Compliance Perspectives

Post By: Adam Turteltaub

The Paycheck Protection Program (PPP) stimulus effort has led to many publicized cases of fraud.  As Neil Getnick, managing partner at the law firm Getnick & Getnick explains in this podcast, it’s not just grifters who are taking advantage of this program. Legitimate businesses can find themselves on the wrong side of the line.

As organizations sought funds many engaged in outright fraudulent activity such as creating fictitious employees, applying despite being on the Treasury Department’s do not pay list, even hiding the fact that they were in bankruptcy.

But there are subtler ways companies can go astray. A technically accurate but misleading answer in the questionnaire is one trap. Another is questionable documentation. There are very specific document requirements, he explains, and if an organization makes a redaction it must be spelled out quite clearly.

But perhaps most importantly organizations need to ensure that their attestation to this sentence is truthful: “Current economic uncertainty makes this loan request necessary to support the ongoing operations of the applicant."

With a new stimulus being discussed in Washington, organizations need to ensure that any funds are applied for properly. And if they err in doing so, they need to be very careful in how they correct the matter.

Post By: Adam Turteltaub

Dubai-based compliance veteran Cynthia Khumalo (LinkedIn) is heavily focused on third party due diligence.  It’s a difficult task for companies in normal times, but it’s all the more difficult these days.

In this podcast she recommends starting by having a good sense of the requirements that the third party is expected to fulfill and how it will enable the business.  That means understanding what the company is missing in its own capabilities and what will be required of the supplier.  Looking to see if the vendor has the technical capabilities and can operate within legal parameters is an essential first step.

It’s only the start of the process, though.  She advises taking the time to understand the organization’s risk appetite, parameters of the third-party’s engagement, and what can be done internally to assess the provider.

When assessing the vendor, it’s important to look at the traditional elements such as ownership.  But it’s also important to go beyond desktop research, when possible and prudent, and check the things only an in-person visit can reveal.

Due diligence doesn’t end when the contract is signed.  On an ongoing basis there’s a need to know what may have changed that can prove problematic, which is why audit rights can be crucial.  But a softer approach can also be helpful, demonstrating that compliance isn’t there to catch the vendor doing something wrong but instead to make sure that things continue in a way that doesn’t run astray of legal and regulatory (as well as contractual) requirements.

Listen in to learn more about third party risks and management.

Post By: Adam Turteltaub

It’s not an easy time for compliance budgets. Never exactly padded, they are under pressure as organizations try to control costs during the pandemic era.

While management may feel as if compliance should be included in an across-the-board cut, not everyone agrees that is a good idea, including the US Department of Justice.

So how do you make the case to management not to reduce compliance investments?  Long-time compliance professional Patrick Wellens suggests reminding them that regulators expect adequate staffing of the compliance team, in good times and bad. In addition, the proliferation of digital and social platforms and collection of so much data may be increasing risks.  Outsourcing and the proliferation of new suppliers adds third-party complexity. And at the same time, various stakeholders are demanding more out of business, not less.

If all of that doesn’t work, and you do have to cut the budget, he advises to cut strategically. Determine what isn’t adding sufficient value and can be suspended.

To get more out of the budget, look at what activities can be shared with other departments and where shared services can help. Building common ground with other departments is a technique that is useful not just for this period but also for the long term.

Look, too, at the training budget. Some of it may not be relevant for the current time.  Also, look to inexpensive and effective alternatives, such as as sharing stories of incidents that occurred at the company. Also, consider regular nudges and ethical dilemmas to consider.

Then, looking to the future, when budgets begin to grow again, he advises not simply restoring what you had cut. Instead, he counsels beginning with investments that can improve effectiveness and address key risk areas.  In the second stage, look for efficiencies where you can optimize controls.

Listen in to learn more about how to do more with less.

Post By: Adam Turteltaub

The need to Know Your Customer (KYC) is not, contrary to popular belief, an issue limited to financial institutions.  A wide range of industries are affected. In fact, in 2020 of the 15 companies penalized by the Office of Foreign Assets Control (OFAC), just two were financial services firms, reports Tracy Manning, Director of Financial Crime Compliance at LexisNexis Risk Solutions.

