Compliance Perspectives

By Adam Turteltaub

These days compliance typically stands alone and reports directly to the board.  But that’s not true for every organization.

At Freddie Mac, compliance is a part of Enterprise Risk Management (ERM), albeit with a reporting line to the audit committee of the board.

To get a better sense of how this relationship with risk works I spoke with Michael Levin, the Senior Director of Compliance there.  He explained that, like so many other large financial institutions, Freddie Mac operates with a three-lines-of-defense system.  Since both compliance and ERM served on the second line of defense, the company decided to combine the two under one executive leader.

For Michael, there have been significant benefits to this relationship.  It has helped the compliance team to better understand risk, build bridges to the business unit, gain greater exposure to the board and become a part of business decisions much earlier.

At the same time, there have been challenges, including helping the ERM team better understand the challenges of managing culture.

Listen in to better understand the benefits and risks and being a part of risk management.

By Adam Turteltaub

Delivering bad news is never easy, especially when that news is an allegation of serious wrongdoing.  Fortunately for the rest of us, Odell Guyton, Managing Director at Klink & Co. and a co-founder of the SCCE, is willing to share his expertise in this thorny area.

As he explains in his podcast, it’s essential to have protocols in place before you have to deliver bad news.  These rules of the road should cover what will be brought to the attention of management or the board, and how the investigation will be managed.  One thing that must be delivered:  information they may need to share with the public, shareholders or the board.

Once the investigation is in process updates should be handled judiciously, and it’s important to avoid delving into the more salacious areas.

Finally, he explains how to handle – or more accurately have others handle —  any discipline that may be warranted.

Spend some time listening to his thoughts.  It could make bad news a bit easier to deliver.

By Adam Turteltaub

Delivering bad news is never easy, especially when that news is an allegation of serious wrongdoing.  Fortunately for the rest of us, Odell Guyton, Managing Director at Klink & Co. and a co-founder of the SCCE, is willing to share his expertise in this thorny area.

As he explains in his podcast, it’s essential to have protocols in place before you have to deliver bad news.  These rules of the road should cover what will be brought to the attention of management or the board, and how the investigation will be managed.  One thing that must be delivered:  information they may need to share with the public, shareholders or the board.

Once the investigation is in process updates should be handled judiciously, and it’s important to avoid delving into the more salacious areas.

Finally, he explains how to handle – or more accurately have others handle --  any discipline that may be warranted.

Spend some time listening to his thoughts.  It could make bad news a bit easier to deliver.

By Adam Turteltaub

If you work in a large, global company these days, odds are very good that there is an extensive ethics and compliance programs. Yet, many wonder why would a domestic company that’s small or medium-sized need one?

Art Weiss, Chief Compliance & Ethics Officer at TAMKO Building Products has a great, short answer:  If you have people you need a compliance and ethics program.

Working for a privately-held company in the US with a strong ethics and compliance program he has seen why every organization can benefit from compliance.  As he explains in the podcast, issues will always come up and having a code of conduct, policies and procedures is essential.

He also points out that, regardless of size and geography, every company has certain risk areas that will require training:  conflicts of interest, harassment, gifts and more.

To those who object, arguing that they lack the resources, he explains that small can actually be an asset.  It’s easier to do face-to-face training, and key stakeholders are easier to get to.

Listen in to learn more about why every organization can benefit from a compliance program, and how to get the most out of your small-company program.

By Adam Turteltaub

If you work in a large, global company these days, odds are very good that there is an extensive ethics and compliance programs. Yet, many wonder why would a domestic company that’s small or medium-sized need one?

Art Weiss, Chief Compliance & Ethics Officer at TAMKO Building Products has a great, short answer:  If you have people you need a compliance and ethics program.

Working for a privately-held company in the US with a strong ethics and compliance program he has seen why every organization can benefit from compliance.  As he explains in the podcast, issues will always come up and having a code of conduct, policies and procedures is essential.

He also points out that, regardless of size and geography, every company has certain risk areas that will require training:  conflicts of interest, harassment, gifts and more.

To those who object, arguing that they lack the resources, he explains that small can actually be an asset.  It’s easier to do face-to-face training, and key stakeholders are easier to get to.

Listen in to learn more about why every organization can benefit from a compliance program, and how to get the most out of your small-company program.

By Adam Turteltaub

Marjorie Doyle, in addition to her years leading compliance and ethics programs, has long taught organizational ethics at SCCE’s domestic and international Basic Compliance and Ethics Academy.  In this podcast, she provides a primer on the topic.

As she explains, organizational ethics is a focus on the organization’s values and how the organization wants to be seen.  It’s how you define your brand.

Making the organization’s values come to life begins with incorporating it in the code of conduct, ideally with scenarios demonstrating real-life situations where they apply.  As Marjorie explains, the key is to incorporate the values wherever you can.  One good place to start is with HR and work to include in every job description a statement of the values and how particular values relate to the job.  And while there, it’s worth discussing how values, ethics and compliance will be included in annual evaluations.

