Creating a Culture of Compliance

David Gebler

Published by In association with

Creating a Culture of Compliance
is published by Ark Group

UK/EUROPE OFFICE NORTH AMERICA OFFICE ASIA/PACIFIC OFFICE

Ark Conferences Ltd Ark Group Inc Ark Group Australia Pty Ltd
Paulton House 4408 N. Rockwood Drive Main Level
8 Shepherdess Walk Suite 150 83 Walker Street
London N1 7LB Peoria IL 61614 North Sydney NSW 2060
United Kingdom United States Australia
Tel +44 (0)207 549 2500 Tel +1 309 495 2853 Tel +61 1300 550 662
Fax +44 (0)20 7324 2373 Fax +1 309 495 2858 Fax +61 1300 550 663
publishing@ark-group.com publishingna@ark-group.com aga@arkgroupasia.com

Editor UK/Europe marketing enquiries ISBN: 978-1-907787-41-6 (hard copy)

Evie Serventi Robyn Macé 978-1-907787-42-3 (PDF)
eserventi@ark-group.com rmace@ark-group.com
Copyright
Head of content US marketing enquiries The copyright of all material appearing within
this publication is reserved by the author and
Anna Shaw Daniel Smallwood
Ark Conferences 2011. It may not be reproduced,
ashaw@ark-group.com dsmallwood@ark-group.com duplicated or copied by any means without the
prior written consent of the publisher.
Managing director Asia/Pacific marketing enquiries
Jennifer Guy Steve Oesterreich ARK1599
jguy@ark-group.com aga@arkgroupasia.com
 Creating a Culture of Compliance
David Gebler

Published by In association with

Contents

Executive summary.............................................................................................................VII

About the author................................................................................................................IX

Acknowledgements.............................................................................................................XI

Part One: Why do organisations need a culture of compliance?

Chapter 1: Compliance is complicated................................................................................ 3

What’s not working?.............................................................................................................. 3
Compliance is more complicated than ever............................................................................. 4
Command and control only go so far..................................................................................... 5
Why does Pfizer keep getting into trouble?............................................................................... 7
Gauging success of the compliance programme...................................................................... 8

Chapter 2: Culture trumps compliance.............................................................................. 11

BP Part one – Culture is the wild card in risk management...................................................... 11
Key points........................................................................................................................... 14
Culture works...................................................................................................................... 14

Chapter 3: Regulating culture........................................................................................... 17

US Federal Sentencing Guidelines......................................................................................... 17
Sarbanes-Oxley................................................................................................................... 20
UK and Europe.................................................................................................................... 21
Principle two – Top level commitment.................................................................................... 22
Prosecutors.......................................................................................................................... 22
The chicken and egg problem.............................................................................................. 23

Part Two: What exactly is a culture of compliance?

Chapter 4: Characteristics of a culture of compliance........................................................ 27

The behaviours to be concerned about.................................................................................. 27
What causes people to engage in misconduct?...................................................................... 29
Why would people not report?.............................................................................................. 31
Characteristics of an ethical culture....................................................................................... 32

III
Contents

Chapter 5: What causes good employees to do bad things?.............................................. 39

It won’t happen to us........................................................................................................... 39
BP Part two – Ignoring the obvious........................................................................................ 42
Honesty is subjective............................................................................................................ 43
Good leaders gone bad....................................................................................................... 46
The influence of social norms on behaviour........................................................................... 48
Real world example – David Myers at WorldCom................................................................... 50
Breaking the cycle................................................................................................................ 51

Chapter 6: Elements of organisational culture................................................................... 53

So what exactly is a corporate culture?.................................................................................. 53
Overview of the values/goals/standards model...................................................................... 54
Goals – The what................................................................................................................ 54
Standards – The how........................................................................................................... 56
Values – The why................................................................................................................. 57
Alignment............................................................................................................................ 61

Part Three: How to create a culture of compliance

Chapter 7: Collect the data – Assessing the ethical climate............................................... 67

Three steps create a culture of compliance............................................................................ 67
The drivers of ethics issues.................................................................................................... 68
Control and fear at level one................................................................................................ 68
Respect and communication at level two............................................................................... 69
Fairness and consistency at level three................................................................................... 70
Accountability and personal responsibility at level four............................................................ 71
Internal cohesion at level five................................................................................................ 71
Making a difference at level six............................................................................................. 72
Service at level seven........................................................................................................... 73
What is in an assessment?.................................................................................................... 73

