Effective Utilization of Surveys to Improve Corporate Compliance Programs. by Andrea Falcione, JD, CCEP and Mary Snyder, Esq.

Transcription

1 Effective Utilization of Surveys to Improve Corporate Compliance Programs by Andrea Falcione, JD, CCEP and Mary Snyder, Esq.

2 2 Effective Utilization of Surveys to Improve Corporate Compliance Programs Introduction Over the past five years, the use of surveys in the compliance and ethics arena has dramatically increased. This whitepaper will provide guidance on the use of surveys as part of an organization s compliance and ethics program, discussing (i) the growing popularity of surveys, (ii) how companies are using surveys in connection with their compliance and ethics programs, (iii) the challenges companies face in both constructing surveys to generate meaningful information and in analyzing the data they elicit, and (iv) what companies are doing with the survey results. 1 Why the Growing Trend in the Use of Surveys? The current enforcement environment across the globe has provided companies with a strong incentive to assess the effectiveness of their compliance and ethics programs. Under the U.S. Federal Sentencing Guidelines for Organizations (Guidelines), a court can reduce the sentence or fine assessed against a criminally-culpable organization to some extent if it determines that the company has an effective compliance program. The theory is that, even if a company is found to have engaged in illegal conduct, it should not be penalized as severely if it had taken steps to try to prevent the violation. At the same time, a company cannot simply establish a set of policy standards and then not enforce them. A similar approach appears in many other regulatory schemes, including the UK Bribery Act, Australian Standard AS 3806, and French competition laws. 1 The pie charts in this whitepaper are based on a survey of certain randomly-selected SAI Global clients and are included for general reference.

3 Effective Utilization of Surveys to Improve Corporate Compliance Programs 3 The U.S. Government has provided guidance on required elements of an effective compliance program in Chapter 8 of the Guidelines. The eight elements outline the criteria the U.S. Government uses when evaluating a company s compliance program in the event of a major compliance failure. Among the eight elements is a monitoring, auditing and reporting provision, which requires companies to evaluate the effectiveness of their compliance program on a periodic basis. Given the fact that the remaining elements are tied closely to company risk profiles, many organizations are inclined to consider what their peers are doing with regard to the requirements. The Commentary in the Guidelines explicitly acknowledges this practice when, in discussing Factors to Consider in Meeting Requirements of [the] Guidelines, it includes applicable industry practice, and continues: (B) Applicable Governmental Regulation and Industry Practice. An organization s failure to incorporate and follow applicable industry practice... weighs against a finding of an effective compliance and ethics program. Program effectiveness is also an important component in addressing the whistleblower incentive program established by the U.S. Securities and Exchange Commission (SEC) in May Under this system, the SEC can award a whistleblower a percentage of certain criminal penalties assessed against a company under the U.S. securities laws, including false or misleading public disclosures, fraudulent accounting practices and violations of the U.S. Foreign Corrupt Practices Act. The award can be reduced if the whistleblower did not use the Company s internal reporting system. In this scheme, effectiveness has two sides. First, the company must have a bona fide system for the internal incentive to work. If the SEC does not deem the internal system effective, the whistleblower s award would not be reduced. Second, and as a practical matter, companies would prefer to learn of, assess and respond to concerns before the SEC becomes directly involved; an effective internal reporting system will encourage persons with concerns or complaints to talk to the company first. Companies have spent a lot of resources putting compliance programs into effect, adopting Codes of Conduct and rolling out programs to train employees about their Codes and ethics and compliance-related risks. Companies with evolved programs 2 are moving beyond the basics beyond checking the box on specific elements to include in a compliance program to see if their money is being well spent. Companies with evolving programs often look for a point of reference to frame the scope and extent of their program. These companies are looking for a sense of what others are doing, and a baseline for the ethics quotient of their company. Companies continue to ask how program effectiveness can best be measured. In a study conducted by Compliance Week and PriceWaterhouseCoopers in 2011, respondents indicated they used a number of different tools, including hotline activity (92%), data about employee training (89%) and audits of the compliance and ethics program (79%). But, as noted by Compliance Week (July 19, 2011), these statistics say more about whether the compliance department is busy, than about whether it is effective. Looking at a company s processes in a quantitative way only goes so far. 2 See the SAI Global Whitepaper on Compliance & Ethics Program Best Practices: Evolving vs. Evolved Programs at

