Disrupting ethics and compliance

We all know what Airbnb, Uber, Zappos and others did to disrupt their industries: they attacked the worst part of the customer experience.

If ethics & compliance was an industry, and employees were the customers, what part of the customer experience should we disrupt? Here are a few ideas:

Long policies written in legalese that no one wants to read or can easily understand
Risk-based training that doesn’t help anyone to do their day-to-day tasks.
A lack of transparency during and after investigations
Double standards when imposing discipline
Tolerance of retaliation

This list overwhelming and yet not comprehensive. Now is the time for this young profession to realize it is heading in the wrong direction. Changing course is easier to do today than it will be tomorrow.

And it will be less disruptive.

Thoughts from the ECI Best Practices Forum

I spent the last two days in Dallas for the Ethics & Compliance Initiative (ECI) Fall Best Practices Forum. The topic was “Building a Respectful Workplace.”

I walked away with many concepts and ideas to explore. Here are a few:

Employees used to protest (strike) only for better wages and benefits. Now, they take to the streets to decry what their employers tolerate in the workplace (e.g. Google, McDonald’s, etc.). How much internal dialog took place before this boiled over? Did the companies listen? Did the companies feel they could just ignore the complaints? How should companies change to address these concerns before they spill into the public realm?
When asked what type of misconduct they observed in the last 12 months, employees consistently place abusive behavior in the top 3 list. So why don’t we ever see this risk on an ERM mitigation plan?
The more powerful the perpetrator of wrongdoing, the more likely s/he is to retaliate against the person reporting the behavior. Do we have a process in place to monitor retaliation by executives?
Incivility in the workplace increases misconduct. Diversity in the workplace increases civility. Can we thus argue that diversity reduces misconduct?
When you strongly disagree with someone, adopt a position of curiosity.
Our fear of conflict leads us to agree with the majority. What can we do to make people feel safe in holding a different opinion? What is the point of diversity if no one is willing to speak up?
Take this test to find out your implicit associations about race, gender, sexual orientation, and other topics: https://implicit.harvard.edu/implicit/
The science shows that the psychopath “top performers” are actually not helping the organization reach its performance goals.
Every company has some leverage over a segment of society. Why not use it for good?
“A solution should not cost more than the problem.” Is this a valid argument only when you put your shareholders at the top of the list?
When having a difficult conversation, separate the people from the problem. Be soft on the people and hard on the problem.
When asking questions, decide if they are in service of the other or of you.

We are in the business of changing behavior

Many E&C professionals struggle to answer the question “How do you measure the effectiveness of your program?”

The research conducted by the Ethics & Compliance Initiative (ECI) offers a simple answer: use employee surveys to measure the following four outcomes of any program:

Whether employees feel pressure to engage in misconduct
Whether employees have observed misconduct by others
Whether employees are willing to report misconduct
Whether employees fear retaliation for reporting misconduct

You can use the same outcomes to measure the effectiveness of one aspect of your program. Say you want to measure the effectiveness of your E&C training. You can measure these outcomes before and after your training. If the scores go up, your training was effective. If the scores don’t change, your employees might be smarter but their behavior hasn’t changed, which means your culture hasn’t changed, which means your training wasn’t effective.

We are in the business of changing behavior, and there is a science to it.

Culture assessment and risk mitigation

In 2007, the Ethics & Compliance Initiative (ECI) demonstrated that there are two drivers reducing risks in organizations: a robust compliance program and an ethical culture.

The ECI research found that you need both drivers to effectively reduce risks; that it is more effective to start with building a compliance program; and that once you have a robust program in place, the effects of an ethical culture on reducing risks are greater than the effects of the compliance program.

These findings, especially the last one, should be considered when creating or deploying employee surveys. Many organizations with robust compliance programs are asking survey questions that focus solely on the program and ignore the state of the culture. These organizations are missing an opportunity to improve their culture and to significantly reduce their risks.

These two drivers (programs and culture) produce four positive outcomes. Good survey questions will measure these outcomes and, at the same time, the culture. The outcomes are:

Fewer people observing misconduct
More people willing to report observed misconduct
Fewer people feeling pressured to commit a misconduct
Fewer people perceiving retaliation as a result of reporting misconduct

Every organization should be measuring its program and culture. And for those with robust programs, a focus on culture, in these times, is sorely needed.

On investigations

One of the best ways to show your employees that we care about them is to take action when they report improper behavior.

When thing go badly in the workplace, a robust investigative process and timely feedback can make a huge difference for the reporter.

No matter how long an employee works for us, they will vividly remember the time they reported wrongdoing and the ensuing investigation. It will stand as one of the most emotional moments of their career. Their courage to speak up should be rewarded with a thorough investigation and protection from retaliation.

Preventing harassment: involve the supervisors

Ten years ago, I led a team of about 100 ethics & compliance officers for a large multinational. Whenever one of them reported that “things were quiet” (i.e. they weren’t receiving allegations of wrongdoing to investigate), I would tell them to get invited to various staff meetings and to provide a short training on conflict of interests. This simple exercise was guaranteed to generate work.

In today’s climate, I would advise them to provide a short training on respect in the workplace. To cover issues related to bullying, discrimination, harassment and retaliation. That ought to generate work as well. And I would recommend one additional feature: make sure the group leader is involved in the training. Having her speak up on the importance of treating each other with respect will get employees to think about the culture of the organization as well. They’ll have a better sense for what’s acceptable and what’s not.

Of course, the goal is to create a culture where harassment doesn’t take place. But, at a minimum, we should want a culture where employees feel comfortable reporting harassment when it happens. The first place they’ll look to for comfort is at their immediate chain of command.