Chapter 8: Building blocks to an ethical culture................................................................. 75

Connect the dots to create a culture of compliance................................................................ 75
Commitment links values and goals ..................................................................................... 75
Integrity links standards and goals......................................................................................... 76
Transparency links standards and values................................................................................ 76

Chapter 9: Change the game – Developing training and communication for every level.... 77
Leadership issues and responsibilities.................................................................................... 77
Challenges for managers..................................................................................................... 79
Getting line employees on board.......................................................................................... 79

Chapter 10: Applying the model in the workplace............................................................. 81

Not following procedures or guidelines................................................................................. 81

IV
 Creating a Culture of Compliance

Intimidation and abusive behaviour....................................................................................... 82

Improper use of assets......................................................................................................... 84
Conflicts of interest.............................................................................................................. 85
Failure to report................................................................................................................... 87
Conclusion.......................................................................................................................... 88

Part Four: Case studies

Case study 1: Johnson & Johnson – The downfall of an ethical culture................................ 91

J&J and its CEOs................................................................................................................. 91
Expansion and decentralisation............................................................................................. 94
Crises................................................................................................................................. 96

Case study 2: Boeing – Using culture to take flight again................................................ 101

Boeing stands alone........................................................................................................... 101
Infighting for the CEO position........................................................................................... 102
Shortcomings in culture...................................................................................................... 104
McNerney and an era of sustainability................................................................................. 107

Appendices
Appendix 1: 2007 Federal Sentencing Guidelines................................................................ 113
Appendix 2: Ethics Resource Center.................................................................................... 119

Index.............................................................................................................................. 121

V
Executive summary
What leader would not want to foster a
culture of compliance?
On the surface, a culture of
compliance reflects an organisation in
which compliance is embedded in every
strategic decision. In such an organisation
employees respect the processes that
are essential for the organisation to get
its job done. The organisation has done
its homework and developed a matrix
of processes and procedures to inform
employees as to what is expected of
hem; and to audit when they fail to meet
those standards.
The following critical questions support
each step an organisation must take to
create a sustainable culture of compliance:
„„ What motivates employees and
managers to comply? Do they comply
because of fear of getting caught? Or
do they comply because leadership
models that doing the right thing is the
expected way to meet your goals?
„„ How does a leader know if the ethics
and compliance programme is actually
working? What criteria are used to base
that determination?
„„ How does the organisation gauge
success? Many programmes gauge
success by the number of employees
who sign the code or take required
compliance training. But the real test
is whether employees would report
misconduct and feel less pressure to
engage in misconduct.
Compliance efforts at most companies were
designed to stop bad people from doing bad
things. In many companies there is very little to
distinguish the controls imposed to deter fraud
from the ethics and compliance programme.
But the reality is that most unethical activity
is done by otherwise good and honest
employees; people who get caught up in
tough situations and then succumb to pressure
and influence. Employees that get caught
even after admitting their crimes will often say
that they were only doing what they thought
was expected of them.
A different approach is needed to reduce
these types of ethics risks. Leaders need to
adopt practices that acknowledge the fact
that maintaining high ethical standards is
not just a function of good financial controls
and widespread awareness of the company’s
code of standards. The ability of individual
employees to act ’ethically’ is as much
a function of their environment as it is a
function of their personal integrity and their
awareness of the rules.
Why is it difficult for leaders to adopt
culture-based approaches to reduce ethics
risks? The problem is that even good leaders
have trouble seeing ethics trouble before
it’s too late. Leaders are less likely to notice
unethical behaviour in others when it occurs
in small increments and before a scandal
emerges. No leader thinks their company
is like Enron or WorldCom.
However, even if things work out all right
in one instance, they are blinded to warning
signs of the next scandal.
VII
Executive summary
It’s a classic bad news/good news
scenario: the bad news is that merely
having a code and training is not enough
to adequately reduce risk and prevent
misconduct. The good news is that there are
clear steps that any manager can take to
create a culture of compliance.
Chief compliance officers should not be
lulled into complacency just because the
organisation has implemented all elements
of a best practices programme. Despite
the deployment of the formal elements of
compliance programme:
„„ Employees will not be committed to
compliance if the core culture does not
support compliance; and
„„ The organisation cannot encourage ethical
conduct if the underlying culture does not
support ethics in its day-to-day activities.
The bottom line is that a company cannot
achieve compliance without first addressing
the behavioural issues in its culture that
impact the ability and the desire to be
compliant. The companies that maintain
the lowest risk of misconduct have created
an environment where employees seek
compliance as the most productive way to
do their jobs. These companies have created
an environment where values such as
predictability, accountability and candour are
embedded in the culture.
This report is presented in three parts:
Part One presents the rationale to look
at culture as a factor in shaping compliance.
Chapter 1 looks at why a company
should even be thinking about a culture of
compliance. What are the costs and benefits?
Chapter 2 details how regulatory environment
in the US and UK have incorporated ’culture’
into pertinent regulatory frameworks. Chapter
3 outlines the new thinking that is required in
order to have a firmer control over employee
VIII
behaviour throughout the organisation
by reviewing the limitations of current
approaches to compliance.
Part Two lays out the characteristics of
a culture of compliance, which is instigated
in Chapter 4. Old models of looking at
morals are yielding to newer awareness that
culture shapes behaviour, even influencing
good people to do bad things, which
Chapter 5 addresses; along with the key
differences between ethics and compliance.
Understanding these differences will be
critical in order in to build an effective
culture. The process of good leaders going
bad is also carefully analysed. Chapter
6 presents a new model to view culture,
by looking at the interactions among an
organisation’s goals, values and standards.
Part Three presents a guide to creating a
culture of compliance. Chapter 7 introduces
the steps needed to create a culture of
compliance; discusses how to assess the
influencers of behaviour that will determine
whether employees will engage in misconduct
and whether they will report misconduct they
observe. Chapter 8 shows how to align the
elements of culture (goals, values, standards)
to create an environment where employees
feel less pressured to engage in misconduct.
Chapter 9 lays out steps to create an action
plan to deploy effective communication and
training to leaders, to managers and to line
employees. Chapter 10 demonstrates how to
tie all the pieces together, apply the model and
develop a programme to address the most
common types of misconduct and undesired
behaviour – to build a culture of compliance.
Part Four of the report presents two
case studies. Much can be learned from the
experiences of two global companies, Johnson
& Johnson and Boeing, each of which
has had its values challenged as each has
struggled to determine how it wants to restore
its prominence as an ethical organisation.
About the author