4 4 Effective Utilization of Surveys to Improve Corporate Compliance Programs The results of the SAI Global 2011 Client Benchmarking Survey also indicated that many companies continue to rely on quantitative activity metrics, rather than qualitative effectiveness metrics, when measuring success. Activity metrics gauge what a company is doing in its compliance and ethics program, while effectiveness metrics gauge the outcome of those activities. By way of example, SAI Global found that more than 80% of its respondents rely on training completion rates and hotline data to purportedly measure effectiveness, while less than 30% use employee exit interviews, follow-on testing, or qualitative reporting. The former metrics serve merely to count the beans, while the latter would serve to measure the true impact of a company s compliance and ethics efforts. Surveys, on the other hand, can provide both a qualitative and a quantitative way to measure the various elements of a compliance program. Current technologies facilitate the survey process. Internet-connected workforces can be easy to reach. For employees without accounts or internet access, manually-prepared data can be collected and reported with computer-based technologies. The rapid evolution of technology has caused boards of directors and senior management, as well as government agencies, to become more data driven. Both constituencies look for more quantitative ways to measure effectiveness. Since data can be gathered and reported with relative ease through surveys, companies can craft surveys to proactively solicit the types of information these constituencies seek. The bottom line is that surveys can be a relatively easy way to collect input about a company s compliance and ethics program from a wide audience of employees, agents and third parties without requiring significant resources. For companies with limited internal resources, third parties with expertise in the survey process can offer a cost-effective way to gather the desired information. How Are Companies Using Surveys?

5 Effective Utilization of Surveys to Improve Corporate Compliance Programs 5 Evaluation and Benchmarking The role of surveys within compliance and ethics programs continues to evolve, although the common thread continues to be its immense value in program evaluation. Companies are now seeking more widespread and diverse inputs when evaluating the different aspects of their compliance and ethics programs and wish to cast as wide a net as possible in collecting that information from stakeholders. As programs evolve and gain momentum, those individuals or departments responsible for making improvements need greater visibility into what employees are experiencing and where their concerns lie. Surveys are an efficient and adaptable tool for taking a deeper dive into an organization s employee base. Regardless of whether an organization has a nascent program or one that is more evolved, there is immense value in the internal benchmarking data that compliance and ethics surveys can produce. Whether a company chooses to look at a survey s results across specific periods of time or across different aspects of the business (e.g., by geography, job function or business unit), comparison data can be very useful for assessing where there may be gaps in a program or where a program has made positive gains. In an era of shrinking budgets and greater scrutiny on corporate spending, there is a growing requirement among compliance and ethics professionals to show that their organizations employees are engaged in the compliance and ethics program and that the program is increasing employee awareness of and compliance with the company s expectations regarding legal compliance and ethics. In the same way that surveys can serve as a valuable internal evaluation tool, so too can they be useful in providing data for external benchmarking. Within the compliance and ethics arena, numerous opportunities exist for peer-to-peer comparisons of compliance and ethics efforts. One example would be through professional associations, such as the Open Compliance & Ethics Group (OCEG), Society of Corporate Compliance and Ethics (SCCE) and Ethics and Compliance Officer Association (ECOA), each of which offers surveys and distributes informative benchmarking data. Similarly, compliance and ethics partners, such as SAI Global, may offer benchmarking surveys and comparative data to their clients, and they are often better positioned to foster best-practice discussions between and among their clients. Another great resource is a compliance and ethics industry group, such as a regional or industry-specific group that offers both formal and informal avenues for information sharing. By connecting with others in a particular geographic location or industry, one can gain valuable insight into survey practices and data points that could help inform his or her own company s compliance and ethics program. Assessment In light of recent legislation worldwide, and in consideration of the updates to some influential guidelines (such as the 2010 amendments to the Guidelines), assessment activities associated with compliance and ethics have taken on heightened significance. In particular, companies have become eager to understand and solicit input from others outside of senior management and the board of directors. In addition to using tools such as interviews and employee focus groups, more and more organizations are now turning to surveys and questionnaires as a means of acquiring information from employees.

