New guidelines approved by the U.S. Sentencing Commission have created tough new training standards for companies that hope to demonstrate to regulators that they have an “effective” compliance program.

The revised guidelines, proposed by an advisory group last year, made 10 modifications to the original 1991 document, which created a sentencing credit for organizations that put in place "effective programs to prevent and detect violations of law."

Among the changes is a new, stand-alone guideline that would "describe more fully those essential attributes of successful compliance programs." The new guideline emphasizes monitoring, auditing, assessing and evaluating programs. To those ends, companies that seek reduced criminal fines will have to demonstrate that they have identified areas of risk where criminal violations may occur, have trained high-level officials as well as employees in relevant legal standards and obligations, and have provided compliance officers "sufficient authority and resources to carry out their responsibilities."

The revised guidelines, approved by the USSC April 8 and sent to Congress three weeks later, will take effect Nov. 1, unless Congress disapproves them during its six-month review process.

Start Your (Training) Engines

Among the changes was the inclusion of training—and the dissemination of training materials and information—within the definition of an “effective program.”

Mitchell

“In the original guidelines the phrase was ‘information and communication,’” explains Scott Mitchell, President of the Open Compliance & Ethics Group. “What the update did was say, ‘Okay, in case there was any ambiguity, information and communication means training.’ The new guidelines have effectively made training mandatory.”

To wit, the amendment sent to Congress notes that one of the guideline’s sections “makes compliance and ethics training a requirement, and specifically extends the training requirement to the upper levels of an organization, including the governing authority and high-level personnel, in addition to all of the organization’s employees and agents, as appropriate.” In addition, it “establishes that this communication and training obligation is ongoing, requiring ‘periodic’ updates.

Jones

B. Todd Jones, an attorney who chaired the U.S. Sentencing Commission’s Ad Hoc Advisory Group that created the new language, believes the initiative will force companies to increase their overall commitment to the issues.

“You can’t just put something in writing, and place someone in middle management as the compliance officer, and sort of wipe your hands as a leader, and say, ‘We’re doing compliance,’” Jones remarked.

Details And Agents

While the new guidelines emphasize ethics training, they don’t spell out details on how organizations conduct such training. The ambiguity has led to differing opinions on what companies must do to be in compliance with the training provisions of the guidelines.

Ethics training companies have seized the opportunity, convincing companies that Web-based training is the best route to take, as the courses can be audited for attendance, follow-up classes can be scheduled automatically, and reports can be generated for audit committee review.

Whatever the mechanism, Jones—now a partner at Robins, Kaplan, Miller & Ciresi in Minneapolis, Minn.—believes the objective is self-evident: “Train people on what the expectations are and provide them with the mechanism to report to those who are in a position to take action.”

Also evident from the new guidelines is the wide-reaching mandate across the enterprise, extending from high-level personnel and members of the “governing authority,” to employees and—where appropriate—the organization’s “agents.”

That guideline echoes regulations adopted by the NYSE and NASDAQ, but goes farther in its mandate. In November of last year, the SEC approved two specific rule amendments that require most listed companies “to adopt a code of conduct/ethics applicable to all directors, officers and employees.” However, the SEC’s rule—which relates to Sarbanes-Oxley Section 406—didn’t mandate training; it simply required companies disclose the existence of such a code. In addition, SOX 406 only applied to a firm’s chief executive officer and principal financial and accounting officers.

Of interest to many is the extension of the training mandate to an “organization’s agents.”

Experts say this means that a company operating a joint venture with another firm must train the affiliated employees. Additionally, companies that utilize manufacturer’s representatives and other sales agents must include those individuals in their training programs.

The OCEG’s Mitchell notes that all sales people—even if not directly employed—should be given an ethics tutorial from the parent company, saying in effect that “As a representative of our company, you must agree to and uphold our code of conduct which also includes the sales practices in which you engage. These are the expectations we have of you in order to be a manufacturer’s representative.”

