Convercent All Rights Reserved.

Transcription

1 Aligning Culture and Governance for Better Compliance A new approach to Governance, Risk and Compliance that creates better policies and more engaged employees to reduce incidents

2 CONTENTS Better Policy Management Keys to Effective Training Engaging Employees with Ethics and Values Closing the Loop Conclusion 2

3 Challenge creates opportunity Most companies understand that they need a compliance program to keep up with stricter laws and regulations. But in today s business climate, a good compliance program can do more than reduce the risk of financial or legal troubles it can be a competitive advantage. Thanks to new regulations and recent violations by some of the biggest companies in the world, corporate ethics and values are under more scrutiny than ever. Five of the 10 largest corporate criminal fines in history were imposed in Employees are being encouraged to report issues directly to regulators in FY2012, the SEC received 3,001 tips to its new whistleblower hotline. 2 And the public is increasingly looking for companies with an explicitly values-based approach to doing business. However, the challenges create an opportunity: You can stand out as one of the good companies if you show employees, partners, customers and the general public how your compliance program is an outgrowth of your company s fundamental ethics and values. You may already have worked diligently to create policies, develop training programs and establish incident reporting systems and case management tools. Yet in many companies, incidents can still occur because those pieces aren t integrated. Policies aren t aligned with current regulations; training isn t tied directly to those policies; and the core ethics and values behind policies aren t reinforced with other initiatives to help employees understand what s expected of them. At Convercent, we believe it s time for a new approach to Governance, Risk and Compliance (GRC) one that s not just focused on a set of stringent rules or rote training and policy attestation steps. Instead, you can treat values, ethics and compliance as part of one continuum. That s why we ve created the first GRC application that integrates traditional compliance tools, like issue intake and case management, with a system to manage values and ethics, policies, training and employee engagement initiatives. Corporate ethics and values are under scrutiny in 2012: Five of the 10 largest corporate criminal fines in history were imposed in 2012, at the same time that the SEC received 3,001 tips to its whistleblower hotline. You can start transforming your own GRC efforts today, and this guide will show you how. We ve worked closely with our 300 customers to see first-hand what works and what doesn t in today s compliance environment. Below, you ll find specific advice on managing policies, training and engaging employees, and tracking progress toward compliance goals to help you continually refine and improve those efforts. With this new approach, you ll help employees better understand your ethics and values, so they ll have an easier time aligning their behavior with the standards outlined in your policies. That alignment, in turn, can help reduce incidents. Because achieving compliance becomes easier when you shift the emphasis from investigation and enforcement toward employee engagement and incident prevention. 3

4 Better Policy Management Policies are the cornerstone of your compliance efforts because they outline how to meet regulatory obligations. But what if you could create policies that far exceed the minimum requirements established by regulations, and instead describe how your organization puts its ethics and values into action? It can be hard to explain ethics and values to your employees. Linking your corporate culture to specific guidelines within your policies makes the concepts more tangible. For example, even though the Foreign Corrupt Practices Act allows for some facilitation payments, you may decide that the company s ethical stance recognizes no gray area and write a company policy that prohibits any gifts or payments of any kind to foreign officials. Maintaining a central database of policies and employee attestations helps you create a recurring attestation process for key policies or high-risk job types. What s more, you can use your policies to explain why your organization expects employees to adhere to a higher standard than the basic regulatory requirements. For example, you might frame sections on antidiscrimination rules and sexual harassment policies in the context of your company s core belief in the importance of treating every customer and co-worker with respect and fairness. That way, the emphasis of the document is on ethics and values, not simply on rules that employees must follow. Once written, these policies have to evolve as regulations change and the organization grows. Without proper policy management, this process can create confusion, as a company might have several different policies addressing different sets of rules, and several versions of each of those policies floating around in different formats. Here are four ideas for managing company policies in this continually changing environment: Create a central policy library that includes all current versions and tracks all previous versions to demonstrate changes over time. For example, Convercent s new GRC application automatically creates an audit trail that shows each policy s complete history including revisions, distributions and exceptions. Being able to quickly determine which version of a policy is in force at any time is crucial when you re investigating issues. You also should make this library digital and provide online access to the current version of all policies, so anyone in the company can instantly access that information when needed. Map existing policies to the specific regulations they address. This process will help you spot any potential gaps in your policies and help you quickly identify areas that need to be updated when regulations change. What s more, you ll easily be able to show how your company addresses specific rules if you re ever questioned by employees or outsiders. Develop a reminder process to prompt you to review your policies on a schedule that ensures those documents keep pace with regulatory changes and the growth of your company. 4

