Establishing a Culture of Ethical Behavior and Legal Compliance: Finding Perspective After Penn State and the Freeh Report

by Holland & Knight LLP

Ethical behaviors and legal compliance within any educational institution cannot be presumed; they must be cultivated, monitored and enforced. It is a team effort. It begins with senior leadership, including an informed and engaged board of directors, which must set the standards and then maintain them with appropriate institutional policies and practices. It follows, then, that an effective compliance and ethics program must cultivate a shared sense of duty and active, independent oversight.

In the wake of the Penn State crisis, educational institutions are assessing the effectiveness of their compliance and ethics programs. In doing so, they find themselves looking to the report published by former FBI Director Louis Freeh, Penn State's Special Investigative Counsel. That report contains Mr. Freeh’s candid assessment of how Penn State handled the matter based upon the results of an investigation he headed, and his governance recommendations for Penn State going forward.

The Freeh Report presents a fine starting point for an educational institution’s compliance review, as it identifies elements of effective governance and meaningful avenues for implementation and assessment of its compliance programs. It is not the end point, however. Each institution must develop its own programs to maximize effectiveness for its campus. This alert highlights several of those elements and avenues that are critical for all educational institutions to address in order to maximize their legal compliance efforts and maintain focus on their core mission to educate their students.

Taking a Step Back: Penn State

On June 22, 2012, a jury in Centre County, Pennsylvania found former Penn State University assistant football coach, Jerry Sandusky, guilty of 45 criminal charges related to unlawful sexual assaults on minors, many of which took place in Penn State's football facilities. On July 12, 2012, Mr. Freeh published a report that condemned Penn State's handling of the matter at various junctures and multiple levels. Many of the observations made about the Penn State situation apply beyond the specific tragedy of child sexual abuse and extend to a broad array of potential serious misconduct. Within the Penn State tragedy and the Freeh Report can be found a number of important considerations for the development of effective governance mechanisms. These mechanisms serve the institution’s underlying goal to prevent, report and respond effectively to misconduct by employees, faculty, students or others on campus.

Elements of Effective Compliance and Ethics Programs

An effective program has many elements. There is no one-size-fits-all paradigm for a singular compliance and ethics program, and the Freeh Report does not constitute an authoritative guide. Nonetheless, the Report does present some key points for institutions to consider as they develop, implement and assess their compliance programs, including:

  • designating a chief compliance officer with sufficient authority and resources to provide both guidance and oversight of activities that expose the university to risk
  • designating an ethics officer and/or council to advise leaders on the ethical ramifications of their decisions and the principles on which the institution expects them to make decisions (many institutions combine the compliance and ethics officer positions)
  • addressing reporting responsibilities of the Office of General Counsel to elevate reporting in a manner that allows proper communication to the level of the president and the board
  • centralizing and elevating human resources functions to enhance supervision of personnel decisions
  • conducting regular training and awareness programs as well as periodic risk assessments and compliance checks
  • fortifying whistleblower policies and protecting whistleblowers from retaliation
  • establishing multiple avenues of reporting, including an anonymous hotline
  • integrating all areas into the compliance program and dispel the perception that any person, department or program is “untouchable” or above the rules
  • involving experienced legal counsel early on when a significant issue arises

Decision-Makers and Decision Points

Perhaps one of the most striking patterns revealed by the Freeh Report is the reported breakdown of decision-making at nearly every crucial point in a timeline of significant events. These breakdowns are all too common in crisis management situations and even occur in more ordinary risk management assessments. Typical areas of weakness include observations that go unreported, reports that go unheeded, questions that are unanswered or never even asked, failure to reassess in the face of new information or unexpected developments, authorities who take no action, and authorities who act without sufficient information, standards, guidelines or oversight. The Freeh Report also focused on the importance of senior leadership to consider or act upon what is ethically required under the circumstances.

Important decisions demand careful consideration of who should make the decision and on what grounds. To avoid breakdowns in decision-making, consider asking the following critical questions at each decision point: Is there sufficient information on which to make an informed decision? If not, who is responsible for obtaining further information? Do the people involved have sufficient authority to make a meaningful decision? Should others participate to provide greater authority, experience, expertise or perspective? Are there specific policies, standards or guidelines to apply? What is ethically required? Has ethics or legal counsel provided guidance?

Board Engagement

The Freeh Report is critical of board governance. As the ultimate authority for schools and colleges, board members have a duty to scrutinize significant issues and decisions affecting the institution, and the institution’s administration has a corresponding duty to keep its board engaged and well informed. To achieve effective communication between the administration and the board, consider:

  • clarifying expectations for board membership, particularly oversight obligations
  • including board members who are unaffiliated with the institution
  • adopting written standards or protocols for reporting matters to the board
  • developing crisis management protocols
  • establishing working committees for compliance, audits and legal matters
  • conducting, at least annually, training on key compliance and ethics issues

The View from Outside

The insular nature of Penn State’s athletic program and university administration contributed significantly to the tragedy that unfolded, according to the Freeh Report. Insular decision-making is dangerous because it is often based on a myopic or distorted view of the situation and how it will be viewed by those outside. It is important, therefore, to seek advice and counsel from outside experts and independent authorities periodically.

General Counsel’s Role

As the chief legal advisor, the general counsel’s role is integral to the institution’s compliance efforts and related decision-making. Educational institutions should clearly define the responsibilities of their general counsels, whether they are internal or external, including reporting obligations to the administration and the board. They should be consulted and involved in coordinating legal compliance efforts, ethics initiatives and auditing mechanisms.

Going Forward

This alert highlights only some of the many areas that educational institutions should consider as they move forward with the development, implementation and assessment of their compliance and ethics programs. Holland & Knight’s Education and Compliance Teams are available to assist institutions in addressing these important issues. (Please refer to two previous Holland & Knight publications: our January 4, 2012 alert, "Preventing Child Abuse on Campus: What Schools and Colleges Need to Know," which provides an overview of applicable laws and a 10-point checklist on how to prevent child abuse on campus and how to respond effectively when it does; and our May 23, 2011 alert, “New OCR Guidance on Responding to Sexual Harassment and Sexual Violence on Campus: What Colleges and Universities Should Do Now,” which explains a guidance letter issued in April 2011 by the U.S. Department of Education Office for Civil Rights outlining the responsibilities of institutions of higher learning regarding the prevention of sexual harassment and sexual violence on campus, and suggests steps schools can take in that area.)

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Holland & Knight LLP | Attorney Advertising

Written by:

Holland & Knight LLP

Holland & Knight LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.