New job? Asked to create or scale an E&C team? The starter checklist to deliver value swiftly 🚀 while staying safe ✨

Welcome to your new role! You have been assigned to create, scale-up or take on the E&C function in a new organization. Don’t know where to start to hit the ground running? In this guide we'll explore how to have an impact and show value swiftly within your new organization, while staying safe yourself.

Before you take the job, be clear on your role and set the expectations straight

As the Ethics & Compliance Officer, you are the guardian of the organization's ethical compass, responsible for designing and coordinating the implementation of, and overseeing an effective ethics and compliance program. You will be working closely with senior leadership, board members, and various departments to ensure adherence to laws, regulations, and internal policies and foster a culture of integrity. 

But you can not do it alone! You will need to have time, attention and support from all of the other functions in your organization who ultimately ensure compliance and ethical behavior. To succeed, you will definitely need to have a clear tone at the top and leading by example from the top.

Make sure to make this expectation clear before taking on the role and to have the conversation at this stage rather than later down the road: you are a project coordinator, you will need things done by the business, the business ultimately owns and is accountable for compliance with regulations and you are there to help them.

I have seen many E&C Officers leave organizations, very disappointed, because they could witness the lack of commitment to actual integrity and abiding by the organization’s values and did not want to be involved in creating a look-ok paper program. No thanks.

Many years ago, I was hunted to create the Ethics & Compliance function in a large, family-owned organization. And I could see many red flags lined up right there: regulated business in extremely risky countries, the 80-years-old president of the company, who was 'not to know about the existence of this new E&C team' combined with the message “to not disrupt the business too much”. I said no thanks. 

Once you are in: understand the organization fast, build trust early

What is your corporate and organizational landscape?

Once you are in the role, before diving into your new responsibilities, take the time to familiarize yourself with the organization's history, values, and culture. Understand the company’s objectives for the coming years, and the challenges it faces. Understanding where the company comes from and where it wants to go will greatly help craft a program that makes sense and that is tailored to this organization. 

Make sure to get a detailed org chart of the corporate structure and network of legal entities around the world. On top of that, get a good view of the important regions, operating units, where most people are located and so on, and in which legal entities they are located. 

How do you go to market? Who brings the value?

Add to your structural understanding of the group the go-to-market market and supply flows. Where are goods or services coming from and flowing to? 

Get a grip of the business power dynamics: which entities are the most important in your group and bring the most business? How decentralized is your organization? How much oversight does the corporate team have over the regions? What is the culture? Will you be able to mandate or will you need to influence step by step?

What is the human landscape? 

Make sure to understand the management team, your peers and key stakeholders. Meet with the heads of each department to understand what is important to them, explain what your role is about and define how you can work together to enable each other and a great business. Work to forge strong relationships. Listen to and understand their perspectives and concerns about ethics and compliance. Building trust early on will be vital in garnering support for your initiatives and driving cultural change down the line.

And of course, it goes without saying that if you have a team, make sure to spend ample time with them and listen to what they have to say: what has been their challenges, what is their mood and their energy levels, what do they think we should be doing as a priority? 

What is the regulatory landscape?

Review the regulatory environment and industry-specific compliance challenges that impact your new organization. Learn from past compliance violations that occurred in your organization or other organizations in similar industries. Is your industry the subject of a particular regulatory focus at the moment? Assess the lessons to be incorporated into your roadmap and help prioritize your action. 

How mature is your new organization?

Assess the maturity of your organization: are you creating a function? If yes, what prompted this decision? Have people heard about Ethics & Compliance before? What are the reporting lines of your organization towards top leadership? What are your resources and perspectives around resources for the year to come? What do people think about the role of an Ethics & Compliance team?

Develop your Ethics & Compliance Strategy and roadmap

Now that you understand the environment, it is your time to craft a well-defined ethics and compliance strategy aligned with your organization's maturity, objectives and environment. 

This could be a 3 year plan, complemented by a detailed roadmap for the year to come, organizing them in key streams (assessments, tone at the top, policies and procedure, training, due care in delegating authority, monitoring, auditing and reporting etc.) for each topic (anti-corruption, antitrust, ESG, data protection and so on) that you want to work on. This will constitute a nice basis for reporting on your initiatives and for measuring progress down the line!

Here are my 50 cents, that I had to learn the hard way: make sure to be conservative in what you can take on at once, work on priorities and adjust drastically to the level of resources available to you now.

Have a look at this article I wrote: A comparative analysis of key frameworks to promote business integrity around the world, as it will give you a good basis of actions to craft a great program step by step.

Make sure your program notably focuses upon:

• A committed senior management 
• An independent and strong E&C function, with the right skills and resources
• A solid risk assessment that helps prioritize your action: have a read at my blogpost A Guide to Launch and Run a Pragmatic Corruption Risk Assessment to stay pragmatic and avoid the common pitfalls of this terrible exercise.

• Key measures to prevent risks, including notably:

• Clear rules: your Code of Conduct and key policies and procedures.
• Effectively communicated: training of all teams as appropriate based on what they should know to perform their actions.
• Regularly monitored: to know if your rules actually work and are effectively applied, examine the incentives structures, audit regularly and so on.
• Enabling people to voice their concerns effectively.