Through 20 years of advising global organisations, David Gebler is a recognised thought leader
in values-based ethics and culture risk management. An innovator of new approaches to raise
the awareness of ethics and values in major organisations, David advises senior leaders on the
deployment of integrity-based processes and the development of interactive ethics and compliance
training programmes.
A business lawyer by training, David received his J.D. from the University of California in Davis.
In addition to practising law in California and Massachusetts, David worked in Israel for CBS Records
International as director of business affairs and as an in-house lawyer for El Al Israel Airlines.
David works with clients to understand how their culture impacts ethics and compliance risks,
helping them develop strategies to reduce those risks by aligning the values of the organisation’s
people with business goals. He has served as ethics counsel for numerous organisations, assessing
culture-based risks, developing ethics training and drafting codes of conduct. David has worked with a
variety of companies including General Dynamics, Duke Energy, MolsonCoors and Scotts-MiracleGro.
David is on the International Advisory Board of Suffolk University’s Graduate Programme in Ethics
and Public Policy in Boston, US, where he co-teaches a course in Business Ethics.

IX
Acknowledgements

The author would like to thank Avery Struthers for his excellent work in pulling together the case
studies for this work.
Thanks to Evie Serventi at Ark Group for being such a strong advocate for the need to talk
about culture.

XI
 Creating a Culture of Compliance

Creating a Culture of Compliance † I would like to order the new release

Author: David Gebler special of Creating a Culture of
Year Published: 2011 Compliance for AUD $395 including gst.
Pages:125

What leader would not want to foster a culture * this offer is only available until the 25th
of compliance? March 2011 - sorry no extensions

** $15 postage and handling

Title First Name Last Name Position Title

Organisation Name Website

Address

Postcode Phone Fax

Email @

† Mastercard † Visa † American Express

Card number

Expiry date

Cardholder’s name

Cardholder’s signature

† Payment enclosed (Cheques should be made payable to Ark Group Australia Pty Ltd)
† Please invoice me

℡  
Ark Group Australia Pty Ltd,
Fax back this form on Tel: +61 1300 550 662 aga@arkgroupasia.com Main Level, 83 Walker Street,
+61 1300 550 663 North Sydney, NSW 2060

We occasionally allow reputable companies to mail details of products we feel may be of interest. If you do not wish to receive this service, please tick this box ‰