Compliance Perspectives

By Adam Turteltaub

Melinda Shapiro, Senior Director of Compliance at San Diego-based National University, knew she needed to do something different with the school’s approach to enterprise risk management (ERM). When she took on the compliance role, she discovered that risks tended to be aggregated into large buckets, such as human capital, which made it difficult to assess individual risks. In addition, risk ratings varied widely by affiliate.

Adding to the challenge, the document produced took a narrative approach, with long explanations of the risks and mitigation efforts. Sometimes there was a lack of alignment between risks and controls. Worse, the format made it difficult to track changes year to year.

Inspiration came from speaking with two other participants at the SCCE Higher Education Compliance Conference. She was able to see a new way of approaching ERM, including switching from a one-year to a two-year cycle.

The results have been highly positive. She reports that there is a much better understanding of risks and controls. In addition, there is now better alignment and very strong support from the board’s audit committee.

Listen in to learn more about what she did differently, how she learned from others, and new ways to think about your own ERM process.

By Adam Turteltaub

Healthcare and healthcare compliance are often thought to be very country specific, due to the many variations of healthcare structures. To learn more about how healthcare compliance works in one country outside of the US we spoke with Emeka Obiora, Vice President, Ethics and Compliance at NMC Healthcare in Abu Dhabi.

Emeka explains that the United Arab Emirates (UAE) has something of a split system. Public sector hospitals primarily serve Emiratis, who are provided with healthcare by the government. Foreign workers in the UAE are required to carry insurance and typically see private providers.

As a result, the risk profile is very different. It is there, though, with several key ones to manage.

The first is licensing. The UAE relies upon medical professionals who come from all over the world and have vastly different training and backgrounds. All must be qualified and licensed locally, which represents a substantial undertaking.

The second common risk area is conflicts of interest, which is focused on interactions with pharmaceutical and medical device manufacturers. To ensure that there is undue influence, contact between clinicians and providers may be completely prohibited.

As is the case elsewhere in the world, privacy is also a significant concern, and in the UAE it has grown to be a greater challenge now that there is a new, tougher law.

So, is working in the UAE in healthcare right for you? Emeka recommends asking yourself if you have a sense of adventure. As importantly, ask the same about your family and what impact a move may have on them.

If you do decide to take the plunge and find a potential opportunity, assess it like you would any other compliance position. Look at the organization and its governance structure: Will you have access to the senior level of the organization?

Question carefully their approach to compliance and ethics. While it may likely not be as advanced as what you are used to in the US, if the tone and the commitment are there it’s worth considering, especially because there is a growing emphasis on accountability, corporate responsibility and ethics in the UAE. That portends well for the future.

Listen in to learn more, including one myth about the UAE that needs to be dispelled.

By Adam Turteltaub

Compliance professionals are trained to point out downsides, identify risks and educate others on what can go wrong. But, points out, Ami Simunovich, Executive Vice President, Chief Quality, Regulatory Officer & Public Affairs for BD, they need to balance that with a need to see and encourage others to take the right risks.

A compliance officer who can do that earns credibility with business leaders.

So, how do compliance professionals get there? She recommends reorienting thinking to focus on how to advance the business in the right way. That begins with tying decisions back to the purpose of the company. This can help enable the right leadership mindset and avoid reckless decision making.

Grounding decisions in the code of ethics, along with a focus on the business’s purpose, helps create a framework for better decision making. Next, make sure business leaders are keeping up with the regulations. Also, encourage them to ask gut-check questions such as: Are we making the right decision? Would our partners be proud of what we have done?  Is this who we are?

Along the way, embrace open conversations that ask whether the decision or initiative is the right one. At the same time, be sure that, as the business proceeds, there are controls in place that are fit for purpose for the risks at hand.

Listen in to learn more about how the compliance team can help the business grow.

By Adam Turteltaub

One of the more well-attended sessions at the SCCE 22nd Annual Compliance & Ethics Institute, promises to be “ESG and DEI: How to Position for Stakeholder Success”. The session will be lead by Adrian Taylor, Director of Diversity, Premier Health; Ahmed Salim, Chief Compliance Officer, iRhythym; and Nakis Urfi, Product Compliance Officer, Babylon Health.

ESG and DEI are two of the hottest issues in compliance, and in this podcast preview of their session they start by taking on a controversial topic: Should DEI and ESG be combined? Traditionally, DEI has been its own discipline. Many now argue it should considered a part of the S (Social) in ESG, while others feel that doing so would diminish the emphasis on DEI.

