Introducing a good compliance culture has been a goal for many organisations for some time. So what are some of the techniques for turning theory into practice, asks Shaun Drummond
Stop, look outside your window and think about becoming a marine biologist instead”, one compliance officer responded when asked to advise anyone interested in getting into the field. Compliance professionals have an unenviable job. CEOs and boards never miss an opportunity to complain of the compliance burden and it doesn’t tend to fire the blood of lesser mortals.
So if the boards are railing against compliance, and staff see it as a boring necessity that gets in the way of what they’re employed to do, it isn’t surprising you hear statements from judges noting how skin deep compliance with the law seems to be in some organisations.
So how are compliance professionals countering all this bad press, let alone introducing a ‘compliance culture’ in their organisation?
What works?
Most nominate getting the leaders in any organisation to focus on introducing and reinforcing at every opportunity compliance with the law and beyond that an ethical culture was vitally important, but achieving this for any length of time is a challenge.
“It’s very important that the board or senior management group can consistently and clearly paint the picture of what they want the culture to ‘look like’ and the behaviours that will be rewarded and those that won’t be tolerated,” says Maria Dalton, general manager, risk and compliance at QSuper. “It’s equally as important that they follow through and reward the desired behaviours and act on those not consistent with the desired culture.”
In her experience, organisations she has worked for have had “moments of brilliance and cohesiveness” and great culture. “But with changing management and board focus, and ever increasing concentration on increasing shareholder returns to the detriment of getting ‘the house in order’, those moments of brilliance never seem to last too long,” she adds.
“Many CEOs with a tenured appointment seem to have a short-term focus on what improvements can be made during their tenure and what changes need to occur in order for them to meet their immediate objectives.”
She speculates that perhaps this would change if longer tenures for CEOs could be introduced and bonuses and other rewards were “based on measurable cultural and financial improvements sustained over five to eight years”. “Cultures do not just bubble along indefinitely. They need constant nurturing, support and endorsement in order to be sustained.”
At a superficial level, some compliance staff have been assisted by a little positive spin, with the word compliance itself removed from their title. On academic undertaking a compliance culture research project says ‘quality manager’ is now popular. Sean Graham at Colonial First State told the Australian Compliance Institute conference last year his title had changed from head of compliance to ‘head of professional standards’. However, the change of name also recognises that the role of compliance staff is not just to ensure adherence to the law, but to try to make sure their organisation is implicitly committed to high standards.
Putting that idea into practice is, of course, the difficult bit.
Measuring culture
One of the big challenges in compliance, says Pamela Hauser, head of group compliance at the National Australia Bank, is how to determine whether you have a healthy compliance culture. What objective factors are good indicators that allow us to measure this? Until recently, this question has remained largely theoretical, she says, but compliance professionals are now beginning to get a handle on what they should be looking at.
“The research tells us that fear is the single biggest indicator of compliance culture – fear of reprisal in some form if you were to report an issue: ‘I have found this dreadful thing [non-compliance or unacceptable behaviour or fraud or so on], but I’m not comfortable letting the right people know what’s happening here because of the negative consequences for me’,” Hauser explains. “The research tells us that [fear of reprisal] is four times more important than any other single factor as a predictor of breaches or events or issues that are known and not reported in an organisation.” NAB conducts several surveys every year that include questions on how comfortable staff feel about raising problems.
As pointed out by Ron Bartsch, group general manager, safety compliance and operational risk at Qantas, the fact that the best measure of success in compliance and safety is a “non-event” reinforces the problem. How do you know that you have a culture that is working effectively to pinpoint problems before they turn into an ‘event’?
“If you are doing your job efficiently nothing happens. It is important therefore for safety and compliance people to sell their message and remind the finance people of their ongoing importance to the business and the value that they provide,” he notes in a paper given at the ACI conference in November. As a result, he says they must be able to “speak the language that accountants understand” to ensure that value is recognised.
Many echo this idea that to demonstrate the value and logic of adhering to imposed rules, and internal standards, part of the answer is understanding the psychology of their organisation and culture of their staff and then using the a form of marketing to engage them. Ultimately, the nirvana is to recruit individuals to the cause to such an extent that they are looking for something that is not right, and are happy to report it to managers and help them deal with any problems.
Getting staff to want to help
Graham at Colonial First State says getting staff to want to comply using the “right blend of hugs and kicks” is part of it. “We use the language of professionalism,” he says.
In general, he says the mindset of management and staff to compliance is: “these guys are a risk”, because non-compliance with the law is a major risk to any company. The business generally does not understand what compliance staff do, but he says it helps that in a compliance role you can be “honest” with people.
“Trust and discretion is an essential part of the business: be an adviser to the general manager. The average life of a senior manager is 18 months. We have got to be able to deliver long-term benefits, but in short, sharp increments.”
But as well as making sure staff are told their obligations, and tested on their knowledge, he says making sure individuals want to report matters of interest to him is a great help. Appealing to “egos” is one way to get individuals to do something they think is onerous or will cost them money – or at least divert them from these primary tasks – even though it is a requirement that they do it, he adds.
