The root of all good

In mid-October 2001 the Wall Street Journal reported on a special purpose entity (SPE) of Enron that was experiencing financial distress. Given the appearance of financial irregularities, the SEC quickly opened an investigation. On December 2, just six weeks later, Enron took center stage as the largest corporate bankruptcy in US history ($63 billion). The seventh biggest company in the US, Enron never had a down quarter financially but overnight became the poster child for corporate fraud. The 20,600 employees of Enron lost 62 percent of their pension assets, tied up in Enron stock in 401Ks while plan administrators were changed.

The size, scope and suddenness of these events were stunning. And while regulators, analysts and investors were trying to understand how this could have happened, a litany of other companies made front page headlines: ImClone; Tyco; Adelphia; Rite-Aid; Aurora Foods; and Arthur Andersen to name but a few. The Dow Jones Industrial Average and Nasdaq were nearing a freefall as investors, concerned that the markets lacked integrity, fled to safer investments in real estate and elsewhere.

On July 8, 2002 President Bush arrived at the Millennium Hotel across from the footprint of the fallen World Trade Center and called for a ‘new ethic of responsibility’, and the swift passage of Sarbanes-Oxley (SOX). Only a few weeks had gone by when on July 30, 2002 Congress passed the most comprehensive federal business reform legislation since the Great Depression: the Public Company Reform and Investor Protection Act.

Ethics are nothing new

Since then, corporations everywhere have paid considerable attention to rebuilding the trust of investors, employees, customers and other stakeholders by deepening their commitment to – and investment in – ethics programs. But such commitments are not new. Since the early nineties, many organizations have taken to heart the incentives put forth by the United States Sentencing Commission (USSC) by developing ethics programs. On November 1, 1991, USSC, which sets the sentencing rules on federal crimes, issued Chapter 8 regarding the Sentencing of Organizations. This landmark pronouncement illuminated two brand new areas of risk: personal threat and corporate threat.

The personal threat – spelled out by USSC – lies in the fact that now executives can be subject to civil and/or criminal charges if an employee commits a crime in the workplace. And willful blindness, or the conscious avoidance of knowledge, is no defense. The corporate threat, on the other hand, derives from the mandatory fines that may be imposed – up to $290 million. Feeling strongly that promoting self-regulation is essential, USSC creatively offered a carrot with the stick – incentives to those organizations that take meaningful steps to develop effective ethics and compliance programs that can mitigate those risks.

The essentials

Embedded in Chapter 8 of the Federal Sentencing guidelines (8B2.1) are the elements necessary to set up the framework for an effective ethics and compliance program. USSC very clearly delineates its expectations: ‘(1) exercise due diligence to prevent and detect criminal conduct; and (2) otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.’

To achieve appropriate due diligence USSC states the organization must establish standards and procedures ‘to prevent and detect criminal conduct.’ Policies, procedures, internal controls and an effective code of conduct are the foundation of these standards.

Good oversight by the ‘governing authority’ (board of directors) with knowledge of the operation of the program and its effectiveness is necessary. And ‘high-level’ individual(s) must be assigned overall responsibility of the program and be given ‘adequate resources’ and ‘authority’ to carry out her/his responsibilities. Importantly, this individual must report to executive management and, as appropriate, have access and periodically report to the ‘governing authority’. What empowers this individual is the very fact that he/she is acting as an agent of the board.

In addition to appointing a person of ‘substantial authority’ the organization must ensure that this person has not engaged in illegal or unethical activities. While background checks during the intake process generally protect an organization during hiring, someone should also closely monitor employee complaints and personnel reviews that may expose individuals whose behaviors could place the organization at risk.

Communicating standards of conduct, procedures and elements of an organization’s ethics program is also important. Herein, training is required at all levels of the organization, including the ‘governing authority, high-level (and) substantial authority personnel,’ employees and, when called for, agents.

Periodic monitoring and audit as well as measurements of the effectiveness of the program are also recommended by the USSC. Many organizations use periodic surveys to pulse employees regarding their knowledge of – and support for – the program. An added bonus: Periodic audits reveal conformance with the program’s elements (number of employees trained, adherence to internal controls and compliance requirements). And some organizations retain consultants to provide a third-party assessment of their program.