5 Maintain a central database of employee attestation against policies. You need some way to quickly see which employees have signed off on the required policies and which haven t. You also should track how long ago they gave their attestations. That way, you can create a recurring attestation process for key policies or high-risk job types, so no employees fall through the cracks. Keys to Effective Training The next step is examining how well you are preparing your employees to uphold your company policies. Some companies provide no training at all, and just require staff to read and sign off on a few documents. Other companies may provide some training, but do very little to test whether employees understand what they ve studied. In order to achieve better compliance, your employees have to understand the rules they re expected to follow as well as the regulatory and ethical foundations of those rules. Consider these guidelines for a training and education program that will help align your employees behavior with those policies: Make the testing engaging and relatable to real-world situations. Too many training programs simply utilize a set of PowerPoint slides with a few bullet points describing the dos and don ts of compliance. Instead, create interactive programs (either in-person or online) that involve role-playing situations, audio and video, even humor to help employees understand how to make ethical decisions in the context of their day-today activities. Test all employees after training to ensure they not only understand the rules, but also the ethics and values represented in your policies. For example, Convercent embeds testing within training modules, so you can see how well employees understand the core concepts as they progress through a course. Convercent users also can schedule post-training surveys that automatically go out to employees who ve received specific training. That way, you can send a series of questions several months after a course ends to determine how much of the training employees have retained. Maintain a central database showing every training program that each employee has passed. Also analyze training levels and scores by region or division to spot places where you may need to focus additional efforts for example, if employees in one location are consistently scoring lower on tests than the rest of the company. With Convercent, you can even be more proactive by setting up notification systems to alert you when basic training goals and thresholds haven t been met. Look beyond testing results to determine the effectiveness of your training programs. Only 46% of organizations said they track the effectiveness of their training programs, according to the Global Ethics and Compliance Program s 2012 Survey Report 3, and most simply measured policy awareness to determine whether training was effective. Instead, look to your incident reporting trends to measure the impact of training on employee behavior. If you see a post-training decline, that s a good sign your training is effective. Engaging Employees with Ethics and Values Policies and training are critical pieces of an effective compliance program, so companies often focus on those two initiatives and consider their work done. New employees get a code of conduct when they join the company and might take a training course once a year but that s the extent of the compliance conversation. 5

6 Unfortunately, that s not enough. Employees are more likely to internalize a company s ethics and values if they see them in practice every day. And the more employees internalize those values, the more likely they are to adhere to company policies. You can start this process by creating activities or initiatives that directly engage employees with your company s ethics and values. The goal is to encourage behaviors that lead to compliance, rather than emphasize a set of rules or regulations that must be followed. For example: If promoting employee health and wellness is part of your corporate culture, you might create a company-wide 10,000 steps a day program that encourages employees to do more walking. Or, if you want to emphasize workplace safety, you might create a rewards program to honor the safest locations in your company. Then, track participation rates and results of those initiatives in a way that keeps the program highly visible to the entire organization. Convercent s platform allows users to create dashboards that employees can access through computers or mobile devices to share their own activities, comments and photos related to the initiative. That way, everyone can discuss the company s progress toward its goals. You also could develop a website or intranet site that shares information and data about these programs with your employees. This kind of high-profile promotion keeps ethics and values in the forefront of employees minds, but also provides insights into employee engagement. You can easily see the degree to which specific locations or even individuals are participating with the programs, and look for places where employees need more help engaging with company values. While only 20% of organizations take a valuesdriven approach to ethics and compliance today, 40% said they are moving their compliance efforts in that direction, according to the Global Ethics and Compliance Program s 2012 Survey Report. Next, build on that engagement by making it easy for employees to discuss ethics, values and policies as part of their average work day. One of the best ways to facilitate these discussions is by establishing new communication channels for sharing compliancerelated questions, ideas and concerns. Convercent s platform, for example, supports questions submitted by phone, , website, text message and a mobile app. Say an employee is visiting an overseas vendor and is invited out to dinner. He s not sure how to respond to the offer can he accept? Does he have to pay for his own dinner? With Convercent, the employee could send that question through a mobile app that automatically routes it to the appropriate compliance professional. An alert system would notify the compliance team that there s an urgent issue, prompting them to send a response directly back to that employee s mobile device. Providing a platform that allows the employee to ask questions like this anonymously, if necessary helps prevent incidents that are caused by misunderstandings, not malice. 6

