Compliance Perspectives

By Adam Turteltaub

The holidays are here, and with them come good tidings of comfort and joy, and increased corruption risk. Holiday gifts, both given and received, can lead to serious compliance challenges.

In this podcast Richard Bistrong of Front-Line Anti-Bribery warns that 2022 may be particularly difficult. For many this will be the first time in several years that they have had the opportunity to connect face to face with customers and vendors. There may be a desire to catch up for lost time, and the rules of the road for giving may have been forgotten. Some may even be tempted to dip into their own pocket to keep the gift off the books.

Making things difficult is that it’s difficult to find a rule of thumb for gift giving that reflects all the various nuances from culture to culture around the globe. However, employees can learn to look to the code of conduct, reach out to managers and contact compliance to ensure that they are staying between the guardrails.

It’s important that workers know that the rules apply to gifts given to government officials and also to employees at other companies. Commercial bribery is a real risk, and a gift that may be perceived as creating an obligation of some sort is not appropriate.

Even charitable giving may be problematic. Although a part and parcel of the regular giving of many industries, it’s important to ensure that the funds are being used appropriately and that the charity is not tied closely with a government official.

In general, organizations need to embrace reasonable and transparent gift giving. To that end, a gift registry can be extremely helpful, tracking both what is given and received, as well as any gift giving plans.

Finally, don’t forget to train employees on what gifts they can accept, and to warn them that it’s easy, as Richard learned, for a seemingly innocent gift to lead them down a dangerous path.

By Adam Turteltaub

Harsh Kariwala, CEO of VComply, warns that traditional tools for managing compliance programs, such as spreadsheets, may be hurting your compliance program. They often are not scalable and can lead to inefficiencies and unnecessary complexities.

Automating your compliance program can be a natural choice, but organizations may resist doing so out of budgetary concerns or mindset. Budget is typically of greatest concern for smaller organizations, which have less to spend and are eager to build or sustain their cultures.

If your organization is ready for automation, he recommends identifying the tools and technology that you would want, followed by defining what process you want to start with.

Take a phased approach to automation rather than trying to do everything at once. Pick one area to start, and analyze what is going right and wrong in the process. This will give you a better sense of the tools you will need and challenges you face.

Measure success by the value it provides to the end user in areas such as time saved versus manual projects and potential penalties that are avoided.

Finally, he advises avoiding the mistake of trying to do everything at once. So, take the first steps now, and listen to the podcast, but not all the podcasts.

By Adam Turteltaub

A compliance budget is a lot more than the numbers in it, explains Betsy Wade (LinkedIn), Chief Compliance & Ethics Officer at Signature Healthcare. It should be a reflection of the organization’s priorities and risk profile.

The budget is also a point of focus of the US Department of Justice when examining a compliance program during an investigation. Their Evaluation of Corporate Compliance Program guidance for prosecutors asks not only if there are sufficient resources but if they are allocated on a “risk-tailored” basis.

So, what is the right budget to have? To determine that answer she recommends compliance teams do a risk assessment and determine what mitigation efforts will be needed. In addition, benchmark against other organizations to learn what they are spending and doing. Just try to make sure that you do so against as similar a business as possible.

Look also to publicly available resources such as benchmarking surveys from HCCA and SCCE.

Keep your eye out, too, for what regulators and enforcement authorities are saying. US Assistant Attorney General Kenneth A. Polite, Jr., she reports, recently called for compliance FTE for every thousand employees.

The compliance budget should include the cost for all that compliance personnel. Also in the budget should be any travel, certification costs of staff members, staff training, services purchased, and more.

To win management approval, she recommends continued analysis of the budget and making adjustments. She also advises using the risk assessment as a tool to support the compliance team’s budget request.

Listen in. Doing so won’t add a penny to your budget.

By Adam Turteltaub

Go back roughly twenty years and you wouldn’t find a country in South America that had corporate criminal liability laws. Today, though, the picture has changed dramatically.

Felipe Sottorff Araya (LinkedIn), a compliance consultant from Chile who recently moved to the US, reveals that half of the countries now have corporate criminal liability statutes, the latest being Colombia.

That doesn’t mean they all have the same laws. There are significant differences among the countries when it comes to triggers for corporate criminal liability. Some have adopted broad rules; others have taken a narrow route.

