Companies and CCOs are starting to get the message – the best and most effective control against code and legal violations is a culture of ethics and compliance. Those are high-minded ideals for high-level executives. The C-Suite likes to embrace these ideals but the C-Suite needs to recognize a couple of realities – a culture of ethics and compliance does not occur overnight and does not result from rhetorical videos of them pronouncing the company’s commitment to ethics and compliance.

A culture of ethics and compliance depends on high-level commitment, actions, statements and conduct, not rhetorical flourishes and town hall statements of commitment. It is a commitment that permeates every day and every action or inaction taken by senior executives, middle level managers and every employee. It becomes the fabric of the company, the identity of the company and the picture the company presents internally and to the outside world. It becomes the definition of the company and its operating credo.

A culture requires attention. Almost every action or inaction has to be filtered through a lens which asks – Is this the right thing to do? It becomes a part of every business decision.

I know this sounds like it is suffocating or overwhelming to a business, but trust me it is not. It is a culture and a discipline at the same time. With time, it becomes a significant asset.

To get to that point, a company has to attend to its culture. That requires a company to begin with a number of questions:

• What is our culture and how do we want to define it?
• How can we communicate our culture?
• What steps can we, as senior managers, take to communicate in actions and words, our commitment to our culture?
• How can we ensure that business decisions are made consistent with our culture?

With these questions in mind, a CCOs challenge is then to take that culture and develop strategies to instill the culture in company operations. The CCO is the ambassador for the culture, the advocate and eventually the administrator of the culture. It is up to the CCO to promote, install and manage the culture.

The CCO’s obligation is to continuously monitor the company’s culture. There are two ways that a CCO can do this – first, the CCO has to report to senior management and the Board on the company’s culture. Second, the CCO has to measure the company’s culture and report on these measurements to senior management and the Board.

The most important indicator of a company’s culture is not how many complaints were received on a hotline or whether or not internal investigations are being completed within a reasonable time period. The most important indicator of a company’s culture is the measurement of the company’s culture – try that on for size, a real tautology.

A company’s culture can be measured in a variety of ways – employee surveys, not just across the company, but in targeted high risk areas. If a company has a huge operation in Russia, the first thing I would recommend is an employee survey in Russia. Then I would report the results to senior management and the Board so that they know what our controls look like in Russia. Will our culture prevent employee misconduct or not?

I may supplement a survey with several focus groups to isolate themes that may appear in the survey results. I may interview key players in my Russia operations to learn what they are observing in the Russia operations. All of this combines to form what I call – a culture audit – something that needs to be done more frequently as a high priority for every CCO.