6 6 Effective Utilization of Surveys to Improve Corporate Compliance Programs One great example is using surveys to aid in the risk assessment process. For many companies, the approach to compliance and ethics risk assessment has historically been informal and limited to stakeholders with perceived visibility into the compliance and ethics issues or risks of greatest concern to the organization. However, with increased scrutiny from government regulators and a recent spike in enforcement actions (e.g., bribery, insider trading, competition law, privacy), there has been a growing trend toward involving more levels of the organization in the risk assessment process. To facilitate this expansion, companies have begun using surveys to help collect and process employee insights on risk. Through the deployment of sophisticated questionnaires covering a multitude of risk areas, those individuals who oversee an organization s compliance and ethics program can more comprehensively and pointedly identify risks across the organization. Of particular significance today, in light of the implementation of the SEC s newest whistleblower bounty program, is the value of surveys in assessing the effectiveness of a company s reporting resources. Questions can range from employees knowledge of the reporting and non-retaliation policies to employee attitudes about reporting to the confidence employees have in the existing system and stated non-retaliation policies. Likewise, the 2010 amendments to the Guidelines have prompted many organizations to assess the effectiveness of their compliance and ethics program overall. Like those organizations that have undertaken risk assessments, this collection of companies wishes to better understand how their program compares to best practices and to identify areas for program improvement. While reviewing documentation and conducting interviews with key personnel are important avenues for data collection, companies are also turning to employee surveys as an efficient and economical means of collecting vast amounts of data regarding attitudes and perceptions regarding their compliance and ethics program. Engagement Finally, surveys have proven to be, in recent years, a great method for raising employee engagement with the compliance and ethics program. In an effort to stimulate employee interest and involvement, many companies will use strategically scheduled surveys to solicit feedback on corporate culture and compliance and ethics training and communication. In some cases, companies will even launch brief surveys to employees in an effort to understand, What can we do better? In each of these cases, organizations are able to gain more insight into the effectiveness of the program while also allowing employees to feel empowered and that company is listening to them. Monitoring and Auditing Just as organizations desire hard data to help them assess their programs and measure their programs engagement with employees, empirical data also allows organizations to monitor and audit how well the program is doing. In particular, survey data can be used to measure and benchmark different aspects of the compliance and ethics program over time. While many programs rely heavily on hotline statistics, case reports and investigation summaries, companies that include surveys in their programs are able to collect year-over-year data points on all aspects of an effective compliance program. Survey data can also help a company analyze case data. Among other things, survey data can help confirm whether the reported cases adequately represent the types and amount of questionable activity at the company or, conversely, whether questions and concerns are not being reported.

7 Effective Utilization of Surveys to Improve Corporate Compliance Programs 7 What Challenges Do Companies Face? As the use of surveys within compliance and ethics programs has steadily increased in recent years, so too has the resistance in some organizations to integrating surveys into the program. Such resistance stems from an array of concerns, including legal, institutional and logistical issues. Legal Concerns In many cases, organizational resistance to surveys stems from concerns about possible legal implications that a survey might have for a company. For example, in-house or external counsel may fear that potential survey results could include discoverable information that may be undesirable for the company, such as the disclosure of illegal or unethical conduct. Counsel may be concerned about uncovering unfavorable employee perceptions of management or company culture. In other cases, a company s legal concerns in deploying compliance- and ethics-related surveys may stem from data privacy and confidentiality concerns. These concerns may relate to the collection and use of employee information (including names and s) in the deployment of the survey, the deployment itself and the receipt and review of survey data. Concerns related to the possible legal implications of surveys within compliance and ethics programs can largely be addressed through careful construction of the survey and the survey questions. Survey questions can be designed to minimize the chance that they will generate troublesome information. The introductory instructions for the survey, instructions for specific questions and pop-ups for specific responses can direct respondents to contact the Chief Compliance Officer or the company s telephone or internet hotline if they have matters of concern. And, if, at the end of the day, the survey itself generates a report, question or concern relating to legal compliance or ethics, the company should want to know about and address it. Privacy and confidentiality concerns can also be adequately covered. Some companies may have crafted their own procedures to address privacy and confidentiality concerns when conducting surveys. If not, having a third party conduct the survey can provide employees with additional comfort that their responses will truly be anonymous. Data privacy issues can also be addressed in the construction and deployment of the survey. For example, the survey might include an introductory section requiring each of the participants to confirm that they are voluntarily providing