There are common elements, however. Bribery is treated as a corporate liability trigger throughout. In addition, the crime has to be committed to benefit the company.

Another common element: expectations for compliance programs. Each country follows the seven elements approach found throughout the world.

Listen in to learn more about the changing landscape of corporate criminal liability and also learn where organizations are most likely to fall short in their compliance efforts.

By Adam Turteltaub

The Winchester Mystery House is both an unusual tourist destination, and a good metaphor, as it turns out.  Built by an eccentric heiress who never stopped making changes and additions to it, the home is filled with dead-end passages and stairs that lead nowhere, a result of the constant building. Ultimately it grew to 24,000 square feet, 10,000 windows and 2,000 doors.

In this podcast, Deena King, author of Compliance in One Page and a working compliance professional, tips her hat to Andrew Nebbett of Ethisphere and the warning to avoid creating a Winchester House of a compliance program.

Too often compliance programs have one piece of another built onto them as they grow to accommodate more risk areas and parts of the organization. Worse, sometimes those pieces operate independently, leading to redundant efforts and a lack of cross pollination of ideas.

To avoid this chaotic mishmash, she advises pursuing what she calls “strategic compliance”. Instead of focusing on the seven elements of the program, focus on the ultimate goal: to prevent, find and fix problems. Then treat the elements as a means, not an end.

Develop a strategic model, she advises, and then push it out through the organization. It helps prevent additions that are separate from the main program and don’t really fit with it.

Set up, too, a network for your compliance teams to communicate with each other, share insights and avoid learning dead ends.

Listen in to learn more, and let us know if you’ve been to the Winchester Mystery House.

By Adam Turteltaub

The compliance team has a new initiative, or you need to tell the business unit that, if it wants to get into a new line of business, a list of compliance requirements need to be implemented. Even if there is no overt pushback, there may be some very severe reservations.

Doubt mining, explains Alan Wilemon (LinkedIn), Head of Privacy at Stellar Health, is about getting people to give feedback about what they are nervous about and what they feel will not work in a project. Put another way, it’s about searching for why they have doubts about the project and whether a goal can be achieved on schedule.

So how do you mine those doubts and identify where the risks are? First, create a safe environment and invite them to speak up. Reach out to project stakeholders first. Then, secondarily, talk to any people who have been spoken for in the meeting. If people are “volunteered” to be a part of the project, talk to them as well.

Also, avoid asking for questions or concerns only at the end of the meeting. At that point many people are eager to leave and won’t say or want to hear anything. And even if people do want to discuss the issue, you will quickly run out of time.

Instead, invite comments earlier and ask them questions such as “Do you think we are being too aggressive?” You need to be the first to admit that there may be issues and the plan could be improved.

Listen in to learn more, and then become a doubt miner.

By Adam Turteltaub

Whether you call it a layoff or a reduction in force (RIF) it’s a stressful time for the organization and the people who work there. Research shows that people under stress don’t make the best decisions, which could raise compliance risk. Plus, it is always feared that some may make retaliation claims in order to preserve their jobs.

Roxanne Petraeus, co-founder and CEO of workplace compliance training company Ethena, says that the good news for compliance teams is that they should continue to focus where they always have: the culture. The bad news is that culture and trust are both damaged during a RIF, which can lead to both an increase in misconduct and a decrease in reporting.

Because of that, communication is more important than ever, she observes. Employees are hungry for more information. And don’t forget another form of communication: just being visible. Let them know that you are there for them.

Other advice she offers:

* Remind employees about the organization’s policies

* Embrace the idea that more is better

* Train effectively in a targeted way, such as focusing on the code of conduct

* Get in the habit of conducting regular surveys of the workforce

Listen in to learn more about how to better manage compliance programs during layoffs.

By Adam Turteltaub

There has been a lot of discussion over the last few years about nudges, although typically in the general business environment, rather than in the world of compliance and ethics.

A notable exception has been the work of Todd Haugh, Associate Professor of Business Law and Ethics at the Kelley School of Business at Indiana University, and a Board Member and Jesse Fine Fellow for the Poynter Center for the Study of Ethics and American Institutions. He has written about nudges and offers additional resources on behavioral compliance.

