Internal Audit & Compliance Importance of Collaboration and Skill Development

Transcription

1 Internal Audit & Compliance Importance of Collaboration and Skill Development Odell Guyton Director of Compliance Microsoft Corporation Co-Chair Society Corporate Compliance & Ethics Austin, Texas June 2, 2008

2 Agenda: The Microsoft Model

3 What is Governance? Corporate governance is the policies, processes, structures, and controls used within an organization by all involved (Board of Directors, management, auditors, and employees) to achieve its objectives in an ethical manner. - Institute of Internal Auditors

4 Complex Stakeholder Environment Business Partners Business Partners

5 US Sentencing Commission 1991 US Federal Sentencing Guidelines Key Criteria for an Effective Program Expanded Objectives (Nov. 1, 2004) Broad mandate: an effective program to prevent and detect violations of criminal law Violations of any law or regulation (criminal or non-criminal), for which the organization is, or would be, liable

6 Amended Federal Sentencing Guidelines, November 2004 Standards & Procedures Organizational Leadership & Culture of Accountability Exclusion of Prohibited Persons Training & Communication Monitoring, Auditing & Evaluating Program Effectiveness Performance Incentives & Disciplinary Actions Remedial Action/Continuous Improvement Importance of Person Responsible for the Day to Day Operation of the Compliance Program

7 DOJ Prosecution Guidelines In evaluating compliance programs, prosecutors may consider whether the corporation has established corporate governance mechanisms that can effectively detect and prevent misconduct. do the corporation's directors exercise independent review over proposed corporate actions rather than unquestioningly ratifying officers' recommendations; are the directors provided with information sufficient to enable the exercise of independent judgment, are internal audit functions conducted at a level sufficient to ensure their independence and accuracy and have the directors established an information and reporting system in the organization reasonable designed to provide management and the board of directors with timely and accurate information sufficient to allow them to reach an informed decision regarding the organization's compliance with the law. In re: Caremark, 698 A.2d 959 (Del. Ct. Chan. 1996).

8 7 Steps of Effective Compliance Establish Standards: Establish standards and procedures to prevent and detect criminal conduct Set Examples: High-level personnel of the organization shall ensure that the organization has an effective compliance and ethics program Management Integrity: Exercise due diligence and not place individuals with questionable backgrounds into positions of substantial authority Communicate and Train: Communicate the standards and procedures of its compliance to all employees and conduct effective ethics training programs Prevent and Detect: Ensure its compliance and ethics program is followed, evaluate the effectiveness of its program, and publicize a confidential system for the reporting of suspected wrongdoing Promote and Enforce: Promote and enforce compliance and ethics program consistently throughout the organization Address and Respond: Take reasonable steps to respond appropriately to criminal conduct

9 Changing Business Environment: Scrutiny In All Corners of the World U.S. and Global Environment - Public Demand for Corporate Governance US Federal Sentencing Guidelines Sarbanes-Oxley Requirements NASDAQ Listing Requirements SEC Regulations State Attorneys General Responsible Business Practices Board of Directors Accountability CEO-CFO Accountability Management Accountability Culture of Compliance / Tone at the Top Investor Confidence

10 Accounting Fraud at Computer Associates

11 Special Litigation Committee Report ( )

12 Internal Audit Vision & Mission Statements

13 MS Office of Legal Compliance Formed by BOD Resolution in 2001 Audit Committee Supervision of Compliance Activities OLC Supervision and oversight of Microsoft s global compliance activities OLC Mandate: Establish and Maintain Effective and collaborative compliance and governance programs that: Meet or exceed government standards and industry practice Integrate SBC into our business practices Promote culture of compliance and high ethical business conduct

14 Office of Legal Compliance Charter

15 Culture and Values

16 Microsoft s World Wide Code of Conduct

17 A Culture of Accountability & Trust Board of Directors Executives and managers are accountable for nurturing a culture of compliance Employees All employees are accountable for acting responsibly and in compliance with applicable laws, regulations and corporate policies

18 Collaboration and Cooperation Synergies between IA and OLC

19 Collaboration in Audit Planning and Execution

20 Fraud Prevention Culture THE GOAL: Taking fraud prevention and business ethics from a compliance initiative to a cultural mindset Shared Investigative Resource Model: FINANCIAL INTEGRITY UNIT Clear and common understanding of fraud prevention requirements and the role of management Culture of Compliance Internal Audit OLC Financial Integrity Unit Management Control Common Definition of Fraud and Understanding of Requirements, Roles & Responsibilities

