Culture is one of those words we use a lot, but have trouble getting our hands around. At our recent Cross-Industry Compliance Leadership Summit at Deloitte University, we gave it a try. Compliance leaders from the financial services, healthcare, life sciences, consumer, energy, and other industries joined me and several of my Deloitte colleagues to discuss the challenges in culture-building that extend across disparate industries—and the common strategies as well.
The heart of the discussion focused on the notion that a culture of compliance is made up of human interactions. The right attitude can be worth more than the number of rules you promulgate. Fostering trust is a good way to earn it back. Organizations that build trusting relationships with stakeholders experience reciprocity from them.
That can be easier said than done. Many organizations define values but don’t communicate them well or often. One remedy is to make those values more concrete than words on a poster. Several of our summit participants said they build ethics and compliance metrics into the formal annual review process. “Show me a compensation system,” one participant said, “and I’ll show you a value system.”
Not surprisingly, we found strong support for the idea that culture needs top-down support and bottom-up buy-in. Senior managers need to be confident that in addition to following the letter of the law, the people they manage “get” the larger aim of a compliance and ethics initiative. That makes them more responsive to the necessary coaching and training. As for top leaders, one panelist shared, “I view sales as a big part of my job. I have to sell senior management on why this is important – why they have to do this. I don’t expect them to know every rule, policy and procedure, but if they can more easily identify values, we have a better chance to avoid a disaster.” Another executive added the importance of the tone at the top, “You have to show people the way. If it’s not important to senior leadership, it’s not important to the third level down.”
The structural aspects of compliance culture can be especially important in global organizations. As one of our colleagues observed, a person several layers down the command chain in a plant in Malaysia is not likely to call the New York-based compliance hotline to report a problem. That person has to be just as confident turning to his or her immediate supervisor to address a potential problem. Like politics, culture is local.
Asking people to behave ethically goes hand in hand with reassuring them they’ll receive support when they do. That means not only protecting whistleblowers, but it also means holding people harmless for making ethical decisions. One panelist suggested the hypothetical example of a sales representative who may be just below quota when a vendor offers a kickback to secure a contract. If the representative reports the bribe instead of taking it, will the company penalize him or her for missing numbers that quarter?
M&A transactions emerged as a special area that requires extra attention to culture and ethics. Some attendees said their organizations had walked away from potential deals because of disconnects in their values. But in other cases, those disconnects may not emerge until it’s too late. Attendees agreed that traditional business metrics still drive deals—but if you can move quickly during the early stages post-merger, typically in the first 100 days, to create a palpable marriage of culture and codes, you can send a very important message to people on both sides. It is especially important for acquired employees not to feel plundered or exploited.
One of our panelists told us compliance officers are more likely than before to be independent of the legal department. In his experience, about 65 percent of them reported to the legal department five years ago, but only about 40 percent today. Another noted that many successful compliance officers come from business backgrounds, rather than from legal ones.
That means more independence for compliance efforts, but it also introduces a new relationship dynamic that has to work well. “If you’re in an organization where legal and ethics and compliance are working together hand in glove, it can work well, and the personalities have to match. If you’re in a company where legal and ethics are in contention – where there’s a legal department and a shadow legal department – then it’s unhealthy.”
So: What is an ethical culture? During the interactive discussion, four principles were offered, based on one participant’s decades of experience in the compliance business:
It’s just as important to specify what a compliance culture is not. Asking hundreds or thousands of people to memorize complex rules is seldom the right answer. Instead, as one participant noted, the culture manifests itself as an attitude of questioning.
“We started a concept we call stop, think and ask,” he related. There are so many rules no one can know them all. But we educate people to know that if they’re uncertain, they should ask.”
For a long time, we always thought of ethics and culture as the soft stuff. It’s not the soft stuff anymore. We’ve learned that culture is the single biggest determinant of behavior in any organization, and that reputation risk is at least as serious as strategic, operational or financial risk. So as ethics and compliance officers, we have to do a better job tying what they do every day to the health and reputation of the organization. One thing we have come to learn – if you’re not managing culture, culture is managing you.
Posted by Keith Darcy, Independent Senior Advisor to Deloitte & Touche LLP on February 19, 2015.
Keith Darcy, Independent Senior Advisor to Deloitte & Touche LLP