Ideally, DEI should not be affected by being included in ESG, they say. If handled correctly, it can maintain its focus and management commitment and even strengthen ESG efforts. When the two are aligned they create a more sustainable business model that balances people, profit and planet. Together they can also help foster engagement with stakeholders, improve culture, encourage greater accountability, and help the company’s reputation.

To be successful, Nakis, Ahmed and Adrian argue, organizations need to manage four key challenges of ESG ratings:

A limited focus on DEI

Having accurate, valid data

A lack of standardization

Subjectivity

All of these can lead to ratings that are more judgement scores than a true measure of an organization’s commitment to DEI and ESG.

Listen in to learn more, including how to identify data that is truly useful for measuring your organization’s DEI and ESG success.

Then, don’t miss their session at the SCCE 22nd Annual Compliance & Ethics Institute.

By Adam Turteltaub

Crystal Jezierski, Senior Managing Director, Guidepost Solutions thinks that at this point we have enough guidance documents and frameworks for compliance programs.

That’s not a criticism but a compliment. She finds the existing prescriptions to be helpful, instructive and reflective of the evolving understanding of best practices for effective compliance programs. They are also flexible enough for new and emerging risks.

What’s needed now, she believes, are more opportunities to benchmark, share, apply and test how programs are implemented.

As with compliance programs as a whole, that begins with understanding how to assess risk and how others are doing so. If done correctly, of course, a risk assessment can  orient resources to both current and future issues as well as change how the company is doing business.

When managing a new issue, she recommends involving a combination of the standard partners – HR, internal audit, finance and technology – as well as additional partners who bring expertise to addressing the risk at hand.

One other partner needs to be considered throughout: the board. It can be a tremendous asset for compliance, sometimes more so than leadership.

To gain and keep board support, she advocates for regular contact, updates, and conversations about emerging issues.

Listen in to learn more about how to leverage the compliance frameworks, learn from others and work with the board to create a stronger compliance program.

By Adam Turteltaub

Email isn’t enough anymore, if it ever really was. Employees are communicating with each other, clients and prospects via texts, WhatsApp, Teams, Slack and many, many more tools.

Much attention has been paid to the US Department of Justice’s call for organizations to be able to produce all that communication, which is not an easy task. Eric Baim, partner at Dovetail Consulting Group, explains that focusing on producing the communications is important, but it is isn’t enough. Compliance teams need  to train employees to use these technology appropriately.

That education process begins with compliance developing an understanding of what these applications were designed to do;  facilitate quick, back and forth interactions, brainstorm, and ask a question less formally than one would via email. The problem is that often these interactions lack context because they are continuations of other conversations. As a result, an outsider seeing them can draw very incorrect conclusions about what was being said.

With that understanding in mind, it’s important to make it clear to employees that if they are conducting company activity via these communication tools, they still need to follow company policy. Next, help them to understand the risk of comments taken out of context and to ensure that they add some. If the text, for example, is a follow up to an in-person meeting, reference it.

Be sure also to underscore the importance of avoiding jargon, being truthful or making assumptive statements. Stick to the facts and keep personal commentary out.

Internally, compliance teams, he argues, should take the time to understand how they can use these channels to communicate with the workforce. Communicating with the business where it is can help keep compliance top of mind and relatable. It can also help foster greater dialog which is, after all, what these applications were designed for.

By Adam Turteltaub

In a perfect world, whenever employees face a difficult decision or outright compliance issue, the right policy would automatically pop up in front of them. While that is not likely to happen soon, Jannica Houben, Vice President, Global Legal Transformation and Travis Waugh, Director, Training, both at TD SYNNEX can envision a word in which Outlook could spot issues as they are typed, flag them for the employee and give guidance and pointers to where to call for help.

Until then, there are still many things compliance teams can do using off the shelf software to automate compliance processes. It’s a topic they explore in the podcast and in greater depth in their Session “Interactive Policies: Using Technology to Enhance Decision-Making” at the 2023 SCCE Compliance & Ethics Institute.

So how do you create this automated future? They recommend beginning by thinking not about what tool you want, but what benefits you want the tool to deliver. Think about the value you want to provide and what would make employees’ lives easier. In addition, expect an iterative process: you won’t get everything right the first time.

Once you have that in mind, you can begin the pursuit of the tool itself.

At TD SYNNEX the compliance team tried to create the path of least resistance for employees to compliance, including developing an adaptive policy guidance tool. Using BRYTER, which requires no coding, they developed a tool which asks a series of questions to determine what the issue is, gives advice and routes a form to the employee’s manager. The manager can then add notes and recommendations.