“Recognise their professionalism – appeal to their ego,” he says. “When you are going to monitor financial planning networks, they are all making squillions and it is very difficult to do it any other way. In the same vein, he says compliance officers also have got to “allow the person above you to claim credit” for any compliance strategies “for it to be well built into your culture”.
New York-based Kenneth Swiss, vice president, global markets compliance at Deutsche Bank Securities, says breaking down the ‘us’ and ‘them’ mentality is important. “In my experience being able to relate to the business has been highly effective. There are many ways to do this. One way is just being yourself. It is not wrong to bring your personality to work – but everything in moderation.
In a recent training program he found using examples of other Wall Street brokers and banks – especially the insider trading examples – grabbed their attention. In addition, he tried to make it interactive. “So I purposely included a mistake and then offered a chocolate bar to the person who discovered it. It was clearly a gimmick but I played to their desire to win. That was my strategy.”
On what not to do, Swiss says simply parroting the do’s and do not’s is ineffective and a waste of everyone’s time. “In an industry where time literally equates to money, people on the sales and trading desks have limited bandwidth for non-business activity – so you have to engage your audience. I am conscious to keep it brief. This applies equally to policy drafting and training.”
Process as well as behaviour
Hauser at NAB says a compliance culture shouldn’t just be about behaviour. Employees have to know what the rules are and what is required of them.
“[Compliance culture] is of course about behaviours. But it is also about awareness of the rules that you have in-house, and of external regulatory obligations. More than that, an effective compliance culture is about a willingness across the organisation to commit to those rules and obligations,” she says. “Without this willingness to commit organisationally, a simple focus on behaviours will be insufficient. The organisation will be courting compliance failure.” Compliance staff, she says, need to create an environment that not only has a good culture, but has the structure and procedures in place to make it easy for staff to comply.
One of the most important ways of inculcating a good compliance culture is via the education that staff receive. In the past, Hauser says compliance training often involved “mini law lectures”. In general, employees don’t need to know the very fine points of the law. But they do need to be able to recognise issues, to know what to look out for, and the right questions to ask themselves. Importantly they need to feel comfortable escalating something they know or suspect to be wrong. “You want people to recognise that something looks wrong, and to know immediately how to respond.”
Bartsch at Qantas says management needs to understand the full costs of not ensuring that compliance is effective and, especially for an airline, that there is a “safety culture” in place.
Qantas has recently created his position to oversee all occupational health and safety, compliance and operational risk for the airline as new legislation comes into effect mandating an approved safety management system (SMS).
If the organisational structure is the skeleton, says Bartsch, then the SMS is the heart of the organisation. “To continue the analogy, the SMS will allow the organisation to survive and grow but relies upon an ongoing health safety culture – this is the organisations’ blood,” he explains. “It continuously feeds the heart with nutrients, information, and continuously monitors the overall health of the body, in other words via systems audits.”
Management training needs updating
A good culture has to be introduced from the top down, even if it is ultimately being driven by the compliance staff, says Angus Young, an academic who lecturers on the topic of compliance at several Australian universities. It then has to filter back up through the organisation.
At present, though, regulation is almost always seen as a hindrance, rather than a part of good corporate practice, he says. It depends a lot, of course, on what the legislation is and how well it is crafted. But a big challenge for compliance staff, says Young, is convincing management to try to turn regulatory requirements to their advantage and ensure it is part of the plan for growing the business, not hold it back.
As such, Young says there needs to be a more fundamental re-think of how senior managers are taught how they should treat regulation. He believes, like it is beginning to be approached in some companies, management schools need to include training in ways to make compliance a positive force, not as an extra “legal” component to the course.
Knowing when you’ve got it
A company needs to determine what sort of behaviours will lead to a good compliance culture and then make sure staff are well informed about what is expected of them, says Dalton at QSuper.
“These behaviours are not specific to a compliance culture but are desirable in any type of business. We’re talking about doing things right, owning up when things are not done right and providing resources, training and process documentation to ensure everyone is aware of what is the desired and correct way to operate,” she says.
Bartsch says the free flow of “information” from employees back to management is a primary indicator of a good culture.
Hauser says the Australian compliance standard, AS 3806, last updated in 2006, provides some useful guidance on culture and she will often mentally check off whether the elements of that standard have been met when speaking with the business or making her own assessments.
Sometimes, she says, you only have to listen and watch senior management to be able to tell whether a good compliance culture exists.
“Many years ago, in another organisation, I remember going along to a staff meeting and the [managing director], was emphasising said how important compliance was to him,” she recalls. “Having made his point and completed “his duty” publically to support compliance, he immediately rushed off to check what the share price of the company was. Everybody saw his actions and the look of relief on his face – ‘oh thank heavens I have got that out of the way’ – that was the real message everyone received. At that point, he undid everything that he just said. The people in the room saw what was really important to him and it wasn’t compliance.”
The Australasian Compliance Institute is holding a Finance Sector Forum on the new challenges for compliance and risk professionals on 15 April. Go to www.compliance.org.au for more details
News