Speaker 1: Greetings, this lecture module is on corporate compliance programs. One of the key issues as we think about ethics is that ethics aren't just reliant on people's goodwill and good intentions. Many times corporations have to take ethical considerations and put these into legitimate company policies called corporate compliance programs. These compliance programs are the mechanisms by which organizations ensure that their employees are behaving in the way that they deem appropriate based on ethics. These aren't necessarily laws, some of them are, but not all. But corporate compliance programs are the mechanisms by which companies re-insure that people are behaving the way they want them to. For example, if you work for the state of Illinois, particularly here at the university, once a year we have to take a refresher course about our ethics and what is appropriate for us to do and what is inappropriate for us to do based on solicitation and working hours and things like that. So it's not against the law for me to vote for a particular candidate, but it is against company policy or against state policy for me to advocate for a particular campus when a particular candidate when I'm working on campus and using my campus resources. So again, it's not against the law, but it's against the policy, the procedures that the company sets up. So we'll talk a little bit about some of the laws around corporate compliance and managing ethical behaviors and then we'll also talk about what compliance programs should have in them. The first legal issue we should be aware around issues of ethics is the Foreign Corrupt Practices Act. And as you can see there, there's a couple of really good quotes and references to what the FCPA does. It's basically unlawful for us to make corrupt payments to foreign officials or to obtain or retain business with these individuals. So in essence it means you cannot bribe someone to gain their business. Now here's the challenge that we have, and as you can see from that last point on that slide, are we at a disadvantage in countries where bribery or gifts, if you will, are part of the cost of doing business? How do you handle that and how do we address the issue that perhaps we may be at a disadvantage in order to gain contracts with foreign countries if we cannot engage in the same business practices that are appropriate in that particular country? So if we think about ethical relativism and this idea that I want to engage in a particular behavior, is it appropriate in my culture? Is my culture saying that this is okay and how come your culture says it's not okay and why is yours right and mine wrong? So there's this Western influence issue too as well that can create a problem. The other aspect of the FCPA is that it requires publicly traded companies to maintain records that accurately reflect their transactions and so if you are making payments, it should be accurately reflected what it is you're making payments for. So we have to keep good records of what it is we're doing and why because it will be, of course, analyzed and challenged. So the FCPA, while a law, also is a law that talks about unethical behaviors, it talks about bribery, it talks about not keeping accurate records of what it is that you're doing. I know a number of students that I've talked to in the past have told me that they know that their company engages in those kinds of behaviors but they present it in their record keeping as something very different than what is actually being done and that would be considered, obviously, illegal under the FCPA, however, sometimes that's the cost of doing business. So where do you cross the line? What's ethical? What's unethical? And how do we think about ethical relativism around that? Another legal issue that we should be very familiar with is Sarbanes-Oxley, also known as Sarbox or Sox. It was enacted in 2002, obviously, because of problems that happened with Enron and Arthur Anderson and some of the issues around the way that they were maintaining their records and the accounting firm certifying that these records were appropriate. So what Sarbanes-Oxley basically said is we have very clear, ethical, enhanced standards for all public companies and the accounting firms that are doing the work to certify their records and it really makes sure that the CEO and the CFO are certifying that these records are appropriate and you might say, well, didn't they always have to do that? Well, yes, they did, but now it holds that CEO or CFO liable to make sure that the integrity of those statements were, to the best of their knowledge, truthful. And so if it's found out that they knew and they certified that these were appropriate statements and, in fact, they weren't, that holds the CEO and CFO liable. So it changed our corporate governance structure a little bit. It had a huge impact on that. Something to think about. Other issues. Legal implications. There are these voluntary issues around corporate compliance. What is the company's commitment to a good ethical culture? And what is the company's values around making sure that corporate compliance and ethical compliance is considered an important part of everybody's due diligence in the workplace? What contractual obligations do we have to ensure that our employees are engaged in appropriate ethical behaviors? And so we'll get into these different kinds of compliance programs and the elements of compliance programs that are important. So the first thing that we want to talk about with respect to corporate compliance programs and what are the best standards for making sure corporate compliance programs work, they should be integrated. And it's not just any one individual is responsible, but it should be integrated across departments, divisions, different levels of the company, and also in different functional areas. So it's really important that, you know, HR has techniques to reinforce ethical behaviors within the way that they manage rewards and things like that, that, you know, marketing has these issues as well, and that all these things come, you know, play off each other. Compliance supports effective governance. So the goal here is the best corporate compliance programs ensure that governance is done well, because governance is, again, with publicly held companies