Bringing It All Home, the Two Tough Cookies Wrap It Up For You, Part III

by Thomas Fox

Tales from the CryptNote-I asked the Two Tough Cookies if they could put together a series of blog posts wrapping up the lessons they have seen and learned and written about in their series of Tales from the Crypt. They graciously put together a series of posts on the seven elements of an effective compliance program from their 10 tales of Business Conduct. Today, Part III of a Three Part Series…

Wrapping it all Up

So, now you’re ready to start your culture audit… Some key questions you want to ask before you start are:

  1. Do I have the support of Executive leadership? If not, go back to your E&C steering committee and work through the objections there first. It should be comprised of empowered executives who can understand the value of what you propose, and give you insight how to get buy-in across the organization. Give yourself MONTHS to get this accomplished, if not years. If they don’t understand the value of what you do, it will take a lot of mini-meetings to get your point across. If you don’t have an E&C steering committee, start by forming one, and include your CEO, CFO, GC, CHRO, IA, and top business line leaders. Also include global representatives if you have a global footprint. If you have an executive management council, they should be on your E&C steering committee, because they are the decision-makers. Be careful not to have overwhelming representation on the administrative side. And make sure the CEO has representation – if he or she doesn’t have time to manage for integrity, then you need to go elsewhere.
  2. Have you clearly articulated the ethical standards of your organization and the procedures to follow in order to meet those standards? If not, or if you’re not sure, start with a small sample survey of some key expectations and do a small focused study on what critical pieces are missing, and work to fix it. That’s your baseline, and you will then have metrics to measure against when you really start to change things for the better!
  3. What are the operational values – the values that define “how things really work around here”?

Your continuum looks like this depending on your ethical climate:



Emerging Ethical



Rules Based

Rules Plus Values

Principled Performance

Organizations that are Compliance-oriented typically

  • Have a goal to prevent, detect, and punish legal violations
  • Channel behavior in lawful directions
  • Underlying model is deterrence theory
  • People are rational maximizers of self-interest, responsive to personal costs and benefits of their choices
  • May be seen as a rule-book, a constraint (especially if overemphasis on punishment)

Organizations that operate with Principled Performance (High-Integrity) typically

  • Combine a concern for law with emphasis on managerial responsibility
  • Define companies’ guiding values, aspirations and patterns of thought and conduct
  • Focus on Accountability, leveraging self-governance in accordance with a set of guiding principles and encouraging independence of thought with an introspective view on personal accountability. Each employee = Ethics Officer

Successful integration of Integrity in your organization is hard work. It takes guiding values and commitments that make sense and are clearly communicated. Company leaders are personally committed, creditable, and willing to take action on the values they adopt. The adopted values are integrated into the normal channels of management decision making and are reflected in the organization’s critical activities. It’s not enough to start every meeting talking about integrity, it has to be woven into every word and action of the leadership team, and done so authentically. The company’s systems and structures have to support and reinforce its values. Managers must be developed to ensure they have the skills, knowledge, and competencies needed to make ethically sound decisions, and resources must be made available on a non-discretionary basis to enhance those skills, knowledge and competencies. Continuing effort, investment, and integration is needed. Close enough is not good enough, and the work is never done.

Sample Gap Analysis of Culture




Organization Type



Emerging Ethical


Work Climate Type

Instrumental, Rules & Procedures

Rules & Procedures, Law & Professional Codes

Law & Professional Codes, Caring


Policy Type


Code of Conduct

Code of Practice

Code of Ethics

Policy Control


Use of rules

Seek advice, Act then disclose

Use of guiding principles

Training Type


Orientation, General courses

Seminars, Courses for some managers

Courses for most employees, Personal interviews

Training approaches

None or General Info

Rules and guidelines, Lectures

Decision-making frameworks, Case studies

Cognitive approaches, Exemplary modeling

Top management commitment


Formal communications of legal aspects

Some informal and formal means of communication

Various informal and formal mechanisms, partnering



Orientation, one-time distribution, annual review

Periodic distribution, Input into review

Frequent distribution, Two-way communication

Enforcement Officer

No one, Unimportant role

Legal or HR Dept, Compliance Officer

Sr. mgmt. committee, Ethics Officer, Supervisors

Each employee, High-ranking employee(s)



Arbitrarily enforced

Semi-consistently enforced

Consistently enforced


Keep job

One-time story, award

Special recognition

Publicity, bonuses

Help/hot lines


800 number, limited hours

Third-party staff, feedback

Follow-up, regular reports

Performance appraisal systems


Idea or suggestion only

High-level managers only, Affects pay or bonuses

All employees, affects pay, Affects promotions

Many thanks to the Two Tough Cookies for this great series!


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Thomas Fox, Compliance Evangelist | Attorney Advertising

Written by:

Thomas Fox

Compliance Evangelist on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.