Importantly, organizations must have and publicize a reporting system where individuals can anonymously or confidentially report wrongdoing or seek guidance without fear of retribution. How one goes about investigating such allegations, however, requires careful consideration. One need only be reminded of ‘pre-texting’ to understand the risks of faulty investigations.

Organizations must also provide consistent enforcement of disciplinary measures at all levels, as well as appropriate incentives for conduct. It is important to recognize the extraordinary impact compensation systems have on employee behavior and that meaningful steps be taken to align performance and compensation systems with desired outcomes in the firm.

Another essential component of a good ethics program is for organizations, when confronted with criminal misconduct, to take reasonable steps to prevent  further recurrence.

Lastly, an overarching element, and in many ways the starting point for any effective program, is undertaking ‘periodic risk assessments’. When this element was first promulgated ‘periodic’ seemed to suggest every other year. In fact, the standard for best practice has been established as continuous assessments.

So what’s happened since 1991?

The 1991 Federal Sentencing Guidelines gave birth to the business ethics profession. Evidence of this phenomenon is apparent in the evolution of the Ethics and Compliance Officer Association (ECOA). The ECOA, a nonprofit membership organization, was formed in early 1992 by a group of 19 members who were interested in creating a multi-industry organization where they could come together and share best practices. Following its formation, the ECOA has experienced steady growth each year, reaching over 600 members by early 2001. Since the passage of SOX, however, the ECOA membership has more than doubled to over 1,350, clearly reflecting the new legislative, regulatory and prosecutorial standards.

Partners in crime-fighting

If it can be said that USSC created the ethics profession, then SOX created an entire industry. The emergence of SOX in 2002 has accelerated corporate commitments to ethics and compliance programs. The clear language of SOX speaks directly to governing bodies (boards), top executives and public accounting firms. Its major provisions include, among others, the creation of the Public Company Accounting Oversight Board, evaluation and certification of internal controls, certification of financial statements by CEOs and CFOs, new governance standards, a ban on personal loans and accelerated reporting of insider trading. And failure to meet these rigorous new standards can mean serious civil and criminal penalties.

SOX has impacted USSC in other ways: Section 805 charged USSC with reviewing Chapter 8 to ensure it was in keeping with the spirit and letter of SOX. As a result, revisions to the Organizational Sentencing Guidelines became law on November 1, 2004, wherein new standards were established. To facilitate law compliance there must be ethics standards and cultures that embrace them. Similar language has been adopted by virtually every regulatory body in Washington, DC. It is becoming increasingly recognized that mere compliance with the law is not sufficient, and that regulators, prosecutors and the courts are looking for organizations to commit to standards beyond the law.

Reinforcing the importance of this, the Ethics Resource Center, a nonprofit research group in Washington, DC, in its most recent National Business Ethics Survey (NBES) notes that beginning in the second year, a compliance-only program begins to lose effectiveness. In fact, NBES clearly points to the importance of corporate culture in regulating and motivating employee behavior. As a result of this new emphasis on ethics and culture, many ECOA member companies are undertaking culture assessments, recognizing the impact they have on workplace behavior. In the end, compliance with the law does not require a ‘gut-check’. Ethics and values-based cultures are about winning the hearts and minds of the stakeholders.

Taking root

Looking back, we can see just how much progress has been made through the efforts of the ethics and compliance community. SOX empowered ethics and compliance professionals to act as agents of the board. As such, their fiduciary responsibilities have never been stronger.

Today, our programs and initiatives are taking deeper root. Emphasis is not just on compliance, but also on developing values-based cultures in our organizations. However, we may be challenged in the months ahead, operating in an environment where the stock market appears to have topped out and earnings are being challenged by rising costs, a badly sagging housing market and global competition. Later this year cost-cutting, including layoffs, loom for many organizations. Let the message be very clear, however: the failure to continue the course towards greater self-regulation can only be met with one other alternative – more regulation.

As we look into the future, the true measure of success for ethics programs shouldn’t be just limiting the liability to our organizations, but also how our efforts contribute to the success of the enterprise. Great companies that weather market turbulence are built upon a foundation of ethics and values-based cultures. And developing an effective ethics program is often the first step in creating an atmosphere that inspires excellence.