This profile is the latest in a series of weekly conversations with executives at U.S. public companies who are currently involved in establishing and developing compliance programs. An index of previous conversations is available here.

Describe your duties at Alcoa.

I’m part of the global compliance organization. Our chief compliance officer is also chief legal officer for the company; he heads up a global program that includes the ethics and compliance section, which I direct, as well as trade compliance and the environmental compliance effort.

My job focuses more on the ethics and compliance side of that global function: dealing with compliance to laws and regulations and to our internal policies—just in general following our values and ensuring others follow our values.

Most of your Alcoa career has been in finance and quality management. How did that experience help with your compliance job?

I spent my first 20-some years in finance, and a lot of that was in the tax area. Obviously, compliance is embedded in just about everything you do in the tax function, so in understanding priorities, meeting deadlines, and complying with laws and regulations, that job reinforces the importance of ensuring compliance.

When [former Chief Executive Officer] Paul O’Neil first came to Alcoa, I was selected for a global training program on total quality management; then I taught quality management for a number of years. There I started to broaden my horizons in ethics and compliance, because in dealing with quality we’re dealing with customers, with meeting specifications of customers, with assuring customers that we are meeting those specifications; that when we tell a customer we’ve done something, in point of fact we have done it.

What’s the personnel structure for Alcoa’s compliance department?

There are five full-time people on staff; those are the only full-time people in the ethics and compliance group. I indirectly report to a compliance advisory committee, made up of our chairman, chief financial officer, and my boss, the general counsel of Alcoa, who is also the chief compliance officer.

Below that, we’ve identified six regional compliance liaisons. Most are the corporate counsels for those regions of the world ... But in effect we have six regional liaisons who are responsible for: one, ensuring that our program is effective and deployed properly; two, handling investigations and compliance-line calls that arise in their regions; and three, ensuring that their training is appropriately deployed.

Beneath that group we have about 1,500 people indirectly involved in ethics and compliance at all of our locations. Alcoa has about 500 locations globally, and we’ve identified three people at each location. We’ve identified the HR manager, the environmental health and safety manager, and, for lack of a better term, a 24/7 person. Depending on the calls or allegations that we receive, the regional liaison knows how to allocate that call for proper investigation. If it’s an HR-related call, it goes to the HR person, and so on.

The 24/7 person works in a system where if we receive a priority call—imminent danger to employees, or to the location or the community we operate—we throw away all the paperwork and processes and call the 24/7 person immediately to take action.

Who would that 24/7 person typically be?

It depends. At our larger locations we have security staffs, so usually it would be the security department. Where we have smaller locations, it’s generally the location’s operating manager.

You mentioned five full-time compliance people. What are their roles?

I have someone to handle my statistical work, gathering data and producing management reports that we need. Another person is one of those liaisons, who represents the North American region. One person is responsible for our training and annual business-conduct survey. I have another person who is sort of an analyst and developer; we’re getting into new areas and have rewritten our code of conduct ... and that person is responsible for those areas. Then there’s me; that’s five.

What is your typical day like on the job?

I do an extensive amount of traveling, for several purposes. One is to create awareness and constantly reinforce our values and business-conduct policies. Another part is where we have investigations on significant issues; I spend a lot of time outside the country investigating those sorts of things.

Who brings compliance updates to the board?

It’s a shared responsibility. Generally our general counsel does that, however we have a director of global compliance who also takes the initiative. I may go before the audit committee once a year.

Alcoa shifted its training regime from an ‘on request’ policy to a more pre-emptive approach. Why and how did that happen?

Our training efforts had been done through our legal staff as what we called a “preventive law” program. It was only on a request from the business unit, and only a specific topic requested by the unit. So they might want background on the Foreign Corrupt Practices Act or conflicts of interest, and that’s all it would cover.

When I took over this office, we decided the first priority was to globalize our whole ethics and compliance program ... So first we rewrote our code of conduct and put it at a tenth-grade level. We also translated that document now into 21 languages.

The second element is an ethics-and-compliance line all over the world. In each country, we have a separate ethics-and-compliance line. We are one of the few companies on the cutting edge of this, where you call our compliance line and the call is answered in the language of the country where the call originated from.

How did this go over with local employees, perhaps rolling their eyes at the latest plan from Central Headquarters?

You don’t make it a Corporate Headquarters project; you make it a business-unit project. You make people in the field have input into the code of conduct. You have them say, “What is understandable? What do we need to say here?” We wanted to make sure this was not a corporate-driven project, although we coordinated it. It had to be driven by business units themselves. No project will ever be successful if it’s driven by corporate headquarters.

How has Alcoa managed Sarbanes-Oxley and Section 404?

Alcoa is fairly unique in its audit practice: We have a total self-assessment process. That means if you want to know what the auditors are going to audit when they walk in the door, we have already defined all that in a manual covering all the major areas of audit: environment, safety, health, finance and IT. Within that self-assessment process, when Sarbanes-Oxley was drafted we went through that manual and picked out the relevant sections that would determine internal control as defined by Section 404. We then required all our businesses to self-assess themselves against those objectives, to do all of the tests, and meet a certain level prior to Nov. 15.

We then backed that up with specific internal audits that validated or verified that the internal control procedures were in place. So we did a self-assessment, and then we did very specific internal audits against the 404 objectives. And it was a heck of a task.

You often participate in associations of ethics or compliance officers. What are your thoughts about developing standards or guidelines for compliance?

I think it’s difficult. The ethics officer association attempted to develop an ISO standard for compliance, and it was very difficult because no two industries are the same, nor do they have the same cultures or operate in the same environment or have the same types of customers. A few things we have used for our program development were the federal sentencing guidelines and most recently the revised guidelines. We’ve looked at several other benchmarking studies done by the Ethics Officers Association and the Ethics Research Council. We’ve generally developed an overall program that listed the constituent elements that you should have.

But again, those are really talking about just the basic physical things that you should have in place. We wanted to go one step beyond that and say it had to be more than just paper and had to be effective.

Let me give you an example. We have developed specific real-time training, individualized to the specific risks that people face on their jobs—giving someone on the shop floor training in the Foreign Corrupt Practices Act is not only a waste of their time, it’s a waste of our time. We look for the specific ethics and compliance issues this person faces on the shop floor on a daily basis. When they attest to the completion of a task or an inspection process, have they actually done that? Have they short-cutted anything to meet a production schedule or a shipment date? Those are the ethics issues that the person on the shop floor faces ... so we gear our training to give specific guidance to the types of risks people face in their daily jobs.

What are your compliance priorities for the next 12 months?

When we talk about where to go next with our program, a few areas we look at are developing a comprehensive risk-assessment process, doing a world-wide employee ethics and compliance survey, and then having an external evaluation of our ethics and compliance program—somebody to come in from the outside who has the expertise and can say, “You’re good here and you’re weak here.”

Thanks, Perry.

Click here for upcoming Webcasts with compliance officers.

Topics