In addition to HR, the board can be a strong ally, if the values are taken from nice puffy clouds in the sky to practical applications.  She recommends providing boards with specific questions they can ask management, such as,  “Can we do this project and live up to our values?”

Listen in to learn more about organizational values and how they can enhance your enterprise.

By Adam Turteltaub

Marjorie Doyle, in addition to her years leading compliance and ethics programs, has long taught organizational ethics at SCCE’s domestic and international Basic Compliance and Ethics Academy.  In this podcast, she provides a primer on the topic.

As she explains, organizational ethics is a focus on the organization’s values and how the organization wants to be seen.  It’s how you define your brand.

Making the organization’s values come to life begins with incorporating it in the code of conduct, ideally with scenarios demonstrating real-life situations where they apply.  As Marjorie explains, the key is to incorporate the values wherever you can.  One good place to start is with HR and work to include in every job description a statement of the values and how particular values relate to the job.  And while there, it’s worth discussing how values, ethics and compliance will be included in annual evaluations.

In addition to HR, the board can be a strong ally, if the values are taken from nice puffy clouds in the sky to practical applications.  She recommends providing boards with specific questions they can ask management, such as,  “Can we do this project and live up to our values?”

Listen in to learn more about organizational values and how they can enhance your enterprise.

By Adam Turteltaub

There are a number of challenges to managing compliance programs in Asia:  With dozens of countries and thousands of languages, one size does not fit all.  There is tremendous diversity in cultures.  Some countries are common law and others are civil law societies.  Governments have different priorities for enforcement.

But compliance officers can’t just throw up their hands, nor do they need to, says Jimmy Chatsuthiphan, who spent several years working in compliance in Asia before returning to the US.  He is currently serving as Director of Global Compliance Investigations for Panasonic Avionics Corporation.  The risks are substantial and can be managed, he tells us.  Plus, several countries in the Asia-Pacific region are known for having very clean business environments.

As importantly, there are a large number of managers in the business units who are already familiar with compliance concepts.  As a result, it is not always an uphill battle.

Success, he tells us in the podcast, does, though, require having someone on the ground in the region.  It is too large an area, with too great a time zone difference, to be managed remotely.

What else works well in Asia?  Speaking to themes like karma and the importance of doing things right, even when no one is watching.  Likewise speaking about not disappointing your family, either your family at home or your “work family.”  Try also, he advises, citing incidents that have affected the company or competitors.  And, of course, having strong financial controls and third-party vetting.

Listen in to learn more about these issues, the changing regulatory environment – compliance programs are being recognized more – and tips for conducting internal investigations.

By Adam Turteltaub

There are a number of challenges to managing compliance programs in Asia:  With dozens of countries and thousands of languages, one size does not fit all.  There is tremendous diversity in cultures.  Some countries are common law and others are civil law societies.  Governments have different priorities for enforcement.

But compliance officers can’t just throw up their hands, nor do they need to, says Jimmy Chatsuthiphan, who spent several years working in compliance in Asia before returning to the US.  He is currently serving as Director of Global Compliance Investigations for Panasonic Avionics Corporation.  The risks are substantial and can be managed, he tells us.  Plus, several countries in the Asia-Pacific region are known for having very clean business environments.

As importantly, there are a large number of managers in the business units who are already familiar with compliance concepts.  As a result, it is not always an uphill battle.

Success, he tells us in the podcast, does, though, require having someone on the ground in the region.  It is too large an area, with too great a time zone difference, to be managed remotely.

What else works well in Asia?  Speaking to themes like karma and the importance of doing things right, even when no one is watching.  Likewise speaking about not disappointing your family, either your family at home or your “work family.”  Try also, he advises, citing incidents that have affected the company or competitors.  And, of course, having strong financial controls and third-party vetting.

Listen in to learn more about these issues, the changing regulatory environment – compliance programs are being recognized more – and tips for conducting internal investigations.

By Adam Turteltaub

Both HIPAA and the HITECH Act have been around forever in compliance years, but that doesn’t mean that the challenges they pose have all been met.

In fact, Adam Greene, a partner at Davis Wright Tremaine in Washington, DC explains that the risks keep changing because technology keeps evolving.  Big data, Artificial Intelligence and machine learning are all changing the playing field, not to mention ransomware, information sharing and interoperability.

In our talk together on this podcast he speaks to the dynamic environment as well as some of the issues compliance teams are facing when dealing with the regulators.  It’s a topic he knows well, having seen it from both sides.  Before his current tenure in the law firm, he served at HHS in the Office for Civil Rights (OCR).

Some of the other topics he discusses include:

* The disconnect between how information security professionals look at security vs. what OCR wants to see in compliance documentation

* Ongoing difficulties in enabling patients to access and share their health data

* Vendor management after the business associate agreement is in place

* The European General Data Protection Regulation (GDPR), and not over or under-reacting

* How best to approach regulators after a breach occurs

Listen in.  He provides a good guide to changing times for this substantial compliance risk area.