In this podcast, he explains that behavioral science has revealed that nudges – carefully crafted prods to make the right decision – can have a profound impact. A nudge takes advantage of choice architecture, which pushes people in a direction by structuring the environment in which choices are made.

Notably, this is not about tricking people. This is a pro-social effort.

So, how does it work in practice? It begins at the end. Look at the outcome desired and then examine the steps along the way. As you do, build a behavioral map that identifies when small interventions in existing processes can achieve positive compliance results. For example, one organization was receiving more anonymous reports on its help line than it desired. The organization realized that the default setting for reporters was set to anonymous. By simply shifting the default to including the person’s identifying information, non-anonymous calls increased 5%.

Another example comes in the area of travel. When an employee fills out a travel form for a high-risk country, it’s a good time to provide information on data security and the corruption risks of meeting with government officials.

Professor Haugh cautions that it is best to think of nudges as ways to have specific impacts on certain behaviors, not to do something broad like creating a positive corporate culture.

Have reasonable expectations and then test out various nudges to see which ones are having an impact and which ones aren’t.

Listen in.  It may nudge you to think of your compliance efforts differently.

By Adam Turteltaub

Rodrigo Cunha is Global Director, Legal, Ethics Compliance and Data Protection for AB InBev. There he focuses on digital ethics.

As he explains in this podcast, when it comes to data, traditional risk management, focused on making sure that what the company is doing is compliant, is only the first step an organization needs to take. They also need to incorporate risk management in the design of the program. In addition they have to focus on reputation and trust. Without a good reputation for protecting data and the trust that comes with it, a company will have an exceedingly difficult time doing business.

Digital ethics, he believes, is a business enabler. Organizations need to look beyond the compliance requirements, especially now with requirements increasing and varying so much by jurisdictions.

Instead, it is better to think about expectations of the government, consumers and other stakeholders as a guide.

At AB InBev that assessment led to the development of five principles that they stand for wherever they operate:

* Collect only the data we need

* Use the data only in a matter that we say we would

* Protect the data we have

* Keep only what we need

* Be accountable

Further thought led to the development of a sixth principle: We use data how people expect we would.

Putting these principles into practice involves a deep partnership with the business units. It includes effective training but also modifying the three lines of defense model to make sure the business unit is better able to meet the challenge. That includes the compliance team working closely with them to respond effectively whenever issues arise.

Listen in to learn more how to better embed data ethics into your organization, and hear what Rodrigo sees for the future, including a potentially dramatic shift in consumer behavior.

By Adam Turteltaub

Why is it that so often leaders in organizations fail? They seemingly had all the skills, accumulated all the experience, and then something went wrong, sometimes disastrously. Not just the CEO, it can be leaders at other levels in the organization.

Bret Hood (LinkedIn), Co-Founding Partner of 21st Century Learning & Consulting provides some fascinating answers to that question in this podcast in which he draws from, amongst other things, his 25 years in the FBI.

He explains that as individuals move up the organizational ladder feelings of empathy may start to deteriorate without the person realizing it. They may grow to become self-centered, taking credit for the success of others, and distributing blame for failures, including their own.

This can be coupled with what he calls “illusory superiority”: the belief that you are better than everyone else. Most of us suffer from that to a degree. A very disproportionate percentage of people feel that they are smarter than their peers or even a better driver than most. In an exercise he frequently does, rarely do more than 3%-5% believe that they are in the bottom half for leadership skills. Clearly, it’s not possible for 95% to be in the top half.

Many leaders (and others as well) also suffer from what he refers to as “sunk cost bias.” A mistake is made, and instead of owning up to it there is a tendency to double down. A small fudge of the numbers in one quarter when thinking “well, it’s a small one-time dip” leads to greater fudging the next, and then on and on, rather than an honest accounting.

The bottom line is knowing your capabilities and performing an honest self-assessment is difficult. That’s why he recommends two approaches. First, think about what your gut says, and then ask: what if I made the opposite decision? What would be the consequences? This technique helps you see things from more than one perspective.

The second recommendation is to find people you respect who trust that it is safe for them to ask hard questions and offer opinions that contradict yours.

Listen in to learn more about leadership, and also the concept of followership.