21 Benefits of Shared Resource/Investigation Leverage internal audit supervision and escalation Leverage OLC privilege and legal guidance Transparency in investigation Focus on investigation resolution, control enhancement, improved governance Align with overall audit and compliance programs

22 Benefits of IA/OLC Collaboration

23 Developing Roles of IA-OLC Collaborative Effort Created the Financial Integrity Unit to develop fraud prevention, detection and investigation capabilities Conduct annual overall fraud risk assessments Perform engagement-level fraud and Standard of Business Conduct risk assessments and procedures Perform overall corporate compliance program reviews and detailed audits of specific program aspects e.g., Employee background check process Quarterly external financial reporting audits, with focus on significant estimates/je s and disclosure processes Quarterly spend abuse audits Continuous Control Monitoring (CCM) initiative Vendor compliance audits

24 Compliance Universe Laws & Regulatory Compliance Trust & Respect of Customers, Partners, Shareholders Asset Protection & Stewardship Productive, Safe & Diverse Work Environment Commitment to Global Community Applicable Laws Regulatory Compliance Lobbying Political Activities and Contributions Regulatory Investigations, Inspections, and Inquiries Responsible Leadership Product and Service Quality Communication Obtaining Competitive Information Fair Information Practices Financial Integrity; Fiscal Responsibility Use and Protection of Assets Use of Information Technology Intellectual Property Creation, Retention, and Disposal of Records and Information Assets Openness, Honesty, and Respect Diversity Equal Employment Opportunity Safety and Health Citizenship and Community Service Respect for the Environment International Business Activities Vendors Confidential and Proprietary Information Sensitive Payments Third-Party Software Anti-Boycott Requirements Insider Information and Securities Trading Export Control Conflicts of Interest Competition and Antitrust 6/3/2008 Gifts and Entertainment Purchasing Decisions and Practices

25 Microsoft Corporate Compliance Oversight and Reporting Structure 09/05

26 Future State What is next? Further alignment of risk assessment and compliance monitoring Enhance productivity of collaboration and bring other parts of compliance community into the same level of collaboration Net effect of strong collaboration between internal audit and OLC results in and enhances governance, culture of compliance, and the performance and effectiveness of both organizations

27 Reflections from the Compliance and Ethics Field: France Honest ; Trustworthy; Good Commonsense; Focused on Prevention; Cognizant of Legitimate Stakeholders Interests and Concerns;

28 Reflections from the Compliance and Ethics Field: France Ability to focus on near term as well as on far term goals; Ability to effective teach, educate to the uninformed; No ethno-centric focus

29 Reflections from the Compliance and Ethics Field: France Be a good "listener; Build credibility with Senior Executive Audience (by senior exec due to the quality of his advises, designed for buy in by the company culture) ; Develop expertise to choose the best technological tools to aid your compliance work

30 Reflections from the Compliance and Ethics Field: Europe Full international business culture focus, with broad and deep knowledge of the various businesses and main industrial PROCESSES of the company; Develop Vision/ Processes/ Communication approach; Possess an excellent fit with the CEO, enabling him or her to implement/ continuously enrich the CEO vision in the field of Ethics and Values;

31 Reflections from the Compliance and Ethics Field: South Africa You must be a role model and set an excellent example; You must be trust worthy;

32 Reflections from the Compliance and Ethics Field: New York City deep and broad understanding of the entity's business; broad-based support by senior leadership; demonstrated common sense and seasoned business judgment; demonstrate initiative and perseverance ; Understands and has experience in change management; strong interpersonal skills to influence up and down the chain of command

33 Reflections from the Compliance and Ethics Field: Seattle Lives the Company values Capable of keeping one's own Counsel Approachable, non - threatening and non - judgmental demeanor Excellent listener

34 Reflections from the Compliance and Ethics Field: Multi-national CEO CEO's are looking for someone with a very broad business perspective as opposed to being ethics & compliance centric; They don't have to understand all the segments of the business, but at least have an appreciation for all that is going on.

35 Essential skills that will never make it to a job description A top performer, well respected in one s prior field (so that one comes into the job with a reputation for excellence that will survive the inevitable backstabbing that occurs when one makes unpopular decisions) Diplomatic The ability to tactfully and discreetly help people make necessary course corrections and still save face Judgment the ability to recognize which issues are important enough to fight for (or as one of our colleagues once described it: knowing which hill to die on ) And the most important one: the ability to get another job any time. You have to be ready to leave the company rather than tolerate or rationalize unethical behavior.

36 Closing Q&A