ECI Best Practices Forum – Fall 2017 – Day 1

Yesterday was the first day of the 2017 Fall Best Practices Forum, put together by the ECI. The topic: Creating a speak-up/listen-up culture. Here are some of my meeting notes:

Science shows that “telling” is instinctual and “keeping quiet” is learned.
- Babies as young as 14-months old can communicate to their parents when something is wrong (e.g. they will cry if an older sibling steals their cookie while mom is not watching to get her attention). But…
- Kids as young as 4-years old have already learned that “no one likes a tattletale”. This is reinforced during school years, on TV, and in the workplace.
Thus, managers…
- Should assume that employees want to report.
- Should be educated on recognizing and responding to reports.
- Should let reporters know that it was a good idea to come forward
Organizations should share how reporters make a difference and protect them
- Reporters are 32% more likely to come forward if they know it will make a difference and 40% more likely if they know they will be protected
- Reporters use a 2-step analysis
  - Are there potential repercussions for me personally? If yes, shut-up. If no…
  - What is the cost/benefit analysis? E.g.: Will anyone care? If no, shut-up.
- Reporters want to know what will happen if they speak up. We need to demystify the process. KPMG has done that successfully with videos from their CECO demystifying intake, investigations, retaliation protection, etc.
  - KPMG videos explain, with statistics, why it is not as effective to report anonymously (harder to protect, to stay in touch, to investigate).
  - Reporters are less likely to trust senior leaders. The greater the power imbalance, the lower the trust. That’s why supervisors are key.
  - Reframe the conversation to describe reporters as loyal to the organization
- Employees working in organizations with a helpline report more than others – but they barely use the helpline! There is a lot of speculations as to why that is.
- Managers need to learn to listen.
  - On average, managers interrupt their subordinates within 17 seconds of the start of a conversation.
  - What makes it difficult to listen attentively is, in part, that the brain can process 1,000 words per minute while people speak an average of 150 words per minute. The extra brain power is spent on distracting thoughts.
  - Listening requires significant effort.
  - In brainstorming sessions, allow employees to “pass” and go back to them later.
- Retaliation
  - Most retaliation is “social”.
  - 80% of retaliation happens within 3 weeks of a report.
  - When organizations take extra measures to protect the reporter of a significant allegation, it is perceived as retaliation by the reporter!
- Quarterly performance meetings can be more effective than annual reviews because it is easier for employees to discuss issues that happened recently.
- Miscellaneous quotes
  - “The best employees are the ones asking the best questions.”
  - “Some people believe they are doing the right thing because they are not asking the right question.”
  - “Managers focus on complexity, leaders focus on change.”
  - “Crises are situations that draw out heroic actions.”
  - “The CEO is the curator of culture.” – Microsoft CEO
  - “Think of trust as a credit score, with the lenders being your stakeholders.”
  - “Culture is the immune system of your organization.” – Huffington
- Recommended books
  - Nudge
  - Riding the waves of culture

Life is a long game

We have all forgotten our phone or wallet in a public place before. As we hurry back in a panic and call a friend to tell her all about it, she might try to calm us by saying something like: “You wouldn’t steal someone’s phone, would you? So don’t assume yours was stolen. I’m sure it’ll be there.” It’s a hard reality to swallow at that moment but most of us don’t know anyone who would steal a phone they find at Starbucks.

The same is true of retaliation. There are times when we should speak with a colleague about a behavior they should change. But we often stay quiet for fear of retaliation, especially when that colleague is higher on the food chain. Meanwhile, if someone approached us with respect and a true desire to help, we wouldn’t retaliate, would we?

In both cases, our response is understandable because the stakes are high. Losing a wallet or a job can be a nightmare. So we forget that the odds are in our favor and play the short game.

But assuming that others are bad is a losing strategy in the long game of life.

Carthago delenda est

Cato the Elder was so convinced that Carthage had to be destroyed that he called for its destruction at the end of every speech he gave – whether or not the speech was about the city. That’s what I call focus.

What should E&C professional focus on? What is our Carthage that must be destroyed?

For years, I have argued that it should be retaliation. When retaliation occurs, employees no longer speak up. Risks become invisible. The organization become vulnerable.

But what gives any employee the temerity to retaliate against another? Beyond a twisted sense of justice, there is often a belief that the victim will not speak up, and that even if he does speak up the perpetrator will get away with it. In other words, the organizational culture supports retaliation.

Perhaps retaliation is our Carthage. If so, its destruction will require a special weapon: a strong ethical culture.

It’s time to suit up.

Whistleblower thank-you speech

In light of the investigation of Barclay’s CEO by the British authorities, here is a sample speech that executives can use after receiving an allegation from an anonymous whistleblower:

“We recently received an anonymous allegation of wrongdoing by the company [include details as necessary].

First, I would like to thank the person who had the courage to bring this to our attention. We can’t address the risk we don’t see. Every employee is encouraged to speak up when they see something wrong. In doing so, you are protecting the company from further and greater harm.

Second, I want to assure you that when you protect us so, we will protect you. We will not tolerate retaliation of any kind against anyone who reports an actual or suspected wrongdoing in good faith.

Finally, please note that I instructed everyone involved in the investigation to refrain from any inquiry attempting to uncover the identity of our source. It simply does not matter who raised this issue. Trying to find out who they are can only break the trust we have with them – and with all future sources. That’s a risk we do not want to take.

We are committed to finding the truth about what happened. Only the truth will give us a shot at improving how we do things.

Thank you.”