While the cat’s away

By Patricia J. Harned – Chief Executive Officer, Ethics & Compliance Initiative

When I was 10 years old, my mother took a full-time job in a nearby office so that she could provide a second source of income for our family. My siblings and I were old enough not to need a babysitter, so every day after school we became ‘latch-key’ kids – at home without supervision.

We were never big troublemakers as children, so there was no great risk that we would set the house on fire or cause some other calamity. Nevertheless, without fail, every afternoon the phone would ring at some point while we were home alone. When one of us would answer, my mother would inevitably be on the other end of the line explaining that she was calling ‘just to say hello’. Now, we might have been young kids, but my siblings and I all knew what she was really doing. She wanted to check up on us.

Nowadays, I meet leaders who have a similar perspective as my mom did, way back when. I have met CEOs who routinely call their offices while on travel, simply to be sure that their employees are actually working. I have heard other executives confess that they occasionally call remote employees, just to be sure that they are not ‘working’ while on the golf course. As leaders, we tell ourselves that it is all part of the effort to ‘trust but verify’ that the organisation is operating according to plan. However, on some deep level, I suspect that every one of us cannot help but wonder whether there is also some truth to the adage that, no matter how kind-hearted and trustworthy our employees may be, ‘when the cat’s away, the mice will play’.

We are not completely crazy to think that way. Despite the fact that most organisations today have established codes of conduct to set out their policies and standards for workplace conduct, and even though most supervisors say that their employees are committed to ethical conduct, each year an average of 44 per cent of workers at all levels say that they still observe at least one act that violates those standards, or the law. Thus it seems that, even if the cat is present in the workplace, the mice still play.

Importantly, however, levels of workplace misconduct have decreased by 25 per cent in the United States since several prominent regulations have been enacted; namely Sarbanes-Oxley, Dodd-Frank and a number of industry-specific requirements for corporate compliance programmes. Prior to the passage of those regulations, as many as 55 per cent of employees said they observed some type of wrongdoing in a given year. What has mattered is not that the regulations existed, but that companies established the systems and controls that are linked to the reduction of workplace wrongdoing. Those systems were prescribed by regulatory requirements and enforced when violations occurred. So, there is also some truth to the idea that we need the regulatory and enforcement cats to stay.

Is the cat going away?

Lately, I have received a number of calls from journalists asking me about the implications of what, so far, appears to be a loosening of US enforcement against corporate violations and the potential for the repeal of some of the legislation that has clearly influenced corporate conduct. There are some legitimate reasons for eyebrows to be raised. For example:

• Wall Street regulators have imposed far lower penalties in Trump’s first six months of office than the Obama administration’s initial six months
• So far, the Trump administration has collected about 60 per cent less money in fines from companies for violating pollution-control regulations compared to the same period of the past two presidential administrations
• The only regulatory settlement that one of the biggest corporate scandals this year – Wells Fargo – has faced out of legal claims totalling $3.3billion has been a $185million settlement with Consumer Financial Protection Bureau (lead regulator), the Office of the Comptroller of the Currency and the LA City Attorney
• The House of Representatives passed a bill in March that would substantially reduce private litigation by consumers against corporations and another bill in June that could undo significant portions of Dodd-Frank

Taken together, it comes to mind that once again, we are all concerned that we might be witness to the proverbial enforcement cat going away – and the likelihood that the corporate mice will begin to play in ways that we do not want them to.

That worry may be well-founded. After all, the majority of these regulations were established as a result of corporate misdeeds. Sarbanes-Oxley didn’t exist until a rash of corporate scandals took place (Enron, Tyco and Comcast among them). Thanks to the financial crisis, the same was true for Dodd-Frank. Even Chapter 8 of the US Federal Sentencing Guidelines – the framework that has in many ways become the de facto standard for ethics and compliance programmes – did not exist until judges were in need of guidance in sentencing of corporations that had been convicted of a crime.

So, it begs a few questions: if the tides are turning and regulatory and enforcement efforts continue to recede, how should boards think about ethics and compliance in their organisations? Should they shout for joy and count the cost savings for lack of a need of internal controls? Or should they double down on their programmes for fear that if the cat is going away, the mice will begin to play?

Double down

One need only think of Uber, Rolls-Royce or Volkswagen to appreciate the need for boards to remain vigilant in insisting upon strong ethics and compliance programmes in the organisations they govern. In each of these instances, we have yet to see what will come from enforcement actions for alleged wrongdoing. But already we are witness to the significant reputational loss from which these organisations now need to recover. And sadly, directors of these organisations discovered far too late that their corporate compliance programmes and cultures were not what they thought them to be.