is what our board of directors has to do. And so governance, corporate governance, takes on an enormous amount of responsibility to ensure not only are we behaving appropriately, but A, it keeps the regulators happy so that they're not sniffing down our back, and B, we've got employees that feel comfortable and safe around the ethical culture of the company, and the goal here is that the company is not going to be successful over the long haul if the employees are not behaving appropriately and ethically. So we get this way when we make sure, as the governing bodies, we make sure that people are engaging appropriately, it saves the reputation of the company, it makes sure that we are investing appropriately in the right behaviors so that we don't go to jail, and it keeps all the regulators off of our back. That's the goal. Corporate compliance programs also have to make sure they're tied in with business objectives. If they're not tied to the business objectives, people are going to ignore them. So they have to be tied into that. And then we have to be really clear about what is a legal issue, what is an ethical issue, and be really clear about the boundary between the two. Anything that's unethical obviously has to be really clear with respect to what our company decides is an appropriate behavior or an inappropriate behavior. The legal issues also have to be clear because if someone chooses to behave unethical, it may not put them in jail or put the company at legal liability risk. But if they engage in illegal behaviors, now we're putting the company in legal jeopardy, and that's what we have to be careful of. So we have to define the differences between the legal liabilities and the ethical liabilities and what's appropriate and inappropriate in both camps. But we've got to make sure that we have a system in place that tells us when someone steps over that line that we're clear that that line has been crossed and that we have a system in place to address that boundary violation as quickly as possible. Moving on with our discussion about compliance programs, not only do we have to have mechanisms in place to identify the boundary violations, but we also have to be able to respond quickly and appropriately to those violations. It's one thing to say, hey, I just saw that you behaved unethically, and then you ignore it. That's not doing anybody any service. So not only do we see the violation, but we also need to make sure that we have a very public and appropriate example to be made of the individuals who violate those boundaries. And we may not necessarily go into detail, specific detail, about what people did, but if someone violates a boundary, we need to make an example of them. And so we have to make sure we have clear mechanisms in place so that people feel comfortable knowing that when the boundaries are violated, A, that there's punishment, B, that there's protection for those who are whistleblowing, and also that people take what they're saying seriously. Your corporate compliance program also has to have benefits and outcomes that are absolutely unique to your company, because just because it's a benefit to your company doesn't mean it would be a benefit to mine. Just because it's inappropriate for the state to say you can vote for this person or not doesn't mean that it's inappropriate for an employee of a company to be able to say that. So it's essential that we recognize that corporate compliance programs are unique to the company, and they're unique to an industry, and they're unique to a country at all these different levels. So you've got a corporate compliance program for somebody working in the airline industry here in the United States. It's going to be very different than someone working in a manufacturing environment making shoes in a different country. So every company, every culture, every industry has unique standards, and so while there may be country standards and there may be industry standards, still from company to company there may be variances in what those policies are and how they're implemented. What are some of the benefits of doing this? Well, we want to make sure that there's trust, accountability, and integrity. So we want to make sure that the culture is enhanced by making sure that we are clear about where those boundaries are and ensuring that they're managed well. So you've got a better culture of trust and accountability, people behave more appropriately, better things happen for the company over the long haul. When we have a really good compliance program and make sure that we can prevent non-compliance even if it doesn't prevent it, it helps us to detect when it does occur. So we need to have a really good system in place to be able to deter as much behavior as possible and detect it when we need to. And make sure that when we have a non-compliance issue, because it's not an if, but it is a when, when the non-compliance issue occurs that there's a very clear mechanism in place for when that can happen. So this way we're prepared, we're ready to go, there's no questions asked, the system's in place and it happens. A good ethics program in place helps us to avoid some of the negative consequences, particularly around our image. It wouldn't be the company that is affected as much as it is the individual who behaved inappropriately. And so if the company culture doesn't reinforce those negative behaviors, but one individual makes a decision to do so, the good news is that we can kind of go in and we can address that issue and it protects us from the larger negative ramifications. Good corporate compliance programs also encourage continuous improvement. Like anything, quality, TQM, you name it. If we have to be continually looking at our systems and making sure that they're working and where they're falling apart, as we evaluate them and where they're falling apart, we need to go back and tweak and fix. So we have to be thinking about where the weaknesses are in our system and make sure that we're closing the gaps on those weaknesses. So what do we need to do to implement good corporate compliance programs? Number one, all the stakeholders need to be involved in this process. They need to know the objectives and goals and purpose of the program is. Get their voice and get their opinion on how it