Editor: What are some of the concerns that have to be overcome in
introducing an ethics and compliance training system?
Brigham: At the outset you hear a variety of concerns expressed.
particularly from the attorneys. We have a partner called Ethics Resource Center
(ERC) that conducts studies on the topic. In one study they found that one of
the weakest links in any ethics and compliance program was the compliance
hotline. It is clear that the mere fact that you haven't heard a complaint on a
compliance hotline doesn't mean that a violation is not taking place. What was
found is that 46% of employees who have witnessed misconduct fail to report it.
Many employees will not use one of those anonymous reporting systems no matter
what kind of inducement there is. There are two driving factors. One, is that
since they don't understand how it works, they are concerned that any
information sent through that system will not be kept confidential. Second, is
that they don't believe that corrective action will actually be taken.
Therefore, they say "Why stick my neck out?" There is a flaw in the system - and
it doesn't matter who is on the other end of the line, whether a company
employee or an outside contractor. What this seems to tell us is that employees
don't trust the company to keep the information confidential and don't feel that
the company will follow through if they do stick their necks out.
Editor: Isn't the flaw you mentioned attributable to concern that
management does not take the program seriously?
Brigham: That is true. If employees are not convinced that management
has completely bought into the program, neither the hotline nor the ethics and
compliance training program will be effective. We start by building confidence
in the organization's commitment to the program. We call this "system
awareness," This really involves the "tone at the top." Therefore, we encourage
a company's top officers to talk at the beginning of the training sessions about
the importance of ethics to the company. It is not enough to do the right
things; you must tell people about what you are doing.
We collect personal anecdotes from the top leadership of a company about
actual ethical dilemmas that they faced and what they did in those
circumstances. We had such success that we initiated with ERC a project called
leaders in ethics. There is a website called href="http://www.leadersinethics.org">www.leadersinethics.org where we have
collected on camera interviews with the leaders of such companies as Lockheed
Martin, Raytheon and MCI and others. They talk about highly relevant specific
examples that portray ethics in action. A specific story is much more memorable
than general platitudes about ethics.
In one example to be found on the website, a director of a very large company
describes a situation that came to the attention of the directors that could
have put the company in a very bad light if disclosed. The company considered a
number of other alternatives including "sweeping it under the rug." However,
they decided to address it head-on and do the right thing. The company's
employees, having been made aware of the situation, saw the company's actions as
an affirmation that the company would make an ethical choice even under the most
difficult of circumstances. It is very important for company leadership to
personalize the issue by using concrete examples from their own experience. This
approach goes a long way toward institutionalizing compliance and ethics
training into a company's culture.
Editor: I understand that risk assessment is another key to creating an
effective ethics and compliance training program.
Brigham: Risk assessment as applied to training programs will become
increasingly important over time because it permits compliance training programs
to be more precisely targeted to the corporation's needs. Also, the Sentencing
Guidelines give weight to assessing risk on an annual basis. An ongoing risk
assessment program not only enables you to qualify under the Guidelines but also
to quantify the effectiveness of the training program because it enables you to
make year to year comparisons. This is a much better indicator than looking at
the number of times you have been sued or the frequency of use of the hotline.
Editor: Corporations have to cope with an immense range of regulatory
issues. How can any compliance program cover all of them?
Brigham: You can't be sure in any business that you are complying with
every law. There are just too many - so you have to prioritize. The most
important thing is the ongoing business and you can't let the compliance
function overwhelm the need to attend to vital business needs. A close friend of
mine who serves as the chief compliance officer for a multi-billion-dollar
company summed it up this way in describing their compliance and ethics program
to her boss: "Here is what I can absolutely guarantee you ... some employee
is violating, however obscure, some state, local and heaven forbid, possibly
federal law some place in our company every single day .... The key is
prioritizing and determining which laws we need to make sure that employees obey
first - and build a culture of ethics to help us towards the rest." Here again
risk assessment comes into play.
Editor: What are the most significant costs of a compliance training
program and how can they be reduced?