7 Closing the Loop The elements of your compliance program are not separate activities, but parts of the same continuum. Each refinement or improvement you make to one area, such as policy management, should have an impact on other parts of your compliance program, such as training programs. Likewise, problems in one area such as poor training results might mean you have to go back to your company ethics and values, or your policies themselves, to make sure you re clear about what s expected of employees. To achieve this holistic view of your compliance program, you need an integrated reporting and analytics platform that provides data on each step of the compliance program. That s why Convercent developed an integrated platform that combines ethics and values, policies, training and compliance. The value of good compliance reporting: The DOJ declined to fine Morgan Stanley for an employee s violations of the Foreign Corrupt Practices Act after the company showed that it had trained the employee 7 times and sent 35 reminders about FCPA compliance. This infrastructure allows you to: Link company values and employee behaviors, so you can move beyond basic compliance to create a dynamic, connected culture. Enable multi-channel incident reporting and case management that ensures rapid responses, escalations, investigations and resolutions. Align corporate values, internal policies, federal regulations, employee understanding and company performance. Maintain a 360-degree view of your compliance efforts to expose gaps between employee engagement and compliance, so you can resolve problems before they arise. With an integrated system like this, any time an incident is reported you can quickly assess potential causes of that behavior: When did this employee sign off on a policy? When did he last take training, and what score did he receive? What other activities has he participated in to demonstrate his alignment with company ethics, values and policies? This kind of tracking helps streamline investigations you don t have to search multiple databases, pore over separate spreadsheets, or dig through filing cabinets looking for old documents. And it can help prove to regulators that the problem was caused by individual actions, not flaws in your compliance program. Consider the 2012 case involving an employee of Morgan Stanley accused of violating the Foreign Corrupt Practices Act. The Department of Justice declined to fine the company when it saw that the employee had 7

8 been trained seven times and received 35 reminders about FCPA compliance. Morgan Stanley had the data to clearly demonstrate that this violation was caused by a bad actor, not bad compliance programs. 4 And as an investigation progresses, having an integrated platform makes managing cases simpler and more transparent. You can create a file that collects all the reports, notes, data and activities related to a particular investigation. That way, management or compliance professionals can easily monitor investigations, and check findings and recommended actions. But the real power of integrated reporting and analytics is how it helps you spot potential issues before they arise. For example, when you ve updated a portion of a policy due to regulatory changes, and you have a database of attestations against that policy, it s easy to identify which employees need to receive the newest version of the policy and provide a new attestation. There s less lag time between policy changes and policy dissemination and that lag time is when violations are more likely to occur. Likewise, if you see training test scores falling, or notice declines in other metrics you use to track training effectiveness, you might learn that key elements of your policies are unclear and need to be re-written. Your employees can help define your organizational ethics and values, and give feedback on policies and training. When they see that feedback reflected in new policies, training programs or other initiatives, they ll be more likely to adhere to those policies and stay engaged with compliance initiatives. Conclusion The world of compliance is changing, and this integrated, cyclical approach to GRC will help you create programs that can adapt to the rapid regulatory changes and increased ethical demands that companies now face. Because when you get employees more engaged with company ethics and values, you ll have an easier time keeping their behavior aligned with those polices. Better policy management will make it simpler to review and update policies in response to external or internal changes. Measuring the effectiveness of training programs will help you identify opportunities for improvement. Although it might seem like a lot of work, it s really a question of the most efficient way to use your time and energy. Because the more time you spend proactively encouraging compliant behavior, the less time you ll spend on incidents, investigations and repairing a damaged reputation. Even the qualitative insights you receive from employees can help you refine and improve your compliance programs. Encouraging employees to ask questions about policies, or creating programs that engage them with company ethics and values, creates a discussion that s less about rules and more about behavior. endnotes 1 Kaplan, Jeff Conflict of Interest. Retrieved Jan 2, 2013, from < 2 U.S. Securities and Exchange Commission Annual Report on the Dodd- Frank Whistleblower Program Fiscal Year 2012 < 3 Global Ethics and Compliance Program Survey Report 2012 < benchmarking_survey/global_survey_report2012.pdf> 4 U.S. Department of Justice News Release, 4/25/2012 < 8

9 About Convercent Convercent is the first SaaS product that modernizes the way companies bring their values, culture, policies and compliance activities together with a positive employment engagement experience. Hundreds of companies rely on Convercent to systematically align corporate values with individual behavior to create thriving, productive and compliant cultures of engaged, high-performing employees. Based in Denver, Convercent funding is led by Azure Capital Partners and Mantucket Capital. 9