"How do you know if they learned anything?"

That was a question a Board member asked me when, as Chief Compliance Officer, I reviewed with the Board our training plans and results. An excellent question (as questions at this level tend to be). Happily, I was able to tell him that all the indicators (eg post session testing, incidence of misconduct, speaking up etc) supported the view that the training program was effective.

That question brought to mind a broader question which Board members and management should be asking periodically: How do you know our compliance program is still effective?

Why is that an important question? For several reasons, including the following.

First, because successful businesses are not static and neither is risk. As a business grows, perhaps entering new sectors or geographies, so will its legal and compliance risks. Unfortunately, there are numerous examples of companies whose compliance programs didn't keep pace with the growth of the business resulting in unpleasant consequences. For example, Toll Holdings last year agreed paid over $6 million to settle claims of US sanctions violations. OFAC identified almost 3,000 potential violations over a six year period with a value of approximately $48 million. This, despite the fact that Toll had a sanctions compliance policy. Toll’s compliance program, personnel and controls failed to keep pace with the complexity of its growing business.

Secondly, regulators and enforcement agencies will assess whether and to what extent the corporation’s compliance program was effective at the time of the offence or misconduct (see eg Evaluation of Corporate Compliance Programs, (June 2020) US Department of Justice). A program may have been well designed but it is only through regular assessments that we can know how effective it is in preventing and preventing misconduct. (After all Enron had a beautiful Code of Ethics...)

Our recommendation to Boards and Senior Management is to ensure that a formal review process is built into the annual planning cycle. Waiting until serious misconduct occurs is likely to be an expensive choice. As President John F. Kennedy said during his Sate of the Union address in January 1962: “The time to repair the roof is when the sun is shining.”

Contact Exemplify Consulting LLC if you would like help with a program effectiveness review.

#compliance #legal #management #effectiveness