The tool has a dashboard that can track the whole process. It also can help identify gaps and what the organizations risks are, what policies need to be created and when more training is required.

This program has freed up time for the compliance team, enabling it to invest in relationships and add more value.

Getting started is surprisingly easy, they report. Listen in for more inspiration, and then don’t miss their session at the 2023 SCCE Compliance & Ethics Institute.

By Adam Turteltaub

With the consent requirements built into privacy regimes, you can’t help but focus on them. Bill Piwonka, Chief Marketing Officer at Exterro, cautions, though, that there is much more than consent to worry about.

Consent is very specific around whether people you are interacting with giving you permission to have and use their data for specific purposes. Much focus is given to the pop-up warnings on websites and cookies.

Compliance teams, he advises, need to look at all the places where the organization collects data and uses data, including apps, to ensure proper consent is obtained.

One other area not to be overlooked: Data subject access requests. It can be an enormous undertaking when a consumer demands to know what information you have on her or him.

Even more daunting are similar requests by departing employees. Think of the hundreds of thousands if not millions, of documents that contain data from an employee, everything from HR records to emails to conversation on Teams.

So great is the challenge of tracking them all down that employees are starting to use the threat of requiring all this data as a way to leverage a better severance package.

Listen in to learn more about these issues and what you need to do to prepare to meet your privacy compliance obligations.

By Adam Turteltaub

The proliferation of computer-based due diligence tools, combined with the travel restrictions of the pandemic led to a shift away from in-person due diligence efforts. Technology-based approaches increased dramatically, and, according to Jen Hoar (LinkedIn), Managing Director of Forward Risk, relying solely on them can be a mistake.

Talking to human sources, she argues in this podcast, helps augment and provides nuance to open-source public records. Talking to people who have worked with the third party can flesh out what it is like to do business with them and if there are any concerns.

Sources to interview can include prior investors, customers, industry experts, and even trade journalists.

When conducting the interviews with these individuals, she advocates for an open-ended, conversational approach. Rather than trying to get through a list of questions, give them the opportunity to talk about whatever is important to them and pursue the conversation wherever it leads. Be sure, though, to take note if someone is oversharing.  It may be a sign of an agenda.

In terms of your own agenda, she advises against going in with a hypothesis to prove or disprove. Instead, go in with an open mind. Your job is to gather information and to find out what the truth is rather than to test a theory.

Listen in to learn more about the role and value of human-based due diligence.

By Adam Turteltaub

For organizations working to avoid corruption it can be a lonely fight. While a sales or compliance team may know that there are many others out there who would not pay a bribe, when facing a corrupt demand, they tend to be on their own.

The maritime industry, though, has taken a major step to change the dynamic. In this extended, in-depth podcast, Cecilia Muller Torbrand, Chief Executive Officer at Maritime Anti-Corruption Network (MACN), explains how they pursued a collective action approach that now includes about 200 companies.

The maritime industry is very exposed to corruption risk. A given ship can touch many jurisdictions over a short period of time. Captains are often very far from their headquarters and encounter multiple government touch points when approaching a port.

The corruption they face varies dramatically, but it is frequently manifested with requests for facilitation payments: some token of appreciation. The challenge is a legal one since facilitation payments are prohibited under the UK Bribery Act. It is also a practical one, when the appreciation turns into a demand and expectation. When a captain turns down the request, it can lead to a host of problems, ranging from confiscated passports to endless, time consuming inspections.

To help fight this problem MACN began about 10 years ago with just 8-10 companies. It has since grown to around 200. The companies recognized they could not fight the problem alone and had to work together.

Success has been driven by a focus on solutions rather than finger pointing. They also, when possible, seek to bring in the local government. Armed with a database of over 50,000 incidents of corrupt demands they are able to use data, rather than anecdotes, to advocate for change and demonstrate how systemic the issue is.

The results have been substantial, and over time the MACN logo on a ship has come to mean a great deal in countries where they are active. It actively helps dissuade bribe seeking.

MACN has also created a Global Port Integrity Program (GPIP). It leverages the data collected on corruption incidents to provide members with a port-by-port look at corruption risk, enabling better preparation.

Secondly GPIP has enabled them to provide a level of transparency not before seen that can help ports understand how they need to improve.

All these efforts have led to remarkable results with measured improvements on the ground.

Listen in to learn more about what MACN has done, and, perhaps, use it as a model for your industry.