8 8 Effective Utilization of Surveys to Improve Corporate Compliance Programs the data, after reviewing the stated purposes for the survey and how the data will be used (i.e., an opt-in ). Having the survey conducted by a party certified under the United States Safe Harbor program to demonstrate that it complies with the protections outlined in the E.U. Data Protection Directive may also help satisfy certain data privacy concerns. Finally, the use of offline surveys may also minimize data privacy considerations to the extent that they do not generate personally-identifiable data. Institutional Resistance Companies may also find institutional resistance to surveys. Some companies may simply not solicit input from employees in any formal manner as a general policy matter. Some people in the organization may perceive that surveys are a waste of time and resources. Others may feel that the organization does not have the resources necessary to conduct a survey. For those institutions that remain reluctant to do a full survey, discussions with focus groups may be a good first step. Partnerships with third-party survey providers can be an efficient way to address some of these concerns. Some, like SAI Global, provide an especially cost-effective solution, drawing on their extensive experience to deliver surveys smoothly and without disruption. They can also provide examples of the useful data that surveys can provide. Deployment Logistics Once an organization has decided to conduct a survey, it is important to establish the responsibilities of the various departments and individuals involved in the deployment of the survey. A company s compliance, legal, human resources and information technology departments may each play an important role in conducting an effective survey. Appropriate time lines, roles and responsibilities should be set. The company will need to define the group or groups who will be asked to participate in the survey. As a general rule, the participant group should be as broad as possible. The larger the group, the more statistically significant the information will be. For general risk assessments and attitudinal surveys, the broader the group the better, since the aim is to assess employee understanding of compliance and ethics standards and to understand employee attitudes at all levels of the organization. For assessments of very specific risks, deploying the survey to a more limited group (e.g., manager level or specific functional groups) may generate the most useful information. If the survey is only deployed to a specified group or groups of employees, it should include a significant percentage of that group or groups. In the event that the survey will not include all employees, participants should be chosen randomly; efforts should also be made to ensure that the participants include employees in each major group (e.g., hourly and salaried, managers, employees from each location, office and plant, etc.). For a global company, translations will typically be required. If translation costs are a problem, a shorter survey using questions the company decides are key may be a practical alternative. Specific data privacy laws applying to a particular plant or office location may also need to be addressed. Working with managers and Works Councils is often a useful if not required first step.

9 Effective Utilization of Surveys to Improve Corporate Compliance Programs 9 While online surveys are especially efficient, companies can reach employees who do not have internet access by using machine-readable paper surveys which can be scanned and collated. While this process adds time and complexity, it is an efficient and effective way to reach offline audiences. An in-person presentation incorporating wireless survey technology via hand-held clickers is also an option. Kiosk and other access points are additional alternatives; companies that provide kiosks for employee benefit matters may be able to use the same systems to provide online surveys to employees who do not have regular access to the internet in their jobs. Survey Methodology As with all assessment tools, framing the appropriate questions in clear, direct and unambiguous language is key to a successful survey. The nature of the questions will be based on the purpose of the survey. For example, a compliance-focused risk assessment would include questions designed to assess employee understanding of compliance risks relevant to their business areas, such as competition, gifts and conflicts of interest, anti-bribery and anti-corruption, financial integrity, records management and information protection. A survey designed to assess corporate culture and employee attitudes, perceptions and beliefs would cover the company s programs, policies and corporate culture and would be structured to gather information relating to employee understanding of general compliance and ethics issues and responsibilities and familiarity with company resources. Typically, a survey will include a variety of question types: Demographic questions (e.g., identifying the type of employee or nature of the business or geographic area in which the employee works) Multiple choice questions (e.g., asking for a yes/no/don t know response) Matrix questions, which offer a range of possible answers (e.g., in the last year/within the last two years/more than two years ago, or Never/Rarely/Sometimes/Often/Always/I Don t Know) Certain questions might branch into other questions. Some branches will be based on the area in which the employee works. For example, targeted competition-related questions could be sent only to employees in sales or marketing, those who communicate with employees of competitors (which can include, for example, human resource professionals) and the managers and executives to whom these individuals report. Other branches can generate more information about a specific question. For example, the employee who responds that s/he has experienced discrimination might receive follow-up questions asking whether s/he reported it and, if not, why not. A popup message providing contact information for the Chief Compliance Officer, reporting hotline or other resources and urging the employee to report the matter could follow. A company can use the standard questions crafted by a service provider, such as SAI Global, or can customize the questions in whole or in part to meet its specific objectives. A survey can also include comment boxes for specific questions or one comment box at the end of the survey for general feedback. Most companies choose not to provide for such open-ended responses, however. Among other things, this type of data is difficult to evaluate or quantify. Legal departments may also be concerned that the possible benefit of providing an opportunity for anonymous comments does not outweigh the risks of receiving a troublesome comment that can neither be verified nor effectively investigated.

