A Few Ideas to Operationalize your Ethics & Compliance Program

According to the 2022 Ethics & Compliance Initiative Report on the state of Ethics & Compliance in the Workplace, “approximately 15% of employees in small, medium-sized and large organizations perceive a strong ethical culture in their organization” (The State of Ethics & Compliance in the Workplace - 2022 Ethics & Compliance Initiative). 

What strikes me is that this means that 85% don’t. How can we really operationalize our program so as to truly create an ethical culture? Here are a few ideas and areas to think of to operationalize everything we do:

Know Your Business In Depth

It seems obvious, but sometimes it is overlooked as we drown in other things. We need to know our business in depth to be able to tailor our Ethics & Compliance program to its reality. To do this, we can:

Leverage the risk assessment exercise as an opportunity to truly listen: our regular risk assessment is a great way to deeply understand the reality of the business in our organization, the layers and different areas of risk. Let's not make it a tick-the-box exercise but rather let's take the opportunity to spend time with the operational teams, and truly listen to the teams and what they have to say.

Spend time with your group transfer pricing team: to understand in depth the flows of funds and goods across borders in your business, and spot areas of risk.

Get some different expertise within your team: recruit someone from internal control, finance or an operational team in your Ethics & Compliance Team to get a deep view of the business realities. Internal mobilities are a great way to combine various expertises in our teams and create strong synergies.

Enable and document Ethics & Compliance process deviations: as we know the specifics of our business in depth, certain processes may make no sense to some regions or business lines or may need adaptation to be truly effective. Enabling the communication with respect to this need for adaptation and documenting them is key to enable a two way street of communication and really fit the reality of your organization on the ground. Don’t forget to document them well so that you can keep track.

Spend time with the field organization: visit the teams on the ground regularly, travel around, make the Ethics & Compliance function super accessible. Everyone in the group should know our E&C team, how we can help etc. You can’t be everywhere? Work on your Network!

Create Deep Roots for your Network Within The Organization

Understand your organization and ensure the Ethics & Compliance organization makes sense: the way we support the business needs to match the realities of the field organization on the ground, your business lines, brands, business units, regions etc. Make sure you are relevant to the business organization in your group and that you adjust your organization as your group evolves.

Leverage other functions to enable the deployment of your strategy: to do so, ensure you have in each entity or business unit a person identified within the HR, legal, internal control and other key functions. Leverage their help to roll out the initiatives and to keep the gate.

Work with Champions: don’t focus only on gatekeepers, work with a network of Champions in commercial functions. They can support the E&C Correspondents very well, and also they know the realities of the business and the risks at stake. Who better than a sales rep to speak to another sales rep? 

Leverage your network to alert you of gaps they identify: only by testing your program, processes and procedures, you'll identify some gaps or blind spots. Several brains are way more powerful than one brain to do so. Only the actual operational deployment of your program in the field organization will help you find these gaps. 

The DOJ Evaluation of Corporate Compliance Programs refers to the “Responsibility for Operational Integration – Who has been responsible for integrating policies and procedures?” This is about ensuring the rules are alive and actively implemented by the field organization. Trust your network on the ground to be your key partners in implementing the policies and procedures, and to inform you of any gaps they identify so that you can enable your program to be an ever adjusting and living creature. Make sure to document these gaps to then address them swiftly and demonstrate progress. Maybe create a KPI from the number of gaps identified and remediated?  

Measure What You Do And How You Do

Keep it simple: let's focus on a few important KPIs to measure within our scope. Involve the field organization to assess maturity and progress together over time. This will also allow you to report on your program effectively and measure progress.

Get feedback from your network: your network is key to let you know what’s going on on the ground. Make sure these communication streams are well flowing. What is working, what is not working? What should we do differently? You may want to get a pulse of the organization regularly: send regular questionnaires to your network to get measurable feedback, compare from quarter to quarter, rinse and repeat.

Always Keep a Keen Eye on How Concerns Are Handled 

How concerns are handled are a symptom of the operationalization of our program. If this does not work well, our program is sick and needs healing!

First, we want to make it easy to report concerns: give our colleagues various ways to report, hotline, in person, by entity or at group level etc.. To various stakeholders, hierarchical reporting, Compliance, HR etc. Ensure people know where to go and that this difficult move is as easy as possible for them.

Knowing where to go is not enough, the system should also be extremely transparent: how concerns are investigated, which team is in charge and what happens. We need to be serious and over-communicate with our no-retaliation-policy. If people do not dare to report for fear that nothing will happen, or worse, for fear of retaliation, our program will stay on paper.  The more we communicate about what happens afterwards, the better. And we can do so without names. A regular anonymized report about cases investigated, what happened and how things were handled is a great way to inform the organization that we are taking things wrongdoing seriously.

Once a concern is reported, handle it with care and report back: giving as much transparency as we can and as legally possible to the reporter and the subject of the investigation. We also need to ensure things are handled swiftly. The DOJ Evaluation of Corporate Compliance Programs is quite clear in asking the following questions “Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendation”?

Root cause analysis is key to truly re-integrate our learnings into your program: why did this happen? Was there a gap in the process? A misunderstanding? A lack of control? Let's take the learnings from what happened, translate them into actionable points to strengthen our program so as to ensure it does not happen again.

Examine incentives and disciplinary measures: are we sending the right signals? Is Integrity one of our core values, is E&C included in the way we assess our people? Do we effectively discipline people, and their management, when misconducts happen? This is a clear focus of the latest update to the DOJ Evaluation of Corporate Compliance Programs : "Prosecutors should also assess the extent to which the company’s communications convey to its employees that unethical conduct will not be tolerated and will bring swift consequences, regardless of the position or title of the employee who engages in the conduct". More on the impact of this update this in my next blogpost.

Lastly, asking ourselves regularly the “does it work?” probe from the DOJ Evaluation of Corporate Compliance Programs can help us keep our focus while we organize our initiatives.

I hope these few points inspired you to think further about the operationalization of your Ethics & Compliance Program. Follow Upright Solutions on Linkedin for more inspiration for your Ethics & Compliance Program!