This profile is the latest in a series of weekly conversations with executives at U.S. public companies who are currently involved in establishing and developing compliance programs. An index of previous conversations is available here.

You volunteered for this job—lots of people would guess you’re a glutton for punishment. What was your thinking?

Well, it was an historic time for the country and the financial markets. It was a company with a very solid and sound set of businesses, and a solid business model that had some problems that needed to be addressed.

In my past I’d lived through a bribery scandal at a Japanese joint-venture, arriving after the fact and implementing a number of corrective actions. I got a lot of satisfaction out of doing that, and I had a lot of confidence there were lots of employees and shareholders who would appreciate solid changes being implemented.

It seemed like it was doable... in addition to all that, I knew the boss. I had worked with the CEO for four years and had a good feel for his abilities, and I felt very confident that together we could attack this.

Well, how did that process of interviewing for the job go?

We met about four days after he took the job as chief executive, and we walked through his initial list of challenges for the company. It became apparent pretty quickly that he was going to make a number of changes on the board and senior management.

What he would most benefit from, in my background and my skills, was me coming in and focusing on the immediate governance issues that had to be addressed. I could look at the issues both short-term but, more importantly, also long-term—what were the processes that needed to be put in place to address the issues that had come up.

How much of your job is making appearances and talking to people?

It’s probably 30 percent of the job. We have 2,000 locations around the world, and we have a host of investors in a variety of places; it’s a combination of that. I could be on the road 100 percent of the time and not cover every area I’d like to cover.

When you do speak to employees, how much of the job is just standing there and let them vent? After all, in this case it was management that violated compliance rather than the workers.

Early on, there was a fair amount of venting... I think the first 12 to 15 months had a lot of that. Today, confidence in the employee base has increased pretty significantly based on what we’ve been able to get done. We have a fairly good summary on our website of all the actions we’ve taken to date... and I think employees see that in a visible way.

In that first year, how much of the job was installing nuts-and-bolts systems for controls and governance?

It was almost the entire job, other than the communication effort.

How did you identify those needs? What were they?

In the finance area, a lot of it was writing the controllership guide; we have 7,000 employees in the finance organization. It was writing the corporate policy manual, working with HR and legal and finance in getting those key policies written. I was rolling out the guide for ethical conduct. I was putting in the corporate secretary’s office to put in the disciplines and controls we needed there; putting in an ombudsman’s office to field inquiries from employees, customers, suppliers on a help-line basis... putting in a Sarbanes-Oxley 404 process. (In the first year I led that process. Now it’s led by a corporate controller we just hired.)

And how much of the job today is still that remedial work, versus contemporary governance issues that any company must face now?

Given that we’re two years into it... we’ve launched just about every major initiative we need to launch. Now it’s getting those initiatives to stick forever. It’s trying to make the processes we’ve launched mature; it’s hiring people and training people; putting metrics in place to make sure we are monitoring the processes. It’s dealing with the day-to-day stuff that most companies deal with.

OK, remedial tasks aside—what are your specific governance duties for the long-term?

Krol

I’m the management interface with the nominating and governance committee. I help [Tyco lead director] Jack Krol pretty significantly in managing the issues for the governance committee and for his role as lead director; what is the support he needs to ensure the agendas and the dialogue the board has are focused on the right topics?

One way we do that inside the company is that I’m leading an effort to assess risks, both across the key corporate functions as well as implementing a process in the divisions now where they are assessing their business risks. Jack and I go out and do individual visits at the businesses, where it’s just he and I and the division management teams. They present what their analyses of risks are and what their remediation actions are to deal with those risks. That’s probably the newest part and the biggest part of my role beyond the routine stuff that we do from a governance standpoint.

We also have scorecards that we prepare on the board’s activities; at every board meeting we’re reporting to each committee how they’re doing against their charters and against their board guidelines.

How often do you meet with the governance committee?

I’m involved in every meeting of the governance committee from start to finish, other than the executive sessions. That’s at least six times a year, and obviously we have some special meetings beyond that.

And what about the reporting structure at Tyco?

The corporate audit staff reports dotted-line to me, and directly to the audit committee. The ombudsman reports dotted-line to me and directly to the audit committee. I have a governance analyst and a governance director who report to me and do a lot of the process work we’re talking about.

I know that succession-planning and mentoring is another area Tyco wants to improve. Do you have a role there?

That is led by our senior vice president of human resources. It tied right in with the values that we established as a company. In our guide for ethical conduct, the first page in that guide is a letter from our chief executive articulating the four values. Those values are what [the HR department] based our “organization leadership review” on. That is the evaluation of our top talent around the company, based on nine behaviors that tie into those four values.

For example, integrity is one of those values. One of the behaviors would be managerial courage. We’re trying to evaluate our top leaders on how good they are at demonstrating managerial courage; is it a natural part of their leadership style or not? And to the extent that they’re not demonstrating it, what can we do to get them the training and the coaching they need to ensure it’s a behavior that’s consistently part of their leadership style.

What about setting a global standard for compliance? That must be difficult for a business as big as Tyco.

That’s a great question—it’s why I’m sitting here in London while we’re talking today. To give an example, we’re currently working on our new values and integrity training, which will go to employees in September or October. I was over here this week for ‘train the trainer’ sessions for about 70 people. Now, those people came from a variety of countries in Europe; they’re human-resources leaders who came here to take train-the-trainer training. They’ll end up training 25,000 managers in August or September, and then those managers will train 260,000 people on this...

We’re not asking anyone to do anything out of the ordinary; we’re just establishing a standard and telling people they must comply with the law, but beyond that they’ve got to comply with company policy. Quite honestly, that results in some interesting dialogue... and that’s why we spend as much time as we are to do this. Approximately half our employees are off-shore, so it’s a significant challenge.

How’s the Section 404 project coming?

We have more than 3,000 people involved internally on that effort. We relied in the first half of 2004 on outside consultants to some extent to help us. But now that we’ve been through the testing and we’re into the remediation phase, we’re using very few consultants.

Those 3,000 people now are pretty-well trained to tackle this on their own. We’re a company that certifies in September of next year, so we’re not under the same gun that a year-end company is, but we’re trying to complete even our year-end September work so that hypothetically we can be certified at the end of September if need be.

Was this process made even more painful because of Tyco’s previous lack of controls?

No, I think it’s a process that would have had to be done no matter what. That’s how we look at it. We analyzed the wrong-doing that occurred, and we made sure we had the routines and controls in place to remediate the weaknesses there. But honestly that’s a small part of things. When you’re looking at 2,000 locations and putting in routines and controls, the breakdown in controls at the corporate level—well, it obviously resulted in large dollars of misappropriations, but the number of different processes you had to look at and document was really a small quantity.

Dennis Kozlowski was an extreme example of how amiss things can go. But can a company respond with too many checks-and-balances, and create too extreme a solution?

I think it could, yes. The question is, can you do that and still work together well? I sit in on our CFO’s staff meetings, as does our head of audit. Our ombudsman sits in on the meetings of our legal and HR functions (not every one, but he’s invited to attend many). So we have close relationships with the functions that these functions would normally report to.

On the other hand, I think the board has the assurance that it has three people inside the company independent of management that report directly to the board. We have to balance where we spend our time, and we have to make sure we communicate clearly with all the functions inside the company so that we’re viewed positively... That’s something that is on our minds all the time, but I think we’ve balanced that pretty well inside Tyco.

Thanks, Eric.

An index of previous Q&A Interviews is available here.

This column should not be regarded as legal advice. It is for general information and discussion only, and is not a full analysis of the matters presented.