In this podcast she explains that, despite the diversity of affected firms, there are common challenges during this time of pandemic, including difficulty accessing sources for KYC due diligence information and delayed onboarding of new accounts.

So great and persistent is the challenge that almost 80% of survey respondents saw this problematic environment remaining for the next 18-24 months.

To navigate through these difficulties it’s important to understand the convergence of factors that combined with a pandemic to make KYC so hard. These include a mass shift by consumers to digital interactions, and with it rising expectations for business. Worse, bad actors have followed business online, changing their tactics to capitalize on the new reality, including preying on those working from home.

Compliance teams need to rethink their strategies for the new normal, she argues. For example, instead of relying on manual look-back processes geared towards physical identities, they need to explore the digital identity data consumers are leaving their wake.

KYC is yet another challenge for a challenging time. Listen in to learn more about KYC and protecting your business.

Post By: Adam Turteltaub

With the 25th annual HCCA Compliance Institute about to take place we have been collecting some rememberances of the last 25 years from various members of the compliance community.

In this podcast, SCCE & HCCA board member, and the association’s next president Robert Bond shares his history in compliance. Robert, who is Senior Counsel and Notary Public at the London firm of Bristows actually has roots that dig even. About 35 years ago he was living in the Midlands of the UK and had a neighbor who was developing (loudly) a video game, often at all hours of the night.

As Robert and the neighbor talked, it became clear that the programmer needed some legal help, which led Robert eventually to move fully into the then emerging field of video game law. Even at that time, he reports, gaming firms were collecting vast troves of data with often insufficient understanding  of both the opportunities and risks it posed.

By the time of the first Compliance Institute he had moved to London and was leading a small firm’s multimedia practice. Notably by the 1990s privacy, which Robert specializes in, was already becoming a concern. As he shares in the podcast, with the birth of the web, more data was collected and increased focus was being paid to the ethical side and the need to be careful with what was fast becoming the new oil.

His advice when it comes to data; don’t think about a privacy compliance program. Think about a compliance program and how data protection and privacy fit in.

Listen in to learn more about his fascinating career, the evolution of compliance, and what he sees as a C-suite future for privacy officers. And plan on joining us for the 2021 Compliance Institute.

Post By: Adam Turteltaub

In-person compliance training can have an impact like no other. But it has to be done right, which isn’t easy especially during the pandemic. Richard Bistrong, who specializes in delivering in-person compliance training, advises compliance teams to approach live training from a reverse engineering perspective: start with your goals and examine how they drive what you offer education on and how you do it.

That includes looking at how your risk profile has changed. Chances are they have evolved and that travel and entertainment training isn’t as important as it once was.

To make the training work effectively, realize that you can’t just move an in-person session over to Zoom. You need to understand what works in the digital environment. Participants tend to be more passive, making it even more important to be clear as to what is in it for them.

Also, relook at the use of slides. They can make the training feel less personal. It may be better to keep the video focused on the presenter and send additional materials later. It also may be better to have as a goal getting people talking and curious to learn more.

For more advice, he highly recommends reading Can You Hear Me by Nick Morgan.

One other thing to begin thinking about: hybrid meetings. Once workers begin returning to the office there may be times where people are being trained in person with colleagues dialing in. When that happens you need to avoid proximity bias: tailoring the message for and answering the questions of those in the room and losing track of those accessing the program remotely.

Listen in to learn more about how to make live training work in a remote world.

Post By: Adam Turteltaub

Brexit is done, sort of. As Andre Bywater, partner at Cordery Compliance explains, the deal the United Kingdom struck with the European Union applies primarily to goods, not services. While the trade is free from tariffs, it’s not free from paperwork. In addition, while there is a temporary agreement in place on data transfers, an adequacy decisions is still needed for the long term.