• How we remediate risks when they happen:
• Violations are thoroughly investigated, discipline consistently applied and effectively communicated
• And of course, all learnings are made to continuously improve the system.

Make sure to present your plan and roadmap to your leadership to collect feedback and alignment on key priorities, and run it by some key peers for discussion and feedback.

Communicate your vision to your organization

It’s a common pitfall. If your vision is not communicated properly, it’s as if your strategy did not exist. We want to craft a persuasive narrative around the ethics and compliance strategy, and we want everyone to integrate it.

First, articulate a compelling vision and mission for your function. Make sure to relate this to the values of the organization. 

Prepare your pitch, to do so, have a look at my Friday tips for effective communication for Ethics & Compliance teams. Make sure your pitch is well integrated and simple enough to be understood and adopted by the organization. Ideally and ultimately, you want everybody to be able to pitch what you do.

Test your message and ensure that it resonates with employees at all levels, inspiring them to uphold ethical behavior in their daily actions. Our message needs to be relatable and easy to understand for all employees. 

Design a communication plan that utilizes various channels to reach the entire workforce effectively, mapping the functions with what you need them to do, the message that you would like them to integrate as well as their role in your plan. Transparency and consistency in your communication will reinforce the credibility of your message and its dissemination in the organization. 

Implement your program, keep teams up to date on the progress made

Work steadily on your roadmap, prioritize and make sure to start with a few quick wins that will bring nice progress that you can communicate on and that will make everyone feel good about the work already accomplished!

Stay close to all stakeholders along the way and make sure they know what is coming. Keep the excitement going, and build on this for the next program items!

Stay safe along the way

As you know, the scrutiny towards the behavior of CCOs is increasing, and we want to make sure we all stay safe. 

We know how hard it is to be the holder of the program who has to impact the behavior of other functions who maybe have more power than you, different objectives or ways of working. That’s why the support from top management in doing the right thing is so very critical.

We have seen CCOs being charged for failure to implement the required policies and procedures because of not responding appropriately to red flags (SEC, Hamilton Investment Counsel, LLC, 30 June 2022 and Jeffrey Kirkpatrick - 15,000 USD civil penalty and a 5 years limitation to practice).

The DOJ has communicated on the possibility of required certification of the program by the CEO and CCO within the framework of resolution:

“However, in instances where a monitor is not imposed and a company is required to provide annual self-reports on the state of their compliance programs, we will consider requiring that the CEO and the CCO will also have to certify that all compliance reports submitted during the term of the resolution are true, accurate, and complete." (Assistant Attorney General Kenneth A. Polite Jr. Delivers Remarks at NYU Law’s Program on Corporate Compliance and Enforcement (PCCE), 25 March, 2022). 

I think that is actually a great step forward to empower and enable CCOs in an organization: 

“By taking this step, we are ensuring that Chief Compliance Officers receive all relevant compliance-related information and can voice any concerns they may have prior to certification.”(Assistant Attorney General Kenneth A. Polite Jr. Delivers Remarks at NYU Law’s Program on Corporate Compliance and Enforcement (PCCE), 25 March, 2022).  

I wanted to close this article with a few ideas on how to protect yourself along the way while in the role:

Document

Document your roles and responsibilities: make sure there is a clear line between your role in the organization and the actual responsibility to ensure the business is compliant.

Never fail to document what you do at all times, your opinions as well as decisions that have been made and by whom. Keep all of this preciously in a dedicated file.

Make sure responsibilities and accountability are properly allocated, addressed and documented internally: who decides on what, what are the responsibilities of senior managers for each type of decision making? Make sure your Delegation of Authority framework (DOA) enables decisions to be made based on the risk levels at stake. That may involve having some decisions made collectively by your E&C Committee. Decisions made collectively tend to limit the risks of violations.

Certify

In the preparation of the accounts and annual report, it is business as usual to have each Business Unit of the Group draft a certification letter, certifying that all accounts are clear and accurate, addressing any auditor concern and so on. This is in turn certified towards the auditors by the head office. How about creating the same for Ethics & Compliance? Make sure every business unit certifies its operations are in line with regulations and - to the best of their knowledge - free from corruption. You'd be surprised to see what a signature can do to the commitment levels of your functions towards Ethics & Compliance!

Train

Never stop training yourself and your team. Invest in training wholeheartedly. The goal is that you keep abreast of what's new, while growing your skillset, so that you can alert the organization of new emerging risks, and react fast to the ever evolving landscape.

Insure

It is usually the case, but better safe than sorry.  Make sure to confirm that Director and Officers liability insurance is subscribed to by your group, generally, for all Directors and Officers, including yourself. 

In conclusion

Congratulations on taking on your new role! Your commitment to building an ethical culture and ensuring compliance is essential for the organization's success, and your great energy will go a long way. 

By following the guidance provided in this checklist, I hope you feel inspired and energized to hit the ground running, to navigate the challenges of your new role and to lead your organization towards a brighter and more ethical future!

Follow Upright Solutions Aps on Linkedin for more Ethics & Compliance content!