s a compliance team to do? He recommends working with the business unit and other affected teams to write policies that meet the needs of all involved and work out any conflicts internally or among the regulations.

Work, too, with employees who may want to hold on to documents longer than policy dictates. You may find that what they want to keep is the data, not the document itself.

And, if there is a litigation hold, be prepared to work quickly with legal, IT and others to ensure that the relevant documents are preserved while your ongoing document retention processes continue.

Listen now

By Adam Turteltaub

Data analytics is a pretty darn big deal in compliance and ethics these days, with rising expectations for compliance programs to be able to demonstrate their effectiveness using hard data. The word “data” even appears a dozen times is the US Department of Justice Criminal Division’s Evaluation of Corporate Compliance Programs document.

Walter Appleby, formerly VP, Compliance & Ethics at Georgia-Pacific and Rosie Williams, Director, Compliance & Ethics were scheduled to address “Harnessing the Power of Data:  Unleashing Compliance Excellence” at the SCCE 23rd Annual Compliance & Ethics Institute, which will be held September 22-25, 2024 in Grapevine, TX.

Unfortunately, after recording this podcast they had a scheduling conflict for the CEI.  Nonetheless, we are still fortunate to share the conversation.  In it they explain that better use of data carries a number of benefits including a stronger risk assessment and management program, better informed decision making, and more effective use of compliance resources.

Data analytics begins with collecting together the data you have and determining its quality. As the old adage says: bad data in, bad data out. Sources of data can include your helpline, training statistics, HR and even legal.

You will also need to determine which metrics best reflect the performance of the compliance program. Here, the risk assessment is helpful, but so too is taking the time to listen to and think through the needs of your customers in the business unit.

Next, determine the proper recipe for integrating the various data resources so you and leadership can gain insights into gaps and deficiencies. This likely includes taking the time to think graphically to determine how best to visualize the data in ways management finds useful.

Listen in to learn more about how to use data to pinpoint issues, identify opportunities and assess the effectiveness of your program. And, we still hope to see you at the 23rd Annual Compliance & Ethics Institute.

By Adam Turteltaub

Mobile devices are terrible if you need to retrieve information from them. Employees hate handing them over and there are a ton of apps in which data disappears automatically. All in all, it’s just a nightmare.

But, the government still wants you to track what employees are saying, and you may have to produce that data.

Matt Rasmussen (LinkedIn), CEO, and Ryan Frye (LinkedIn), Chief Innovation Officer of ModeOne want to discourage you from falling into despair over the prospect. Employee resistance can be overcome by taking a targeted approach and using electronic tools that only seek business-related data.

Even before you get to that point, though, they recommend taking the time to train the workforce about what rights the company has to the data so this doesn’t come as an intrusive surprise.

Listen in to learn more about how to make retrieving mobile device data a bit less painful.

By Adam Turteltaub

“What else should the board be asking?”

It’s a good question in general and the tile of a session at the SCCE Compliance & Ethics Institute, which will be held September 22-25, 2024 in Grapevine, TX.

In this podcast, the leaders of that session, Deborah Spanic, Chief Ethics & Compliance Officer of Clarios, and David Gebler (LinkedIn), Principal of Leading with Ethics, share that there are three fundamental questions the board should be asking about the compliance program:

Is the compliance program well designed and aligned with risk?

Is the program being applied earnestly and in good faith with adequate resources?

Does the compliance program work in practice?

From there a host of other questions fall out including those focused on culture and on the connection between the compliance program and the enterprise’s overarching strategy.

Making sure the board is asking the right questions, and getting the answers it needs, requires a strong relationship with the compliance team. In Deborah’s case that includes being a standing agenda item for the audit committee each quarter and having a one-on-one conversation each mid-cycle with the audit committee chair.

Listen in to learn more, and then be sure to join their session in Grapevine at the  Compliance & Ethics Institute.

By Adam Turteltaub

How do you get employees working remotely, who may have less of a connection to the company, to make the effort and take the risk of reporting potential wrongdoing?

For Evie Wentink, it starts with recognizing the need to encourage a culture of reporting for these workers. It also includes recognizing that, even though they are remote, it doesn’t mean that they aren’t victims of or witnesses to a range of bad behaviors including harassment and bullying.

Compliance teams should also recognize that remote workers lack many of the casual opportunities to discuss with peers what they are seeing and what to do about it.

To help overcome these challenges, she recommends training and creating multiple reporting avenues.

She also recommends training managers in active listening so that they know what do when an employee walks through the virtual door with a concern.

By Adam Turteltaub

It’s not for nothing that there’s a year in the title of this blog post and podcast. Social media risks change frequently, explains Kortney Nordrum, VP, Regulatory Counsel & Chief Compliance Officer at Deluxe. She is the author of the chapter “Social Media Compliance” in The Complete Compliance and Ethics Manual and will be leading the session Social Media:  Old News and New Risks at the 23rd Annual Compliance & Ethics Institute.

These days the range of those risks is substantial. TikTok poses a notable challenge, since it accesses most everything on the user’s phone, which means work email and files may be exposed.

At the same time the FTC and NLRB have been very aggressive in their enforcement. The FTC has been scrutinizing endorsements – and a “like” may count as one – by employees of their employer’s products and services. Meantime, the NLRB has made it clear that it believes employees have wide, although not complete, latitude about what they say about their workplace online.

And, if that wasn’t enough, the marketing and social media teams need to be trained (and monitored) for what they are saying and doing in the company’s name.

What should you do? She recommends training with concrete examples, teaching people some common sense, and keeping lines of communication open.

To learn more, listen in and then don’t miss her session at the 23rd Annual Compliance & Ethics Institute.

By Adam Turteltaub

Everyone wants a mentor. Not everyone gets one, and not every mentor-mentee relationship works out.

Sarah Couture, Principal at Couture Compliance wants to change that. She’s the author of the chapter, “Mentoring for Compliance Professionals” in the Complete Healthcare Compliance Manual.

In this podcast, she offers advice for mentors and mentees both. Here’s a sample:

Mentors and Mentees

Level setting is essential for ensuring expectations are aligned

Think about your objective, what frequency of meetings makes sense and for how long the relationship should last

Be humble and transparent

Mentees

Look for someone you respect

Don’t only look for people who know exactly what you do; be open to outside expertise

Let your goals help drive your mentor selection

Mentors

Consider if you truly have the time

Ask: “Can I provide what this person is looking for?”

Only select mentees you respect and click with

Ask if the mentee is curious, willing to learn and to grow

Listen in to learn more about how to make the mentor-mentee relationship work, and, if you subscribe to the Complete Healthcare Compliance Manual, be sure to read Sarah’s chapter.