So what does this mean for compliance teams? A great deal. For one, it’s dangerous to assume that what applies to the EU also applies to the UK, and vice versa. Shipments of goods through the UK will likely be impacted, and plans should be made in case data flows are interrupted.

Global companies should also anticipate even more complexity in all the already challenging risk area of sanctions. The UK will likely want to continue to make it mark in this arena and also in the oft-related issue of modern slavery.

Business also needs to plan for more complex labor issues. Moving staff between the UK and EU will be significantly more complex with visa issues needing to be navigated.

Listen in to learn more about what Brexit means today, and what your compliance program needs to do for the post-Brexit future.

Post By: Adam Turteltaub

It’s not everyday that a Chief Constable joins the Society of Corporate Compliance and Ethics, let alone one who is the United Kingdom’s police national lead for ethics. So when Richard Lewis signed up we invited him to sit down for a podcast, and he graciously said yes.

In this conversation he explains the structure of policing in the UK and its ethics function. Each of the 43 police agencies, he told me, has its own ethics committee. Above them are four regional committees, and above them the National ethics Committee which he chairs and meets quarterly. To make the discussion robust and not an “echo chamber” the National Ethics Committee includes police but also individuals from business and academia.

Their mission is not to enforce ethics but to determine best practices that can be applied. In addition, they explore the ethics issues facing the police including the Black Lives Matter movement, #MeToo, abuse of authority and, as he put it both what they can and can’t do as well as what they should and shouldn’t do.

Another area of discussion is digital ethics. Technology such as facial recognition software and AI are evolving faster than the ethical frameworks.

In this conversation we also explore managing stress in these difficult jobs. One important strategy for maintain mental health: having an adequate work-life balance. It’s a goal that has grown more difficult to achieve in this always-connected world, made worse by the fact that so many people can’t escape an office that is now in a corner of their home.

Post By: Adam Turteltaub

When creating effective compliance programs, it’s also important to create an effective compliance team.

To do that, compliance veteran and executive coach Amii Barnard-Bahn lays out in the podcast a five elements approach:

* Trust

Team members need to believe that their peers have good intent and are in an environment where they can be honest and open with each other. That requires a leader who fosters a collaborative environment.

* Mastering Conflict

Conflict is inevitable and a natural part of being human, she explains. It’s also a part of good decision making, but we need to be aware of how we and others respond to conflict.

* Achieving Commitment

Interestingly, she argues that consensus can hurt commitment, if it’s just head nodding. What you need is true buy in, even if not everyone agrees with the decision.

* Embracing Accountability

That means accountability doesn’t just come at the end but all along. You also need a willingness to call out behavior that is damaging to the team.

* Focusing on Results

When it comes to results, it’s key to look at both the what and the how, and to look around the corner to see what the future risks are.

Listen in to learn more about how to improve the effectiveness of your compliance team.

Post By: Adam Turteltaub

Privacy continues to be a challenging issue for healthcare providers. Chrissy Kyak, Compliance & Privacy Officer for Medstar Georgetown University Hospital, MedStar Montgomery Medical Center and MedStar Health Research Institute reports that problems remain with people viewing family member data, and COVID diagnoses.

Staying on top of the issue requires ongoing vigilance, and the use of software that can potentially flag improper data access, she reports in this podcast. She will also be addressing the topic at the 2021 HCCA 25th Annual Compliance Institute, taking place April 19-22.

When it comes to conducting an investigation, she reports that interviewing may have gotten easier.  Subjects are more relaxed, she finds, in the virtual setting.

In terms of interviewing strategy, she typically shares that she saw something in the audit, asks their perspective and what the access was for.

In those cases where the investigation begins with a report from the hotline, she will ask the subject if he/she is aware of the policy and why do they think there is a meeting. Most report a lack of awareness of the policy.

Often she has discovered a lack of training is the culprit. That’s a problem that can, of course, be remedied. When doing so she finds it best to focus on giving people the information they need to get through the day right now. They don’t need a lot of legalese, especially with staff stretched so thin by the pandemic.

Listen in to gain more of her expertise, and be sure to join us for the 25th Annual Compliance Institute.