Compliance Perspectives

By Adam Turteltaub

Judy Spain is a professor of business law at Eastern Kentucky University, Compliance Collaborative Program Consultant with the Georgia Independent College Association, and, most importantly for this conversation, the author of the book Compliance Risk Assessments: An Introduction, which was just published by SCCE and available for sale on both the SCCE and HCCA websites.

In this podcast we review the changing importance of the concept of risk and risk management, which Judy argues, has moved from an insurance-based approach for mitigating damage after an event to a more proactive one designed to prevent the problem in the first place.

She also discusses:

* The need to stop and think, rather than to react

* The importance of making ethics a part of the compliance risk assessment

* The value of including multiple voices in the risk assessment process

* Knowing your goal before starting

* The steps involved in getting the assessment done right (which are outlined in great detail in the book)

* Understanding that not every risk has the same impact

* The central role of prioritization

* And much, much more

To learn more, listen in on the podcast and then enjoy a preview of Understanding Compliance Risks Assessments on Cosmos, our digital publishing platform.

By Adam Turteltaub

The FBI has a long-established compliance program born out of allegations of misuse of National Security Letter authority.

In this podcast, Catherine Bruno, FBI Assistant Director for the Office of Integrity & Compliance, offers advice for other governmental entities eager to establish a compliance program. She explains the history and structure of the FBI’s program, advice for selecting members of the team, earning management support, mistakes to avoid, and more.

She also provides insight into what has helped the development of the FBI’s program, including enlisting experts within the organization to identify risks and to help secure buy in.

Listen in to learn more about how to build a compliance program in a governmental setting.

By Adam Turteltaub

Tyler Shultz, like many others, was entranced by the vision of Theranos and its charismatic founder Elizabeth Holmes. He would not remain so for long, ultimately sharing his concerns with her, his grandfather (a member of the board), and then becoming a source for a Wall Street Journal reporter, and a whistleblower, reporting to New York state’s public-health lab his concerns that the company’s proficiency tests had been manipulated.

On March 30, 2020 he will be sharing his experiences and insights at the 2020 Compliance Institute, and he was also kind enough to talk with us for the Compliance Perspectives podcast.

In a very frank discussion, he tells us how the culture of Theranos discouraged people from coming forward and raising issues. In fact, there were severe disincentives for doing so ranging from potential loss of a visa to litigation.

We also discuss what drew him to the company and why it was so hard to face the dark reality behind the enticing façade.

Finally, he addresses signs that compliance professionals should watch out for that could be symptomatic of a very dysfunctional culture, if not outright wrongdoing.

Listen in to hear what he has to say and then plan on hearing much more at the 2020 Compliance Institute.

By Adam Turteltaub

Given the risks of third parties, especially in risk areas such as corruption, much emphasis is placed on thorough vetting.

But once the deal is signed and the agent or contractor is hired, the risks don’t stop there. It’s essential to monitor how third parties preform through the lifespan of the engagement, including off boarding.

In this podcast Kara Bonitatibus, Head of Product at Lextegrity, points out that auditing should be periodic and focused on broader risks, not just the highest ones.

In addition, an audit every two to three years is not enough. Ongoing monitoring is essential to identifying issues sooner and taking corrective actions quicker. It can also help identify anomalies that may be signs of problems, such as multiple invoices under a certain threshold level, or split invoices.

Listen in as she explains more about how to use auditing and monitoring to give you a bit less to worry about when it comes to third party relationships.

By Adam Turteltaub

In 2019 the French Anti-corruption Agency (AFA) issued new guidance for compliance programs. According to Maria Lancri, a Paris-based partner in the Squair law firm,  companies already with good compliance programs should be in relatively good stead. Overall the guidance is consistent with the SAPIN II law.

Nonetheless, this guidance is demanding because unlike others when tend to be broad, this is very specific, especially when it comes to support expected from the business. There are even provisions for leadership, including director liability.

Listen in to learn more about what the guidance requires, including one very surprising provision.

