Q&A: Rising Star in Compliance Boon Kim Fam

Q. A colleague of yours told us you once said you have the hardest sales job in the world: selling compliance. What is the hardest part of selling compliance, and where have you succeeded?

A. The phrase ‘I have the hardest sales job in the world’ was inspired by a former CEO of one of the companies I used to work for. During a national sales conference, he remarked in his opening speech after I had provided compliance training to all the sales managers that ‘this young lady has the hardest sales job among all of us here. She has a product which cannot be seen. Yet, she continues to be persistent. If she is able to convince people ethics and compliance is important, then with the great products we have, surely you must be able to sell well.’

Ethics and compliance is essentially working on shaping the DNA and transforming the culture of a company. Here are some examples I can share of what has worked:

• Inspire pride. We need to inspire the wider population to be proud to be a part of the company, no matter what role they are playing. For example, two years ago, during the peak of the pandemic, PVH welcomed its centennial year of being listed on the New York Stock Exchange. I weaved this message into compliance onboarding training by emphasizing this legacy we have inherited cannot be replicated and how important it was to uphold it in making day-to-day decisions on behalf of the company. When armed with a higher purpose, we build a team of people who naturally want to do the right thing.
• Make it relevant. In the compliance space, I think what we may be familiar with is the concept of a ‘built-in,’ not ‘bolt-on,’ approach. When I first joined PVH, I used the example of an F1 pit stop, where precision is paramount and the timing to get it right is very limited. We had a brand ambassador at the time who was an F1 racing driver, and using the pit stop example resonated very well with the audience. It was relevant and relatable, and therefore obtaining buy-in was a lot more effective as a result.
• Know when to be a compliance GPS and a compliance compass. Hui Chen, the current chief integrity adviser for the Department of the Attorney General in the state of Hawaii, stated, ‘Compliance without ethics is just following orders.’ I completely agree with this statement; what I have found to work well is emphasizing the ‘why’ in compliance (a compass) before working through the ‘what’ and the ‘how’ (a GPS). This is particularly important in developing ‘ethical muscle’ to empower everyone within all levels of the organization to make considered decisions that align with company values.
• Identify examples which will leave a lasting impact. Storytelling is a pretty powerful tool, and I can’t think of a better way to showcase examples of what could go wrong if a corporate compliance culture is ineffective.
• Be visible. This extends beyond getting a seat at the table. To be able to effectively influence, we should proactively engage with different departments. One of the challenges we continue to face, at least within Asia, is the ability to have on-site meetings. It is important to remember social distancing does not equal no interaction, as we should try and leverage tools that will enable us to continue to engage with all levels of the organization.

Q. How do you keep track of the ever-evolving compliance and data privacy landscape in all your places of business?

A. In any sustainable compliance and privacy program, ethics should be the driving force behind the decision-making process. One of the reasons why I find it extremely rewarding to work in the field of ethics and compliance is the ability to influence policies that set higher standards than what the law prescribes.

Understanding the trends and where we are heading is only part of the job. Enabling decision-makers within the organization to set higher industry standards through company vision, policies, and procedures to make a real difference in the community we operate in is what drives me in my role. In summary, if you set higher standards, instead of aiming for a pass and merely complying with the law, you can stay ahead of the curve.

In addition, working closely with different business units to understand upcoming business trends and strategy is just as important as understanding legal trends.

Q. How has your role as vice chair of the ethics and compliance committee of the American Chamber of Commerce in Shanghai, China (Amcham) allowed you to bridge the gap between companies headquartered in the West with a significant presence in the East?

A. Amcham Shanghai has 22 industry committees serving different member organizations that are either headquartered in the United States or have significant businesses in the United States. The ethics and compliance committee has leveraged the expertise of our member firms and companies, together with other industry committees, to organize panel discussions and seminars with topics of key interest to member companies.

I have hosted as well as sat on these panels. The topics have been very diverse, ranging from ethical leadership, data privacy and security, driving a speak-up culture, and discussing the social credit rating system in China. By providing timely updates and addressing member concerns through these discussions, the ethics and compliance committee has continued to stay ahead of the curve to bridge the gap.

Q. Where do you see the compliance and data privacy field going in the next 10 years, and how do you plan to stay ahead of the curve?

A. Here are some of the trends I expect from an ethics and compliance perspective:

• Foreign Corrupt Practices Act (FCPA) enforcement will continue to be an area of focus, requiring training, communication, and effective and timely investigations;
• Environmental, social, and governance (ESG) reporting will change from being voluntary. Over the course of 2021, the U.S. Securities and Exchange Commission teased proposed rules for mandatory reporting relating to several key areas of ESG, including climate change, human capital management, board diversity, and cybersecurity risk governance; and
• Inclusion and diversity will follow compliance programs, where a structure in place driven by tone at the top is key.

From a privacy perspective, similar to compliance and certainly in Asia, we have seen increasing tightening of laws, especially in relation to data subject consent, cross-border transfer consent requirements, and mandatory regulatory reporting requirements in the event of any data incidents.

Q. How do you inspire thought leaders to become ethical champions?

A.  A very wise former supervisor of mine and lifelong friend and supporter once said, ‘Everyone is Team Compliance.’ Therefore, as compliance officers or leaders of compliance functions, we should first place ourselves in the position of a compliance thought leader and be in position to influence. Here are some examples of what I have done in the past:

1. Map out your communication methods and calendar and have leaders be a sponsor for the key communications. Empower leaders by having them speak about key compliance messages in town halls. For these messages to be effective, ensure these are in bite-size pieces, simple and easy to understand.
2. Identify opportunities to showcase exemplary behavior and celebrate compliance heroes. I am a firm believer that compliance should not just be a policing function but also an inspiring one. By weaving in opportunities to highlight, honor, and recognize ethical behavior and having leaders showcasing and acknowledging such behaviors, this sends a resonating strong message across all levels of the organization that it really pays to be ethical and compliant.

Q. What lessons can be gleaned from your experience co-creating the regional data governance committee at PVH?

A. In a matrixed organization, ensuring the right stakeholders are included in decision-making is crucial. The benefits of setting up a committee consisting of the right stakeholders will ensure transparency in decision-making as well as a methodical cadence to track items towards completion. In addition, setting up a governance committee enables compliance officers to engage in different projects and truly play a hands-on role in the strategy and direction so that compliance will always be embedded in the decision-making process and not an afterthought.