Wayne Brody: Making the business case for E&C

LRN, a culture and ethics advisor to more than 500 companies, has been researching ways to measure the effectiveness of ethics and compliance (E&C) programs. This year, based on data collected in its sixth annual Ethics & Compliance Leadership Survey, LRN developed the first Program Effectiveness Index (PEI), an attempt to assess compliance programs according to factors that can be compared across organizations rather than just internally. Corporate Secretary’s associate editor David Bogoslaw recently spoke with Wayne Brody, a senior leader at LRN, about the characteristics that distinguish more effective programs from the rest.

What is LRN’s approach when advising companies on their ethics and compliance programs?

A real differentiator for us is that we approach those areas through principles and values [as opposed to rules]. We have a very strong point of view that compliance as such should not be the be-all and end-all. It’s but one outcome of a potential focus on the overall culture and behavior of the organization. So everything we do turns around that, whether it’s computer-based training or other kinds of training in traditional ethics and compliance areas, or leadership development, or cultural assessments and other assessment tools that we use. For example, we’ve recently been building a computer game based around the issues of conflicts of interest and anti-bribery.

Would you talk about the metrics LRN used to construct the PEI and how the index ties in with measuring program effectiveness?

There were five questions in the survey that really spoke to leadership assessment of the programs. We had one respondent per program and 200-plus programs. The distribution of answers looked like you’d expect it to from a statistical point of view, and nobody answered those five questions in ways that suggested they weren’t being self-critical and paying serious attention.

There are three key roles that the E&C function plays within an organization. The first and most traditional is the role of the overseer, with a focus on controls, risk management and investigations. The second would be as a business enabler, which is critical and much overlooked – that is, the role of the program in providing advice and counsel and in enabling better decision-making throughout the organization. Some of it’s as straightforward as, ‘There’s a new regulation in my area of business; what do I have to do to comply?’ Or, ‘How can we turn our skills at complying with it into a competitive advantage and drive towards corporate strategic goals, whether it’s growth or new markets or increased sales?’

It’s very important to see an E&C program as part of the business. One thing we’ve learned through the survey data, and anecdotally before that, is that if a program is going to be effective, it needs to be built into the organization. It can’t be a business preventer – it has to be a business enabler, or it’s always going to be viewed as a bolt-on by the business unit leaders.

The third role is as a corporate conscience – promoting a corporate culture, addressing employee concerns, having a voice at the table, setting the strategy from a cultural and ethical point of view. There were three questions in the survey specifically addressing the program as overseer, as business enabler and as corporate conscience.

Then we looked at two other measures that we thought spoke to the impact of the program. The first was the extent to which employees applied their understanding of the organization’s code of conduct on the job. One way to look at programs is beginning with the code of conduct, which is typically the centerpiece of it. How effective are employees at getting that onto the shop floor and into the decision-making in every cubicle, in every office, in every sales meeting? Finally, we looked at the impact of E&C education as opposed to the program as a whole – the impact on employee behavior and decision-making.

The idea of measuring how effectively the program serves as a business enabler is interesting. How does that work?

Putting it another way, to what extent can we turn our skills in compliance into a competitive advantage? Knowing this has to be done, can we do it better than the other guy? Can we out-behave, and have out-behave become outperform?

There are two ways you see this happening. One is doing it more effectively, efficiently and quickly than your competitor in settings where you’ve got it figured out while the other guy gets slowed down by regulatory requirements. Or, from personal experience, you understand it and learn it and do it so well that you provide to your customers or suppliers an opportunity for them to outsource that concern to you. If you know how to comply with a particular regulation that impacts the entire supply chain in whatever your product or service is, the person buying from you may say, ‘You’ve got that covered. I’ll let you handle compliance with X that might come up in export administration.’ Or, where it’s difficult to ship goods into a country in which your customer is operating, they may say, ‘You’re really good, so I’m going to buy these from you and let you handle that tricky business that otherwise I would have to handle.’ Or a supplier might say, ‘I don’t want to build the staff or the expertise to deal with that compliance issue of getting a product into that particular market, so I’m going to let you do that for me.’

