The financial, legal and reputational risks to organizations presented by illegal

Transcription

1 THE REWARDS OF A RISK-BASED APPROACH TO COMPLIANCE & ETHICS TRAINING Mark Rowe, Director of Compliance and Ethics Advisory Services, SAI Global Compliance, interviews Jeffrey M. Kaplan, Partner, Kaplan & Walker LLP and Former Chair of SAI Global s Law and Ethics Advisors The financial, legal and reputational risks to organizations presented by illegal or unethical conduct have never been greater. The sources of these risks include employees, agents and other types of business partners. Compliance and ethics training, aimed at helping people recognize, avoid or overcome potentially risky situations, is vitally important and now commonplace in most large and many mid-sized corporations. But there are numerous challenges in deploying such training and frequently management is left with nagging doubts about the reach and effectiveness of the training. In this interview, Mark Rowe and Jeff Kaplan discuss whether the right training is being provided to the right people, in the right way, and for the right reasons. Mark Rowe: Even as Enron and WorldCom were imploding, corporate Compliance and Ethics (C&E) training was viewed in a great many organizations as an inconvenience to be endured. In a few short years, though, its priority has been elevated such that it is now typically a key component of corporate risk management strategy. How would you characterize this shift to a risk-based view of C&E training and where is it leading? Jeffrey Kaplan: It is essentially a function of two things. First, violations of laws and ethical expectations have become more costly than ever. This is true both in terms of direct economic impact, typically in the form of fines, and also indirect impacts on the business in the form of reputational damage. So, as a matter of simple risk/reward calculus, C&E mitigation has moved into the mainstream of general risk management. This shift is likely to occur within a steadily increasing number of organizations, particulary in certain high profile areas such as competition law and anti-corruption law. 1

2 Second, while training had been a feature of many companies C&E efforts even before Enron, looking closely at what actually makes such efforts work as sound mitigation practices require organizations to do led many more to realize that training is a critical component of reducing those risks. There are basically two main reasons why training really matters in terms of an overall C&E program. Number one is that C&E training helps employees understand various legal and ethical imperatives that, in our highly regulated and increasingly global economy, may not be self-evident: that is, training provides an essential informational component. Number two is that the mere fact of having a strong training regime should itself help convince employees that management is serious about complying with the legal and ethical imperatives. In other words, training also supplies what could be called a motivational component. Rowe: Why is it important for an organization to take a risk-based approach to C&E training? Kaplan: On the most basic level, a risk-based approach to training is important because it is, in effect, mandated by the 2004 revisions to the Corporate Sentencing Guidelines. But more significant than that, addressing all aspects of training in a risk-based way from content development/selection and identifying trainee populations to setting training schedules is essential to mitigating the prospects of unlawful and unethical activity, since such prospects themselves are inherently risk-based. Regardless of the C&E area at issue, the possibilities of violations are not spread equally throughout an organization. Wrongdoing which, in its own way, tends to be very efficient occurs where the temptations and pressures, as well as the capacities, are greatest. So, C&E training needs to be targeted to the right audiences in the right ways to be truly effective. Beyond that, C&E risks often mutate in the same way that diseases do, and effective C&E programs must adapt to meet the evolving nature of risks. A static approach to training as with many other C&E elements will often miss the mark. So, risk-based C&E involves both identifying those parts of an organization (typically by job function, business line or geography) most in need of training on a given subject today and also trying to anticipate, in an informed way, where those risks will be tomorrow. I stress the latter because training efforts generally take a long time to plan and deploy, hence the need to truly be ahead of the risk curve. Rowe: C&E training has always been about communicating awareness of the limits within which individual employees and managers, and the organization as a whole, must operate. So, risk-based C&E involves both identifying those parts of an organization (typically by job function, business line or geography) most in need of training on a given subject today - and also trying to anticipate, in an informed way, where those risks will be tomorrow. 2