should look, what it could look, what's going to work, what's not going to work. Just because corporate heads have a good sense of what they think will work, it doesn't mean it'll work that way at the grassroots level. So it's important that we have some clarity from all the stakeholders, what is or is not going to work. We want to make sure that we are addressing the letter of the law, absolutely, but we're also encouraging people to engage in the spirit of the law. Because you can say, well, you know, I'm following the letter of the law, but maybe not the spirit of the law. We want both, that's the ideal. So we want to make sure that we have internal standards of behavior as well as external standards of behavior set up and in place. You want to embed your compliance and ethics risk management process into the business. So as we do risk assessment at the strategic level in the company, we want to look at where there may be gaps and weaknesses in our ethical structure. So that if we recognize that there's a hole here, that someone might find a loophole around this in order to engage in something in a way that's inappropriate, we've got to be continually looking at and trying to fix those gaps and those holes to ensure that the assessment process is accurately assessing where we may have some problems or potential issues around compliance and ethics. Leadership is a key factor. Top leadership has to, by definition, be behind this, otherwise it will never work. People also need accountability and ownership and the way you can develop accountability and ownership is ensuring that people are trained on what is an ethical dilemma, how to address these issues. They have to have knowledge about where the gaps are and where you can expect to see some dilemmas around certain behaviors. Additionally, we want to make sure that this is an open culture where people feel free to speak up. If they don't feel free to speak up, this is going to be a major problem for the company. And then we have to make sure that there's an evaluation mechanism, that we have metrics that we can assess to know whether or not people are engaging appropriately and also ensure where they are violating the rules. And also assess, even on top of that, if they're violating, how is it being handled and what are people's perceptions. All of those are absolute important factors on program implementation. How do we measure those outcomes? Obviously we have to make sure we have really good metrics that talk about governance issues, compliance issues, risk assessment, risk management issues, and the company culture. So we want to make sure that we've got a compliance and ethics approach to things that really is clear about what the measurements and the guidelines are on our metrics. What should governance be doing? What should compliance be doing? What should auditing be doing? What should risk assessment be doing as they're looking at where there may be some potential holes in the way that we do things? And then overall, what's the culture around these issues? Are people clear about what they can or can't do? Do people buy into the idea that if I do this, this is inappropriate and I can't do this behavior, this is not acceptable? So we have to be able to measure all of those elements and making sure that we've got a framework and a system in place to support those kinds of metrics. The three key areas that we're going to assess are effectiveness, efficiency, and responsiveness. And in the next slide, we'll actually address what those key dimensions, how we effectively do that with those three key dimensions. So the first element is effectiveness. We want to know the quality of the program and how effective is it. Is it designed effectively? Is it operationally effective? It's not enough to just say, oh, it's a good effective program. Effective how? Is it an effective system in the way that it's set up so that it's an easy system to implement and that people can do it? Or is it really about the outcomes? Are we actually catching what we need to catch? So it's about how it functions, but it's also about the outcomes. So it's the process and the outcome in terms of effectiveness that we're looking at. The second element is efficiency. Obviously, we want to make sure that it's not costing us more than we're catching. So we need to be looking at the financial side of this. Is it an efficient system, such that it is saving us more money than it is costing us? Is it human capital efficient, meaning is this costing employees time and effort in order to adhere to these compliance programs? Is it making it too onerous for them to be able to do it efficiently? Because we don't want it to be costing them money and time and efforts and resources and we don't want it to be an onerous system for people. Lastly is the idea of responsiveness in that are we sure that the cycle time for managing some of these issues is addressed quickly, appropriately? Is it adaptable? Does it adapt and flex based on the circumstances or is it a fairly rigid system? We need something to actually be fairly flexible and adaptable because there's no cut and dried circumstance. There are always blurred edges, if you will, in that this may seem appropriate under this condition but maybe it's inappropriate under this condition. So we need to be clear about that and make sure that our compliance program is adaptable as it needs to be as we gain more information, as we learn more, and as we sort of trial and error figure out whether or not our ethical system is working in the first place. Every time we have a new dilemma, we've got to go back and say, is this still working? Is this doing what we want it to do? So that's the issue, the basics, if you will, on the corporate compliance programs. Key culture, making sure that we understand the legal side of things but also the voluntary issues that are coming to play in terms of the company policies. What's the culture going to be like? How are we going to measure it? How are we going to ensure that this is occurring the way we want? As we think about ethical compliance programs in every company that you're going to be in, you should be thinking about whether or not it's actually doing these things or whether it's creating more work for people than it's actually catching violations.