Perhaps the most prescient comment I heard during the height of the pandemic came from Jed Gardner, Group Director of Transformation at Linedata, which was that we have moved from disaster recovery to business continuity to business as usual. It appears that not only was the comment correct but now we are moving in the business world from crisis to crisis to crisis. This month’s Harvard Business Review magazine dedicated its Big Idea Series to the topic of crisis. Over this short week I will be exploring what this new reality means for the compliance professional. We begin with the article A New Crisis Playbook for an Uncertain World by John E. Katsos and Jason Miklian. As we enter a period of unprecedented instability, is your compliance function prepared?
The authors begin by identifying what makes us now in essentially permanent crisis but as Gardner reminds us, it’s just business as usual. They state, “Today we stand at the precipice of not one but three converging and potentially catastrophic long-term trends: climate change, globalization, and growing inequality.” Given the political instability of America and much of the world, these will only get worse. Moreover, because of this political instability, corporate America has been forced to take the lead in providing solutions to these crises. But one type of crisis can initiate several other types of crises, so “the Covid-19 pandemic, for example, was not just a health crisis but an economic and political one as well.”
Last year we saw increased pressure on compliance functions to speed things up, disregard existing controls for the sake of expediency and move to doing business with a wide variety of third parties, both on the sales side and in the Supply Chain that were not fully vetted through standard due diligence. The Department of Justice (DOJ) responded to these developments in a very clear manner, do not forsake your standard controls for the sake of expediency. If you do and the resulting conduct violates the Foreign Corrupt Practices Act (FCPA) or other federal law, standard or regulation, your organization will not be able to use the excuse that it was an unprecedented crisis.
What the authors found was that “the red-flashing danger signals were always apparent to anyone reading the local news or talking to local people.” Yet almost all companies were “trying to do what they thought was the right thing. But the ones that both survived and thrived had more than good intentions or strong leadership.” Most interestingly, the single most important tactic for every company was to employ a tool long used by every successful Chief Compliance Officer (CCO) and compliance professional – to listen. Every best practices compliance program has a series of early warning posts which should be monitoring your organization. It could be the hotline, your internal controls, your compliance professionals embedded in business units or it could be your local compliance resources who are not compliance function employees. The authors developed a business playbook for dealing with them that I have adapted for the compliance professional.
Listening Locally
A compliance function cannot do effective strategic risk planning or risk management without understanding your organization’s sociopolitical context. The authors found that companies which “had little engagement with local communities, viewing them merely as sources of consumers or raw materials, were unlikely to outrun upheaval.” This is compounded that when a crisis hits and it becomes economic, leading to layoffs, your information flow is constricted and perhaps resentments arise from arbitrary closings. The key is to build a broad base in such localities, both in your compliance function but also far beyond. This is where both ESG and corporate social responsibility (CSR) initiatives can be critical. Through such initiatives, companies can “build deeper ties with the broader community, because those connections are integral to business survival during crises. This means developing relationships with local leaders within and beyond the corporate world and working across societal dividing lines instead of siloing within the “safest” segment of the community.”
Now think about those same concepts from the compliance perspective. Even if you do not have compliance professionals physically located in all regions, this is where your local compliance champions can be so critical. They can provide you information on a wide variety of topics. You could also consider the Regional Compliance structure I have previously advocated which can put an early warning system in place.
Go Beyond the Government Requirements
If it is one thing the business community has learned over the past few years is that the fractured US government will not show leadership in any meaningful way. While businesses have called for greater government regulation and oversight, most particularly in the tech sector, the government has failed to answer. This was most evident in the Business Roundtables Statement on the Purpose of a Corporation where businesses advocated a broader view of stakeholders than simply shareholders. Of course, the Trump Administration laid down regulations that were clearly anti-ESG, even with all business concerns supporting ESG.
This means businesses may well have to go beyond the basic legal requirements. This is even more important in the age of social media which can amplify any corporate misstep that becomes a public controversary. Witness the reputational damage to companies when their supply chains are found to include forced labor or modern slavery of employees. For the compliance professional, it also means going beyond the local government where you might do business. If the port authority where you are bringing goods in continually demands bribes for unloading of equipment, you can engage with a higher level in that country.
Make Principled Choices
Most interestingly, the authors found that the third key step was to “not be afraid to take principled political stands.” They found that “firms tend to thrive when they make consistent choices and communicate them clearly, even if a segment of the population disagrees with them.” They pointed to “the case of the American yogurt company Chobani in the highly polarized United States.” While the company was criticized for hiring immigrants and supporting others in immigrating to the US, it continued to do so because it was not only the right thing to do, it was good for the business. It improved morale and brought a hard-working class of employees into the organization.
This would seem right in the wheelhouse of the compliance professional. Think of institutional justice and institutional fairness. Not only did the DOJ announce in the 2020 Update to the Evaluation of Corporate Compliance Programs that the CCO and corporate compliance function is the keeper of institutional justice within an organization but the social justice movement over the past 18 months have made clear that employees expect the same inside of an organization. Witness the current imbroglio of Activism. Even with a CCO who criticized internal company employee whistleblowers, numerous employees stepped forward with information about the toxic culture of the company, through specific instances of discrimination and harassment.
Many compliance professionals are currently engaging in these steps. However, they may not be thinking about them as early trip wires for the next crisis. With the further admonition from the DOJ in the 2020 Update to the Evaluation of Corporate Compliance Programs that the compliance function must have access across all the data lakes within a company, CCOs and others may be the most uniquely suited corporate functions to help be ready for the next crisis.
[View source.]