10 10 Effective Utilization of Surveys to Improve Corporate Compliance Programs How many questions should a survey contain? It depends on a number of factors. The type of survey is one important consideration. As a general rule of thumb, companies may include from 15 to 20 questions in a standard ethics assessment, while a broader risk assessment survey would be longer and, with branching questions, may include up to 150 questions. For initial surveys, there is a tendency to want as broad a set of data as possible and to ask a larger number of questions. On the other hand, employees who are asked to participate may have limited time to devote to the activity, which would be a reason to limit the number of questions. Communication is an important step in conducting an effective survey. Some organizations have established a culture where employees expect to receive and respond to surveys. Many companies have not. For those companies, it will be important to establish a game plan to inform participants that a survey is coming and to encourage their participation. If the company intends to share the results of the survey with employees, it should communicate this fact (and make sure to deliver the promised communication). Who should this message come from? Messages from a senior executive and a business unit head may provide important support for the initiative. If possible, the survey should be deployed at a time that is not especially busy. Year end and heavy vacation periods should be avoided. It often makes sense to time a survey for three or four months after the deployment of a compliance and ethics initiative such as training, when it is still fresh in employees minds. One of the most effective tools to address survey fatigue or employee apathy is to share the results of the survey and show concrete actions taken in response. Alternatively, a company may choose to offer incentives to encourage participation, such as bragging rights to those managers and groups of employees who have the most completions. Mentioning levels of participation in manager evaluations may provide another incentive. When considering how to boost participation, companies must be sure not to compromise anonymity, however, if anonymity was promised to participants. Technical Concerns A number of software programs are available to facilitate the collection and organization of data generated in electronic surveys. Efforts should be made to minimize technical issues that participants may encounter when completing the survey. Coordination with the company s information technology group may be critical. At a minimum, (1) ensure that the survey itself works as planned e.g., branches work, the survey doesn t permit inconsistent answers (e.g., clicking on options as well as none of the above ), (2) assure anonymity will not be compromised, (3) white list the address from which the survey will be sent, and (4) pilot to a group of employees with a diverse set of characteristics and systems to identify and resolve technical issues that might arise during the broader deployment. Evaluating the Data Companies should strive for a 50+% response rate. In our survey experience, participation rates range from about 50 to 75%, with an average of about 60%. A lower participation rate merits further discussion since it may indicate a disconnect between the message management is trying to send and the message employees receive.

11 Effective Utilization of Surveys to Improve Corporate Compliance Programs 11 Companies need to set some basic guidelines for compiling the survey data. Consider how to handle incomplete answers, incomplete surveys and inconsistent answers, for example. As a rule of thumb, it is important to preserve as much of the data as possible and to avoid cherry picking results. There may, however, be unusual circumstances where the data received is not meaningful and can be ignored. Once the survey is closed, compile the data into a meaningful report. One useful frame of reference is to categorize the various responses based on the level of compliance and ethics risk inherent in the response. For example, responses indicating that employees do not know the ethics resources available to them to report compliance concerns would be a risky response. Alternatively, responses indicating employee awareness of the company s commitment to non-retaliation would be a low risk response. Similar breakdowns can be made based on responses to questions probing employee awareness of substantive risk areas. With this frame of reference, the data can be organized to show the number of high-risk, moderate-risk and low-risk responses. Organizing a report in this manner may also provide a useful starting point for analyzing the steps, if any, that the company should take to address the survey responses. Additional value can be derived from surveys in two ways. Benchmarking data, if available, can be useful. More valuable, however, is internal benchmarking derived through follow-up surveys. Follow-on surveys allow companies to measure whether initiatives taken to address matters raised in the prior survey have been effective. If, for example, an initial survey indicates employee lack of knowledge of the company s internal ethics resources, a company can take steps to provide additional information and reminders including posters, pens, mouse pads and the like about those resources. Subsequent surveys should provide valuable feedback as to the effectiveness of those efforts. Companies may also choose to deploy more frequent, shorter and less formal follow-on surveys using internal instant messaging tools, in-person communications and company intranet sites. In our experience, most companies are satisfied with the survey experience based, in part, on positive reactions of survey participants and the value of the information generated.