3 Why must this necessarily go beyond an explanation of laws, regulations and policies? Kaplan: The motivational component (mentioned earlier) is truly key. Employees in many organizations are overwhelmed with information. Unless a message is delivered in a way that signals its importance to the organization, and also is memorable on it own terms, the message itself is often lost. So, the very nature of C&E training itself should reflect the overall importance of a C&E program to top management, which will both motivate employees to try to remember applicable rules and, more importantly, to seek information from an appropriate company resource if they are unsure of the application of those rules to their jobs. And training should have a long mental shelf life. Those of a certain age may recall television cartoons, where in a situation of temptation, a devil and an angel appeared on a character s shoulders to debate what the character should do next. In real life, the devil whether it be a competitor or a customer or a supervisor is very present. To be an effective angel in that moment of C&E truth for the company, the training has to be memorable indeed. Rowe: From a course design standpoint, what in your view are the critical elements of a successful course, and do they vary depending on topic area? Kaplan: Above all, I believe that an engaging story is the key to making training effective. People have a great capacity to learn from stories, and over the millennia many of our most important values religious, civic, professional and other have been taught through the use of stories. Second, paying attention to modern instructional design techniques is important as well. For instance, testing a student s knowledge on a People have a great capacity to learn from stories... 3

4 topic before addressing that topic while seeming counterintuitive has been shown to work well as a means of stimulating learning. Finally, it is important not to provide too much information especially law-related information. I say this because even implicitly suggesting that employees need, in effect, to become law experts can be discouraging, and lead them to abandon interest in a topic altogether. Rowe: There was a time when companies delivered the same C&E training to all employees. Why are organizations today moving to training consistent with language, geographic location and job function? Kaplan: There are really three factors at work here. The first is the imperative of risk assessment, which we have already discussed. That is, the greater the understanding of C&E risk within an organization, the more targeted the organization s approach can and should be in identifying trainee populations for given topics. For instance, and to give a simple example, an individual working in procurement will likely have different conflicts of interest risks than a salesperson or researcher would have. Of course, as risk assessments become more sophisticated, so will the understanding of different C&E instructional needs by business line, job function, and geography, among other things. Second, there is the related but distinct phenomenon of C&E responsibilities being increasingly distributed throughout organizations. That is, in addition to being instructed not to violate rules themselves, managers and others are, to an unprecedented extent, now being tasked with affirmative responsibilities to prevent and detect violations by others. So, training needs to be differentiated this way, too such as through content which is conditional on the learners needs and circumstances with an eye toward those different responsibilities. Finally, there is a growing concern that an undifferentiated approach to training is simply wasteful, and therefore training employees in a blunderbuss manner could incur the enmity of key individuals within an organization, diminishing the effectiveness of the program as a whole. That is, in a time when many companies are asking all of their leaders to find greater operational and other efficiencies, C&E officers should be finding more efficient ways to train (whether or not it has been asked of them). Rowe: You were one of the first in the C&E field to address the issue of Tone at the Middle. What do you mean by this and why is it so critical in an organization? Kaplan: Mid-level managers are often on the front lines of meeting their companies C&E challenges closer to sources of risk than are The greater the understanding of C&E risk within in organization, the more targeted the organization s approach can and should be in identifying trainee populations for given topics. 4

5 high-level personnel or compliance staff. They tend to bear the brunt of the pressures that can lead to wrongdoing. And, for a C&E program to be effective, they are the ones who should serve as sentinels in detecting risk and be ready to respond appropriately when risk confronts them. Kaplan: Training for mid-level managers and supervisors has a number of aspects. First, one should train managers on setting an appropriate example. This should include both positive and negative examples. Second, there should be, in some instances, risk area training and communications specifically developed for managers (such as employment law). Third, managers should be instructed on how to keep an eye out for risk for instance, the C&E dangers often associated with too much pressure being placed on employees or with controls weaknesses. Finally, as mentioned earlier, companies should provide managers with do s and don ts in the context of an employee raising an ethical or legal concern. Finally, and perhaps most importantly, mid-level managers are role models for other employees much more, typically, than senior managers are. For all these reasons, assuring the right tone at the middle can be critical in determining the overall success of a C&E program. It s important to remember that, given the high percentage of concerns that, in most organizations, are raised to managers (as opposed to calls to a helpline), they need instruction on what to do and what not to do if issues are raised to them. Rowe: What are the critical C&E-related capabilities and skills that training can provide midlevel managers and supervisors? The latter area is of particular importance and complexity, so let me go into a little more detail about what I envision here. Managers need to be trained to tell employees that the matter will be investigated under the direction of the appropriate office within the company, and that the employees will be contacted shortly as part of the investigation. Otherwise, the employee may be left to wonder what will happen to her complaint, and to suspect the worst. Managers should also tell employees to keep the matter confidential and not attempt to investigate the matter themselves, as this is necessary to ensure the integrity of the investigation. Managers should, in addition, be told to take special care to avoid any response that could be interpreted as retaliatory. 5

