“The truest measure of an effective compliance program is how it responds to misconduct.”— FCPA Guidance (2d. ed 2020)

This straight-forward statement (above) of a company’s commitment to its “effective” compliance program is powerful.  In a nutshell, it says it all.

Over the years as a federal prosecutor, and later as outside counsel, I have witnessed a variety of responses to misconduct.  On the one hand, I have worked with companies that respond vigorously in response to an allegation of wrong doing (what I term, “Let the chips fall where they may, we have to define the problem and fix it.”)  On the other, I have witnessed other companies that attach themselves to reasons not to pursue the misconduct and sweep it under the rug.

A company’s culture is a strong indicator of how a company will respond.  Those organizations that are committed to a culture of ethics and compliance will respond aggressively and with dispatch to root out a problem, understand it, and remediate the issues. This same principle applies to cultural deficiencies or weaknesses.

The Justice Department (and the SEC) have placed greater emphasis on conducting a “root cause” analysis in response to misconduct. Typically, organizations pull apart and analyze their internal controls to identify gaps or ways in which the controls were circumvented.  This is a productive exercise but leaves out a big piece – how did the bad actor or actors rationalize their behavior in the context of the organization’s culture?

This is a more difficult issue.  If an organization truly is committed to promoting and maintaining a culture of ethics and compliance, the organization will have data and other information relevant to the condition of its culture. 

For example, did the misconduct occur in a country, region or office that had been flagged for culture weakness?  Were there any other leading indicators from the country, region or office that indicated the potential risk of misconduct?  In some cases, the number of employee reports on a hotline may increase in the months before the misconduct occurred.  These are all important ways to focus on potential cultural weaknesses.

Assuming that the “root cause” of an incident includes the culture factor, it is important to analyze the nature and significance of the culture deficiency.  If survey data for the country, region or office revealed there were concerns, or perhaps there was a focus group conducted in that country, region or office that confirmed the problems with an organization’s culture, the overriding question then becomes what steps, if any, were taken to remediate the problem.

A culture weakness, like any other compliance deficiency, should be flagged for remediation, hopefully in advance of misconduct occurring. It should be treated like any other deficiency and prioritized based on risk.  If it is a minor deficiency, then it should be a lower priority than more significant deficiencies from a risk perspective.

A culture remediation strategy should be built and ultimately measured on the impact to the target portion of the organization.  The tools available for a culture remediation initiative should include: (1) senior leadership communications and in-person visits/events to promote and reinforce the organization’s culture message; (2) renewed training for appropriate audiences to emphasize the importance of culture, reporting misconduct, and commitment to maintaining a culture of ethics and compliance; (3) messaging around the misconduct, the investigation and the disciplinary results; (4) targeted meetings involving ethics and compliance staff, human resources, ethics ambassadors and other staff to provide perspective on ethics and culture issues; and (5) increased messaging through in-person and video delivery of ethical moments and other reminders of ethical culture.

These are just examples and not meant to be exhaustive.  Culture remediation provides an opportunity for creativity around messaging and ways to reinforce the organization’s overall commitment to a culture of ethics and compliance.

A key part of the remediation effort is to conduct appropriate surveys and collect other data to test and measure the remediation effort.  None of this will occur overnight but a realistic schedule for remediation and testing needs to be adopted.

This may all sound like wishful thinking.  In the end, it is a choice – compliance officers make a “choice” every day on what they prioritize, how much time to put into issues and using a risk-based approach to their own activities.  If for example, a CCO is spending days on a gifts, meals, entertainment and travel policy and reimbursement program, it is likely that other more significant risks are being ignored.  If you begin with the fact that culture is a company’s most important intangible asset and its most efficacious control, CCOs will naturally devote greater time and attention to this issue – it is the new challenge and frontier for CCOs and it is time to embrace it.