Is your compliance program working? Measurement is one of the challenges everyone in our field faces. A few years ago, in the monthly interview article in SCCE’s Compliance & Ethics Professional magazine, Adam Turteltaub interviewed Joe Turner of Sony Corp in an article titled, “Context is Key” (Sept. 2022; p. 8). Joe headed up Sony’s global compliance monitoring function.
It was particularly interesting to see that Sony had a separate unit to do compliance monitoring and auditing. As Joe explained it, their function is to “ensure Sony’s ethics and compliance program is fully implemented at all entities and remains effective.” This short reference reveals some interesting points. It explains what the unit is about. But it also hits what could be called the 3 core elements of compliance measurement. As correctly noted in the DOJ Criminal Division’s evaluation questions, there are 3 general points to measure:
1. Is your program well designed?
2. Is it being implemented?
3. Is it effective – does it work?
(Probably the biggest mistake made in this area is only measuring item 2, and omitting both 1 and 3).
For Sony’s monitoring they would review the content of training to be sure it covered what needed to be covered. They would also verify that the appropriate employees were trained. An ethics survey would verify their understanding.
If a company has a HQ review or “audit” team it could cause businesspeople to avoid any contact with the group; folks generally are anxious about visits from auditors. If, however, the group is consultative rather than being viewed as coming to find fault, this can change the perspective. For example, a compliance assistance/monitoring group could do an evaluation, but also coach the local team on how to improve. By visiting the field units, the assessment group might learn that part of the compliance program needs improvement, and be able to share that learning with other business units. It would also learn of best practices in a particular business unit that could be shared with other units. At the same time it could publicly recognize and commend those units that have developed these innovative approaches. Reviews do not need to be negative or fault-oriented, and can work on a positive basis. (Of course, the compliance monitoring group does not replace the traditional role of Internal Audit, which may choose to assess and review any business unit as part of its traditional role.)
Each business unit would have a compliance person who could be the point of contact with the HQ monitoring group. This would be a perfect match up, with each side being able to facilitate the other’s mission. When the HQ group works in this cooperative way it helps those around the company to feel more connected.
Of course, the trend today is to use data analysis in the measurement process, and this certainly would be part of what such a central compliance monitoring and assistance group would do. But one reference in Joe’s discussion hits a critical point that is important to remember in today’s data-oriented environment. He says “I have found it extremely rewarding and motivating to visit employees at entities globally.” He then takes this input to work with the global compliance leaders to address the employees’ needs.
There is a great risk that compliance will go from ignoring the valuable data and not analyzing it, to going overboard and focusing only on numbers. Numbers can be valuable, but can never replace simply listening to employees throughout the company. This saying may now be trite, but it is still true: “Not everything that can be counted counts, and not everything that counts can be counted.” If you do as Joe suggests, and visit with employees around your company, you will gain an important insight into what is really happening in your company, and how well the compliance program is actually working. As a bonus you will very likely pick up some very clever ideas and perspectives that will add to your overall program.
[View source.]