ECI’s research has shown that when an organisation has a high-quality ethics and compliance programme in place, acts of misconduct are reduced by as much as 34 per cent. These programmes include the following:

• A code of conduct, or other form of written standards
• Training of employees on what actually constitutes corruption
• Risk assessment to determine areas of greatest exposure
• Systems for employee reporting/raising of concerns
• Protections for employees who take steps to report (internally or externally)
• Disciplining of employees who violate the code of conduct

These efforts must be accompanied by a focus on building and sustaining a strong ethical culture in an organisation, too. Culture is not influenced by regulation; it is the result of several activities and commitments by management to:

• Communication of a set of core values that are intended to guide employee decisions and actions
• Leadership efforts to consistently talk about the importance of integrity and to model the conduct they expect from the workforce
• Supervisors’ reinforcement of the core values and the messages senior leaders are communicating
• Encouragement and reinforcement that management wants employees to raise concerns and reports of suspected corruption
• Systems in place to fairly and consistently investigate reports of wrongdoing
• Accountability of employees, regardless of the level, when they engage in corruption

From a board perspective, it is easy to prioritise regulatory requirements and enforcement activities. Yet it is important for leadership to not lose sight of the importance of ethics and compliance programmes and strong cultures, simply on their own merits. These values pay dividends. It’s been show that:

• Employee pressure to compromise standards is reduced by 76 per cent
• Misconduct is reduced by 66 per cent
• Employee reporting rises by 31 per cent
• Retaliation against whistleblowers is reduced by 54 per cent

Additionally, employee engagement increases and their overall satisfaction with the organisation rises when high-quality programmes are in place. All of these outcomes are well worth the investment of an organisation in ethics and compliance.

Become the cat

Boards should begin to think of their company’s ethics and compliance programme as being essential to business strategy, regardless of what happens with regulation and enforcement. In other words, the board should be the cat that ensures that the mice stay in line. How can they do that?

If you are a director and you want to monitor the well-being of your organisation’s ethics and compliance programme and culture, you should not allow any board meeting to adjourn unless the following metrics have been provided to your satisfaction.

1. Communication of values and standards Boards should expect that multiple efforts are underway to communicate the importance of organisational values and standards in everyday business activity. Directors should ask for metrics showing:

• Direct mention of the organisation’s core ethical values in most formal and informal communications by the CEO and other C-suite executives
• Visibility of the code of conduct and reference to policies that relate to key risk areas
• Use of multiple methods of communication to promote helplines (and other reporting mechanisms)
• Encouragement of employee reporting of concerns
• Use of incentives to recognise employee performance that aligns with the organisation’s values

2. Employee perspectives of the organisational culture Ask management to regularly gather information from employees to gauge their perceptions of the workplace from an ethics and compliance perspective. When significant shifts occur, management should be able to explain root causes and address efforts underway to resolve any issues.

Methods for this data collection can vary, but directors should be able to regularly receive metrics demonstrating employee sentiment. Ask management to utilise:

• Surveys of employees
• Focus groups
• Ambassador programmes (employees embedded in operations who serve as sounding boards)
• Internal social media sites
• External social media sites (e.g. LinkedIn)
• 360 degree evaluations and other feedback loops (e.g. evaluations of training programmes)

Reports and investigations

When cultures begin to erode, employees stop reporting wrongdoing to management.  Or if they do come forward to raise a concern about observed misconduct, employees in weakening cultures often say that they experience retaliation for having done so. This is a very serious risk to an organisation. Once retaliation begins to occur, there is a silencing effect overall. The worst thing that can happen is for the organisation to become a place where wrongdoing is taking place and employees are afraid to make problems known.

Management should be able to provide the board with a high-level summary report on a regular basis, listing the concerns that are being raised. Additionally, directors should be aware that, on average, only five per cent of reports of alleged violations are made to a formal company helpline. If business leaders are not providing insight into the reports that are made directly to supervisors or other members of management, ask them to do so.

It is equally important to monitor the investigations and disciplinary processes in place. Ask management to regularly provide an in-depth report on a few randomly selected cases. Pay attention to the:

• Length of time from the receipt of a report to the closure of an investigation
• Treatment of the employee who reported and the employee who was alleged to have committed a violation
• Consistency of the process from one case to another
• Extent to which employees involved report that they experienced retaliation for having come forward
• Root cause analysis of the problem, lessons learned by the company and changes being implemented as a result

Turnover rates

When employees are dissatisfied with their jobs, they leave the organisation. When the culture becomes toxic and trouble is brewing, they leave in droves. Ask management to provide regular reports of employee turnover, especially in key operations where performance pressure is higher.

Perhaps most importantly, as a director, the message that ethics and compliance programmes and culture are important begins with you. It is your job to insist that management continually finds new strategies, better benchmarks, or additional sources of information to satisfy the board that your organisation is aware of the observance of standards and the well-being of its ethical culture.

After all, when the cat’s away, the mice will play.

About the Author:

Dr. Patricia J. Harned is Chief Executive Officer (CEO) of the Ethics & Compliance Initiative (ECI). Dr. Harned oversees ECI’s research agenda and its networking and conference events. She also directs outreach efforts to policymakers and federal enforcement agencies in Washington, D.C., and speaks and writes frequently as an expert on ethics in the workplace, corporate governance and global integrity. Dr. Harned advises CEOs and directors on effective ways to build an ethical culture and promote integrity in organisational activities.

Dr. Harned has served as a consultant to many leading organizations, including Penn State University, BP and the New York Stock Exchange. She has testified before Congress and the U.S. Sentencing Commission. Dr. Harned has been featured in media outlets including the Wall Street Journal, Washington Post, USA Today and CNN, and has appeared on the “Diane Rehm Show.” She was selected by Ethisphere Magazine as one of the 100 Most Influential People in Business Ethics in 2014, and was named one of the Top 100 Thought Leaders in Trustworthy Business Behavior in both 2010 and 2011 by the non-profit organization Trust Across America. Dr. Harned holds a Bachelor of Science in education degree from Elizabethtown College in Pennsylvania, a Master of Education degree from Indiana University and a Doctorate in the Philosophy of education from the University of Pittsburgh.