That’s real competitive advantage, structural competitive advantage – when you take that to the business unit leader, and instead of saying ‘I’m going to stop you from doing business,’ you say, ‘Let’s figure out a way to turn this into more business, better business, more profits.’ That’s ethics and compliance on steroids, when it’s built into the organization. And that’s true whatever your place in the supply chain is, whether you’re downstream or upstream. That’s compliance as value-add in terms of expanding your position in the supply chain.

You see lots of examples of it, such as the Restriction of Hazardous Substances [RoHS] Directive [a European Union regulation that took effect in 2006]. If ethics and compliance as a function is deeply embedded in the organization and builds into the organization a capacity for seeing these things coming and dealing with them in a really effective manner, then, using RoHS as an example, as customers need RoHS-compliant components or suppliers need to ship product through their sales channels, the company that’s on top of that from a compliance point of view has a competitive advantage. And where the compliance officer has a seat at that business table, they can say to the folks involved in those sales and marketing functions, ‘We see the product or service we’re delivering not just as the thing, but how we do the thing.’

The point of all of this is that these days, there are no secrets. Everybody with a cell phone is a videographer and a news reporter. That means that businesses are really interconnected, they’re really transparent, so ethics and compliance is just a way of helping to make sure that companies fit into that new world. Nothing can be kept secret any more, so everything’s got to be done as well as possible. There are no more faraway secrets that happen on the other side of the planet. Everything’s right here.

What are some of the most prevalent examples of outcome-based metrics that E&C leaders have developed with the aim of linking their E&C activities to desired results?

What our data shows is the blend between outcomes in terms of program effectiveness and in terms of business outcomes. Business outcomes are the usual, the things most people get measured on, such as ‘Did you hit your numbers for the quarter?’ But companies are beginning to measure behavior, to measure culture within individuals in their organizations. Some of our larger partners have very sophisticated performance review processes that include various markers of ethical behavior, or E&C program markers such as, how often did managers convey E&C-designed messages to their workforce? If they were supposed to include, on a monthly cadence, ethics and compliance messaging in their regular meetings, how often did they do that? How effective do people within their domain view the messaging they got from their internal leadership? That’s being measured in a number of different companies.

One partner I work with has a ‘management by objectives’ plan for managers that says they are supposed to, no less than four times per quarter, address the messaging given to them by the E&C program on these topics; this is part of the performance evaluation for the manager. The company also looks at responses from annual performance evaluations of employees under that manager’s span of control and asks whether the manager is behaving in the ways that they’re trying to communicate, and the company includes that as part of the management review.

We’re having lots of discussions with partners around best practices and opportunities for measuring E&C and behavior in the workplace on a regular basis. They’re going beyond the engagement survey to an actual assessment of matters like whether an employee is trusted or feels trusted, or is observing misconduct or is comfortable speaking up about misconduct, or is comfortable speaking up about other things. We have assessments that people are using today which are based around how well they understand the company’s values and how consistent their management’s activities are with respect to those values. People are doing that more and more – looking at behaviors in the workplace, as opposed to just business outcomes.

Your data shows that how a company spends matters more than how much it spends on E&C. Tell us a little about that.

More effective programs spend less on consultants and more on education than less effective programs do. Programs tend to be on a continuum, and people are at different stages in their journeys when it comes to E&C programs. Some of them are new and are just being developed, so they haven’t had a chance to have an impact; these programs may be spending more on consultants in that phase.

In terms of specific educational approaches, it seems that both variety and pacing are really important in these programs. What seems to stand out is that doing a once-a-year big blast of code-of-conduct training for an hour or two doesn’t seem to be particularly effective. More varied modes of communication and more frequent pacing of communication seem to be hallmarks of effective programs. I think this speaks to how much a part of the regular life of the organization ethics and compliance is, as opposed to it being this thing once a year that employees have to sit through or sign on to. That latter attitude tends to be a hallmark of a less effective program.