When I was 13 years old, I was picked up by the police at 3 a.m. for violating our town's curfew for kids under the age of 16. (Before you leap to conclusions about how poorly my parents must have been raising me, I will add that I was “camping out” with some friends in a tent in one of our yards, and we snuck out to go visit a group of girls sleeping in a tent in another friend's yard).

Suffice it to say, my parents were not happy to see me standing next to the less-than-friendly police officer after he rang our doorbell at almost 3:30 a.m. It was this experience that first taught me, in a pretty powerful way, the importance of compliance with the law. I doubt anyone (myself and my parents included) would have guessed at that moment that someday I would be leading compliance activities for a company of 14,000 people.

We are all taught, from an early age, that society has rules and that rules have to be followed. However, in a corporate setting, it's not always easy to put rules into context and it is constantly a challenge to find interesting ways to teach employees about the rules and keep them fresh in the minds of the workforce.

I'd like to share a few of my perspectives on compliance and the role of the corporate compliance function, that I hope you will be able to use to improve your company's compliance program, particularly building an effective training program.

Being a CECO Is Not Easy

The job of a chief ethics and compliance officer is much harder than I thought it would be. There are a lot of moving parts at a big company like CA Technologies, and even seemingly simple tasks—like writing a quarterly newsletter—can involve a tremendous amount of coordination and effort by people in a number of departments.

Frequently, I find myself having very frank and sometimes very difficult conversations with employees and officers of the company. I'm guessing that I get fewer holiday cards than some of my colleagues who sit outside of the compliance function. From my discussions with compliance officers at other companies, I know that my experience is not unique in this regard.

When I took on this role, I also underestimated how much time it would take to create courses, awareness videos, and the other elements of our program, as well as how broad the range of subjects would be that we would be asked to provide guidance upon—from import/export to antitrust to anti-corruption to questions about conflicts of interest (just to name a few). My team regularly fields questions on a wide range of issues—certainly much wider an area than I had considered before taking this job.  

Three Types of Problems 

Compliance issues and problems can generally be lumped into one of three categories: (1) bad people who do bad things; (2) good people who make bad decisions because they feel “pressure” to hit targets, meet deadlines, and fulfill other demands; and (3) good people who make bad decisions because they are poorly informed. Let me address each of these separately.

Bad people doing bad things. Every company, large and small, has some bad actors. The good news is that these employees are generally a small percentage of a company's overall workforce. There are things we, as compliance officers, can do to help detect the bad conduct of bad actors before it becomes a major problem for the company. Since no amount of training or awareness will stop a bad person from committing a bad act, we have to ensure that we have strong controls in place to detect unethical conduct. Beyond the usual Sarbanes-Oxley-like controls, one of the best controls available to catch these people is the good employees who work alongside them.

We've all heard the characterization of compliance activities as “check-the-box” exercises—and when we hear compliance characterized this way, it is not meant to be a compliment. Your program needs to be an ongoing effort, to avoid complacency from taking root.

When I speak to our employees about compliance and the importance of “getting involved” when they witness unethical conduct, I often tell the story of Kitty Genovese, a nursing student who was murdered in Queens, New York in 1964. As the story goes, Ms. Genovese was attacked just outside of her apartment building, with the attack lasting for over 30 minutes. The following day when police interviewed residents of the apartment building where Ms. Genovese lived, many residents (some accounts put the number as high as forty) admitted that they had heard Ms. Genovese's cries for help. Not only did these residents not come to Ms. Genovese's aid, not one even bothered to call the police.

This desire “not to get involved” has been replicated many times in psychological studies. In fact, it is now referred to as the “Genovese effect” or the “bystander effect.”

While compliance officers cannot change human nature, we are able to take steps to emphasize the expectation we have of our employees to speak up when they see misconduct.  The importance of communicating this message to employees cannot be understated: The message should be clear and it should be repeated to employees regularly.

Good people falling victim to pressure. Even good employees sometimes do bad things, because they succumb to workplace pressure. I believe the way to address this is by providing strong company leadership. It is imperative that business leaders make clear to the employees within their organizations that the rules are not “bendable.” Any underlying motivational statement expressed to employees about “winning” in the marketplace is an implicit understanding that this means ethically and in compliance with the law.

Too often, the only ones talking about compliance and ethics are the compliance officers and the lawyers. It is our job to do so; however, for messages about compliance and ethics to resonate most effectively among the employee base, the messages about the importance of ethical business conduct and compliance with the law should come directly from business leaders.

Good people who are uninformed. Good people can also make poor decisions because they are uninformed. This is something that can be remedied by ensuring that a company has effective compliance training and communication and awareness programs. Laws and regulations change regularly and one of the goals of a compliance officer is to ensure that the employees we support have the information they need to make good business decisions.

In this guest series column, I will address how we tackle the challenge of providing employees information on compliance issues that we hope they find interesting, relevant, and useful to them in performing their jobs.

Complacency

Assuming you work for a company that has already established the proper tone and commitment to compliance and business ethics at the top, the biggest challenge to a company's compliance program is complacency. It's not easy to find new and interesting ways to engage employees on subject matters that are often quite dry; yet, this is something you have to devote a lot of time and energy to if you want your program to be successful.

We've all heard the characterization of compliance activities as “check-the-box” exercises —and when we hear compliance characterized this way, it is not meant to be a compliment. Your program needs to be an ongoing effort, to avoid complacency from taking root.

In future columns, I'll share with you my ideas and suggestions on how to avoid complacency and help ensure that compliance awareness remains top of mind in your organization.