By Adam Turteltaub

There are a lot of ways for things to go wrong with a helpline. Gio Gallo of ComplianceLine, a helpline provider, outlines in this podcast what he sees as the four most common mistakes. They are:

* Breaks in anonymity. Perhaps the most dangerous, these can occur when not just the name of the whistleblower gets out, but even information such as location, which may lead others to figure out who the whistleblower is.

* Poor communication. Employees don’t know how to reach the helpline or aren’t sufficiently reassured that they can trust it and the process.

* Audit trail/Investigative notes. Bad record keeping can lead to questions about the integrity of the investigation.

* Over-prioritizing legal concerns. Companies can think too legally and not culturally enough.

Listen in to learn more about the dimensions of these risks and what you can do to help mitigate them.

By Adam Turteltaub

When an investigation is done, the work isn’t.  Some form of remediation is likely necessary, not just to discipline a bad actor, but to ensure the issue doesn’t repeat itself.

As Alan Dillane, Global Remediation Program Manager at Dell explains in this podcast, traditionally investigations were focused on who did what, and then moved on.  Investigators often didn't have time to work on large remediation processes.

To solve this problem, Dell dedicated resources to remediation.  Under the Dell approach investigator can focus on the investigation, then the remediation team takes over.

The remediation team assesses the dollar and reputational risk.  It then works with investigators to understand the issue more deeply.  Then the team begins working with the business units to resolve the issue for the long term.

Listen in to lean more, and, if you can, don’t miss Alan’s session on the topic at the 2020 European Compliance and Ethics Institute.

By Adam Turteltaub

Supply chains are emerging as an increasingly complex risk area for compliance. The risk includes trade compliance, vendor management issues associated with cyber/privacy, product compliance, REACH, ROHS and California Proposition 65 , all the way into CSR and supply chain transparency controls such as conflict minerals and modern slavery requirements.  Even packaging can be a concern.

As Travis Miller, General Counsel of Assent Compliance explains in this podcast, to get a full picture of the risk it comes down to breaking down silos and creating centralization.  This prevents blind spots where supply chain and CSR/transparency issues can occur.  In addition, if data is stored in different places, it's impossible, he argues, to make strategic decisions, to incorporate requirements adequately into sourcing requirements, and to determine if product can be sold into a market or not.

For ongoing auditing and monitoring he advises focusing on three areas.  First, are the known knowns:  all the information you know you have in the company and then putting it all in one place.  The second area is your known unknowns:  information that the company knows exists but doesn't have.  Third, look at that data and make sure there are no discrepancies.

Listen in to learn more about these issues and what do if the supplier doesn’t adequately respond to your questions.

And, for an ongoing resource on the issue of supply chains, be sure to check out our Report on Supply Chain Compliance.

By Adam Turteltaub

In late 2019, both Richard Bistrong of Front-Line Anti-Bribery and I had just returned from trips to Asia. In this podcast we debrief on our experiences meeting with compliance professionals, law professors, government officials and business people in Singapore, Abu Dhabi, Vietnam and Shanghai.

As we discuss it’s a challenging time, with business often caught in a cross current between systemic, ongoing corruption and a new push to end that very same corruption. Smaller companies have the greatest challenge since they lack the resources of larger organizations.

The conversation then moves on to a virtue of trans-Pacific travel: the opportunity to read.  The two of us discuss several good reads that could be useful for compliance professionals.

Listen in on the conversation.  You won’t get jetlag.

By Adam Turteltaub

Breaking the rules is breaking the rules no matter where it occurs. And for those of us in compliance there is much to learn from scandals of all sorts.

Chris Rose, the co-host of Intentional Talk on the MLB Network and in-studio host for the NFL Network, was good enough to illuminate what happened in baseball’s sign stealing-scandal and what it all means.

In this podcast we begin by discussing the significance of the penalties imposed by baseball’s Commissioner and why they likely did not go farther. From there we explore the response of the teams and the reputational calculus, as well as the unique relationship of players to the press.

Finally we discuss what likely comes next. Listen in to learn more and get a better understanding of baseball, compliance and ethics.