Brigham: One of the goals of risk assessment is to attune the expense of
the system to a proper evaluation of risk. The actual cost of the software for a
compliance training system is not prohibitive. The big cost is employee time
consumed in administering and taking the programs. If we sold a system to a
company with 1,000 employees, the employee time consumed to administer and take
the program would cost five times as much as the software. All businesses seek
to reduce costs, but certain industries are particularly sensitive to employee
costs; for example, those involving government contracts. Many government
contracts provide for cost reimbursement. Training, if it's vocational, is
reimbursable by the government, but ethics and compliance training is not deemed
vocational so that it is entirely a sunk cost that comes directly out of the
corporation's bottom line. However, all companies are seeking the most
cost-effective systems. It is obvious that the most productive area for us and
our customers to focus on when seeking to reduce cost is the area of greatest
cost, namely the amount of employee time involved.
Editor: How do you go about reducing employee costs?
Brigham: Here again risk assessment plays a vital role. That has
driven companies like ours to pinpoint the exact issues that are relevant to the
individual employee's work. We do individual risk assessments where we survey
each employee's functional responsibility, authority level and knowledge. With
this information, we can cut the curriculum by about 70% with an immense saving
of employee time - and learning is enhanced because we target only those things
that really matter.
Editor: How does risk assessment contribute to making compliance training
programs more interesting to employees?
Brigham: From a learning standpoint, programs that precisely match an
employee's needs eliminate the boredom and attention loss that occurs when you
expose an employee to material that is not relevant to her job. Take a sales
employee that has no power to set prices. If you expose that employee to a full
antitrust course that deals with such things as price fixing, you are going to
lose that employee's attention not only to the irrelevant material, but also to
material that is highly relevant. They will resent being exposed to material
that has nothing to do with their jobs and wonder whether management truly
respects employees' time, or even worse if management even understands what
employees' daily job functions are. Everyone knows that employees talk and
mounting criticism of the kind will undermine confidence in the effectiveness of
the compliance training program.
Editor: How important are punishments and rewards?
Brigham: Another factor contributing to a successful program is visible
and consistent discipline. It would be nice if someone could come up with an
effective reward system as well. But, it's very difficult to reward people for
doing what they should have been doing in the first place. The important thing
is actually to be willing to visibly discipline an employee. That doesn't
necessarily mean that you have to name the employee or pull out all the sordid
facts uncovered in an investigation.
In the one company, the pattern was to sweep the facts under the rug. Rather
than suing the offending employee for restitution, they decided to quietly ease
him out of the company. We totally disagree with this approach. Another company
that had a very similar type situation publicized it in their employees'
newsletter. While they didn't mention the employees by name, they did describe
the situation and mentioned that two people from a named division had been
terminated for their involvement in this misconduct. This sent a crystal clear
message to the workforce that no one is above the law.
Editor: How important is it for ethics and compliance training to be done
on a regular and continuing basis?
Brigham: It can't be a one shot thing. Each employee in the program
should take the training each year or every other year on a continuing basis.
New employees should receive training shortly after they are hired. Depending on
functional role and authority of an employee, you might end up spending two to
four hours of an employee's time during each yearly or two-year training cycle.
Except for more sensitive positions you usually don't need to do eight to ten
hours. Online training is much more efficient than doing it in person. Studies
show what might otherwise take nine or ten hours in person can be done in two or
three hours online with the same degree of comprehension.
Experts agree that the propensity to engage in wrongdoing is greater with
younger and newer employees. These employees are twice as likely to engage in
misconduct as older tenured employees. I mentioned earlier that 46% of all
employees who witness misconduct fail to report it. The percentage would drop to
about 23% for the younger and newer employees as, if all other things are equal,
they are only half as likely as older and longer-tenured employees to report
misconduct that they witnessed. In an institutionalized employee training
environment, you begin the training process for new employees within 30 days
after they are hired.
The process can be commenced even earlier for high-risk new employees. We are
kept advised by some customers of their entire employee data base by job code
and function. Every night we upload those customers' employment records so we
know who has left and who has just joined. In these cases, we can provide
training within the first 48 hours after they have been