How to create an effective ethics and compliance process

Download PDF >>

An effective ethics and compliance process helps companies meet compliance regulations, including the Federal Sentencing Guidelines and offers distinct business advantages. Growing data demonstrates a link between ethical business cultures and corporate success, and indicates an ethical culture enhances business performance. Benefits include reduced risks and costs associated with noncompliance; stronger relationships with customers, employees and partners; increased revenue and shareholder value; and an enhanced corporate reputation.

To achieve these results, leading organizations build ethics and compliance into a cycle of oversight that promotes a culture of principled performance throughout the business operation. A business process approach to compliance proactively manages ethics and compliance risk throughout the lifecycle of: define, prevent, detect, respond and evaluate.

Define legal and ethical risks.

In performing a risk assessment, companies should understand the nature and scope of the obligations they face. Conducting legal research helps ensure the company has an accurate understanding of its legal responsibilities, including those in each jurisdiction in which it plans to operate. And conducting it proactively helps the company anticipate noncompliant incidents, avoiding costly last-minute legal research in response to investigations or litigation.

In addition to a legal assessment of risk, the definitional phase also includes an internal process to identify both enterprisewide and specific risks applicable to individual operating units, locations, employee groups or employees.

An effective risk assessment engages managers and employees at various levels to ensure all risks are identified and fosters a sense of personal awareness and accountability at the individual level. Such a team may include professionals from multiple areas of the company, including individuals from compliance and legal, as well as leaders from various operating units and functional areas and even staff-level employees. This team approach also offers valuable front- line insights into how legal, ethical or compliance failures can occur.

Next, the team performing the risk identification process must cross- reference and rank the data gathered to build a complete profile of the company’s ethical and compliance risks. It can be especially valuable at this time to correlate risks to specific employee groups and levels. This “match-up” list becomes the basis for more effective education and communication programs that target specific groups, or even individual employees, to reduce such risks.

The definition phase should not be considered a one-time exercise. Assessing risk must be a dynamic, continual process that requires an organization’s ongoing attention to be as comprehensive, accurate and effective as possible.

Prevent risks from becoming liabilities.

Top executives play a very important role in risk prevention by living and acting on the values and behavioral standards to which the organization aspires. This concept is often referred to as “tone at the top,” but research indicates that “top” is relative to where an employee sits within an organization. The tone from a middle manager may be equally, or perhaps more, valuable since employees tend to follow the behavior of their closest managers and colleagues. Thus, both leadership and management must constantly reinforce the company’s values through their communications to employees and their behavior.

Another valuable way to mitigate ethics and compliance risks is to create and publicize an effective code of conduct. The most effective codes clearly communicate the organization’s values to employees such that, when faced with a dilemma, they are in a better position to navigate the gray areas because they understand the company’s expectations for appropriate behavior. However, a code is of no benefit on a shelf or in a desk drawer. To be effective, the code’s messages must be continually reinforced through communication and education programs.

Leading companies skillfully use education to raise awareness and understanding, communicate corporate values, set expectations for ethical behavior, clarify legal issues, address consequences and provide employees with the necessary information to make good decisions. The best education programs actively engage employees in interactive, scenario-based learning that encourages them to think critically about the issues, not just memorize a list of rules by rote.

Finally, codes of conduct and ethics education should be supported by a “certification” mechanism that emphasizes the employees’ role in preventing risks. A certification entails employees confirming their compliance with regulations and policies and disclosing potential instances of noncompliance.

These elements – tone at the top, codes of conduct, education, certification – all work together to help prevent ethics and compliance failures while providing a solid infrastructure that supports the formation of ethical, self-governing corporate cultures.

Detect ethics and compliance issues before they become serious matters.

In particular, helplines have become widely used since the passage of the Sarbanes-Oxley Act of 2002. Helplines provide an easy and confidential way for employees to report possible wrongdoing while protecting themselves if they wish to remain anonymous.

To work as intended, employees must feel comfortable using these tools. Earning trust through active communication is key. Managers should communicate the value of the helpline to the workforce and provide specific details and examples of how it works. Employees also need reassurance from the start that their identity will be protected when they use the helpline anonymously, that they will not be subject to any form of retaliation and that the company will respect and respond appropriately to their report.

Certification and registry systems are other effective tools to monitor and detect potential compliance problems. In a certification, employees acknowledge receipt of policies, procedures and codes of conduct; affirm compliance; and explain instances of potential nonconformity or conflict. Leading companies now use automated programs to manage and track certifications efficiently and effectively. In addition, an effective certification process targets specific employee segments and develops a focused process for each segment to address high-risk areas.

Leading companies establish rules to quickly classify reports based on their nature – financial, personnel, environmental, etc. – and their potential seriousness. The allegations can then be routed to the right channel for investigation, whether this is to the audit committee, the risk and compliance team, human resources or outside counsel.

An effective incident management system also includes clear policies designed to protect the integrity of investigations, guard against retaliatory actions and document and report findings to all key stakeholders. In addition, companies must respond to ethics and compliance violators consistently, applying the same procedures and corrective actions to each individual, regardless of whether the allegations or findings of wrongdoing involve executive or staff-level employees. Corrective actions might range from something as simple as additional education to something far more serious, such as immediate termination for violating guidelines or laws.

Evaluate risks and continually improve process management.

In this phase, companies need performance measures to assess the effectiveness of their risk management efforts. The selection of specific measures depends on which goals are most critical to the success of individual programs, the ethics and compliance management process, and the business as a whole. For example, a company might gauge the effectiveness of its education program by measuring whether there is a reduction of related incidents.

Having chosen which performance measures to track, companies establish baseline measures to capture the current status of their programs and then use these baselines to provide comparative historical data to track. Companies can then benchmark qualitative and quantitative performance measures among their own business units – or chart progress against peer companies with recognized ethics and compliance programs – to set new goals for the future.

Many new technologies are now available to support this integrated approach to compliance and ethics management. Leading companies are increasingly using automated, comprehensive governance, risk and compliance tools integrated with an electronic management dashboard. Such tools provide a centralized capability for synthesizing data and evaluating the cultural health of the organization at any given time.

By following a business process approach and using technology, managers can arm themselves with the information they need to make better decisions, manage risks effectively and improve the overall performance of their compliance and ethics process.