6 This can include an unduly negative response to the employee s report, which, if coupled with other actions, can be seen as evidencing retaliation, even it this was not the manager s intent. Managers must be trained, as well, to be good listeners. They should also be instructed to immediately notify the appropriate party within the company of the employee s report unless it is within the category of matters that can be handled by the manager herself. Assuming the matter is within the investigative jurisdiction of others at the company (such as the law, human resources, audit or security departments), managers should be told not to conduct their own investigation of the issue, because doing so might hinder the company s ability to respond on time-sensitive issues and interfere with an effective internal investigation. should do so not only immediately after the training has been given but later on, too when it counts more. Learning specialists have found that there is a forgetting curve, and since no one is asked to commit a C&E violation right after taking training the answer to this question six months later may be more telling than on the day of the training itself. Second, companies should measure the extent to which training engenders questions from employees. When it comes to C&E and pretty much everything else that involves learning the sounds of silence should not be comforting. Finally, other than notifying the appropriate party, the manager needs to understand that in addition to the employee keeping the matter confidential, the manager himself must maintain the information in the strictest confidence. This again can be difficult, because good managers will instinctively want to get to the bottom of and fix problems. Rowe: Companies have become increasingly concerned to measure the effectiveness of C&E training, not only to justify budgets, but more importantly because they need to be assured that the training is positively influencing trainees attitudes and behaviors and reducing the risk of violations. What kinds of metrics might hold the greatest promise of reliable answers here? Kaplan: Companies should ask employees whether the training has helped them understand C&E challenges relating to their jobs. And they Similarly, companies should keep track of the extent to which training is referenced by employees in other C&E matters, such as calls to a helpline. Finally, companies should measure managers on the training completion rates of their employees. Note that this isn t so much an indicator of effectiveness as a way of letting managers know that training matters which, of course, serves the motivational component described earlier. 6

7 Rowe: As companies collaborate with an everexpanding number of third parties in the course of running their businesses, the benefits are countered by an exponentially increasing number of risks. In what ways can an organization most effectively deploy C&E training to mitigate these risks? Kaplan: This is an important but also tricky area. It is important because third parties, such as agents and distributors, have long been a source of significant C&E risk. For instance, in the 1980s the notorious Operation Ill Wind cases in the defense industry involved, to some extent, wrongdoing by third party agents. So did the life insurance sales scandal of the 1990s. And in our own decade many of the FCPA prosecutions have involved third parties, as have some significant financial earnings cases. But it s tricky because as a business matter not all parties can impose their C&E materials training and other on their agents and distributors. There may also be legal risks by being overly involved in setting standards for another organization s work force. So, businesses have to work within the realm of the reasonably possible. One approach is to develop a shorter version of one s own training and make it available for the third parties. Here, as elsewhere, one needs to proceed in a risk-based way. whether distribution should be the responsibility of the third party organization. Rowe: I appreciate the insight you ve provided, Jeff. Your comments make it very clear that C&E training, when executed so as to address an organization s key risk areas in a creative, engaging and memorable way, and tailored for relevant job functions, business lines and geographic regions, is becoming a significant aspect of risk management strategy. How to Maximize the Rewards * Connect training with risk assessment * Deliver differentiated content to individuals based on the identified and inherent risks of their roles * Ensure that top executives support and communicate the importance of a culture of integrity to the long-term success of the enterprise * Increase training for mid-level managers they are the role models to many employees * People remember and learn from stories use them in your training So, for a sales agent, the risks included might be competition law, anti-corruption, and honest sales and marketing practices. And, the distribution of such training raises logistical issues such as 7

8 North America 101 Morgan Lane, Suite 301, Plainsboro, NJ, 08536, USA Tel: SAIG (7244), Fax: Europe, Middle East and Africa 42 The Square, Kenilworth, Warwickshire CV8 1EB, UK Tel: +44 (0) , Fax: +44 (0) Asia Pacific Normanby Road, Southbank, Melbourne, VIC 3006, Australia, Tel: , Fax: info.asiapac@saiglobal.com SAI Global Ltd. All Rights Reserved. 8