12 12 Effective Utilization of Surveys to Improve Corporate Compliance Programs What Are Companies Doing with the Results? Typically, survey results are shared with the ethics and compliance function, the legal department, senior management and the board of directors or appropriate board committee. Oftentimes, and depending on the questions asked, they are also shared with human resources and internal audit. If possible, at least some of the information from the survey should be shared with the general employee population. There are various approaches to this goal. Some aspects of the results may be discussed in a regular communication with employees or at employee meetings. An message that accompanies a training session, or a video, may be appropriate. Let employees know that they have been heard and that the survey, and the information employees have supplied, have been taken seriously. Survey results may indicate a need to provide more specific guidance in some areas. Additional policies or procedures may be necessary to address employee confusion. Regardless of the specific survey results, it may be useful to set up focus groups or other forums to discuss employee concerns and suggestions. Digging deeper provides further opportunities for the company to demonstrate its commitment to compliance and ethics.

13 Effective Utilization of Surveys to Improve Corporate Compliance Programs 13 The results may also point to a need for additional training and communication and may highlight the areas to be targeted. They may suggest a need to enhance the visibility or credibility of the company s reporting systems and processes. The results should provide specific and concrete information on the areas to target and, in some cases, survey results may indicate that no specific action is required. Regardless, it is important to analyze the survey data for information about the effectiveness of the company s compliance and ethics program. Do not simply conduct a survey and check the box. If the survey data suggests that no specific action is needed, that fact should be documented. In other cases, companies will need to address identified gaps. Conclusion As companies consider the time and resources devoted to building their compliance and ethics programs, and study guidance provided by regulators, it is clear that it is time to measure program effectiveness. While surveys are not the only tool to measure effectiveness, they can provide invaluable information, highlighting both successes and areas for improvement. Importantly, surveys can also serve as a useful tool to engage employees in the program. Making sure that employees understand and believe in the company s commitment to compliance and ethics is key to an effective program.

14 USA Europe Australia Asia Plainsboro, NJ T: +1 (877) 470-SAIG [7244] F: Warwickshire, UK T: +44 (0) F: +44 (0) Sydney T: F: Jakarta T: Waltham, MA T: F: Melbourne T: F: Alpharetta, GA T: F: Perth T: F: Houston, TX T: F: About SAI Global Compliance SAI Global Compliance is the world leader in providing organizations with a wide range of governance, risk and compliance (GRC) products, services and technology that help build organizational integrity and effectively manage compliance risk. Our global staff includes professionals and subject matter specialists in advisory services; program design, management and implementation; instructional design; and software development. Our focus is to help establish and enhance compliance effectiveness. With well over a thousand organizations as clients and tens of millions of satisfied users around the world, we work with clients to integrate a flexible suite of solutions and services specifically tailored for a business and industry. Our products include the world s largest library of compliance and ethics learning, Code of Conduct advisory services and training, and the Compliance 360 GRC Software Suite to manage compliance, policy, incident and audit management. Our Cintellate EH&S Software addresses key issues in operational environmental health and safety management. For more information, please call us at the full service location nearest you or visit 2012 SAI Global Ltd. The SAI Global name and logo and Cintellate name are trademarks of SAI Global Ltd. Compliance 360 is a registered trademark of Compliance 360, Inc., an SAI Global company. All Rights Reserved. CBMSWP1206a