One Size Does Not Fit All

Another significant change to the guidelines is the requirement that programs disseminate “information appropriate to such individuals’ respective roles and responsibilities.” In other words, not every employee is to receive the same training.

“Training needs to be appropriate to the person’s role in the company,” explains Mitchell. “What you can’t do is take every employee and dunk them in the same bucket of compliance training, wring them off and throw them back into their job.”

To meet the requirements of an “effective” compliance program under the new guidelines, companies will; need to make sure that employees at different levels, and with different responsibilities, receive training relevant to their particular functions.

Mitchell emphasizes that one or two compliance courses won’t be sufficient for a typical corporation. “If you take a salesperson and start training them on hazardous materials handling because you have just one compliance program for every employee, you will probably be viewed as not administering or discharging your training program thoughtfully.”

This requirement to essentially customize the training for particular employees may catch a few companies off guard. $6.2 billion EMC, for example, may need to develop new training modules for the firm’s various roles and titles. According to Mark Link, the data storage company’s chief accounting officer, EMC has been training employees on ethics for several years, but current company-wide training consists of the same exam given to all of the firm’s employees.

The Giant Task Ahead

Implementing compliance training throughout multi-national corporation could pose resource and logistical headaches. However, many large firms are not that far behind the curve.

“Most Fortune 500 companies have been developing ethics offices and ethics practices for about ten years now,” states Pam Ivey, founder of CSR Group in Austin, Texas, and a consultant on corporate ethics. “What they’re doing now, with all the new regulations, is just strengthening what they had in place.”

One such company is DuPont. Last year, the $26.9 billion chemical maker began rolling out a company-wide initiative designed to educate the 37,000 of the company’s 55,500 employees that spoke English and had computer access.

Using Web-based training modules created and customized by an outside vendor, DuPont has a dozen different compliance and ethics training courses available. According to experts, DuPont’s decision to outsource was not unique—most companies hire third-party experts with an expertise in ethics training to maximize impact and deployment speed.

Every employee at DuPont takes two of the training programs, and the company also requires every sales team member to complete the anti-trust module. Business unit managers are further advised to choose additional training modules appropriate for their functions.

From the outset, DuPont insisted on developing a culture of compliance, and created an in-house marketing team to spread the word. The firm named its training web site “Legal Eagle,” and created posters, gifts, pins, and certificates displaying the Legal Eagle mark.

And while EMC allows for simply a passing grade on its program, DuPont insists that employees keep taking training exams until every question is answered successfully.

According to Marjorie Doyle, DuPont’s Associate General Counsel and head of the compliance department, anything less than 100% may compromise the firm’s compliance efforts.

“What if we have an anti-trust violation in the company, and the Justice department comes in and says, ‘Tell me what you’re doing in training?’” Doyle postulates. “And I say, ‘Well, I have all these statistics and I have all these people that passed.’ But, in looking closer at it Justice says, ‘Yeah, but they all missed the question on whether or not they should talk to competitors.’”

Leadership, Leadership, Leadership

Although it may not be on every company’s high priority list to create a training program administered by an empowered ethics and compliance officer, B. Todd Jones believes that it will be necessary in order to adhere to the guidelines.

“The person who has day-to-day responsibility needs access up the chain of command,” states Jones. “It should be, could be, and often times is someone who has some juice within an organization.”

Scott Mitchell of the OCEG echoes Jones assertion: “I think the other hallmark of a good program is support from the top, where the chief compliance and ethics officer has direct access to the audit committee, and he or she can get any funding they need in order to deal with any issue they discover. And if that means more training or additional communication, they can get it.”

At DuPont, Majorie Doyle states the spark for developing a robust training program came right from the CEO, Charles Holliday, who required that all top seventy-two officers at DuPont complete their training within just weeks of starting the initiative. Holliday then requested reports from the company counsel on who had completed coursework and who hadn’t.

“You have to have the support from your CEO and the people at the top, because people in the organization take their cue from that,” Doyle maintains.

Topics