After a breach of compliance or customer trust, companies often struggle with how to make an appropriate response and the level of transparency to use for revealing the failure. Lately—as full and public disclosures of several management-commissioned independent investigations show— some companies have developed an increased level of transparency when communicating a compliance failure. ⁽¹⁾

Several reasons explain the move toward more transparency. Some consider increased transparency a good governance practice. Others consider it part of a board’s fiduciary duty when the issue involves the CEO. In addition, communities, clients, customers, and other constituents have come to expect that organizations be more open when something goes wrong. Many companies have found that their ability to remain transparent and find the right level of disclosure directly impacts the fallout they ultimately face in the wake of significant incidents.

When serious noncompliance incidents do occur, companies that understand compliance breach best practices can get to a decision about how to manage their specific breach more quickly.  Companies should consider how to: 

• Turn the problem into an opportunity
• Keep public forum or company town-hall discussions productive
• Use information gleaned for compliance process improvements
• Reinforce future compliance

Determining how to execute each directive is one way companies can determine how to make successful disclosures, take decisive action, and avoid the criticism that so often follows slow or incomplete disclosures.

Treat compliance failure as an opportunity

At first blush, publicly acknowledging and discussing a violation of legal or policy compliance seems a resounding criticism of the ethics and compliance program and the company’s culture of compliance. Although sometimes true, opportunity is also often borne from failure. The company can benefit greatly from an open and honest discussion about key questions:

• What caused the failure?
• How will the company address the issue?
• What steps will the company take to prevent future failures?

A company need not release an independent investigation, but can appropriately respond by hosting a town hall meeting for employees to understand what happened. In addition, employees will see that the company holds itself accountable— even when doing so is painful—and understand their role in preventing a recurrence.

When a company responds openly, it sends a clear message that it will not tolerate violations of law and company policy. A public discussion and assurances of no retaliation reinforce confidence that the company will hear and respond to complaints.

Keep public discussions focused on facts

To avoid allegations of defamation and violations or privacy, focus public conversations on the facts. Usually the most useful conversations concern process breakdowns, remediation, and prevention. Discussion about individual behavior is useful only as a limited learning tool. Beyond that, the conversation is not instructive, and thus not useful.

Welcome the side benefit of compliance failure

In the wake of a public discussion of a compliance failure, both employees and customers are likely to raise additional complaints and issues. Company leaders and lawyers should welcome the information and opportunity to address and resolve problems. An effective compliance team deals with these types of issues every day and can assist management in investigating and resolving any issues.

Reinforce a compliant culture when responding to a failure

Ideally, every day and in every situation, a company’s leaders should expect, model, and enforce behavior that complies with applicable laws and company policies. Their example sets the tone for compliance. Nonetheless, failures and violations are part of doing business. Some incidents are minor; some, major. How management, the legal team, and the board respond sets the tone for an overall culture of ethics and compliance throughout the organization moving forward.

Conclusion

Because organizations are made up of people and people are human, mistakes that breach compliance rules and/or violate customer trust are inevitable-no matter the strength of company culture. Understanding and implementing breach management best practices can help when human failures occur that challenge compliance rules. Companies that have a response roadmap can craft a strategy for compliance breach management to help leadership gain control of problematic situations, communicate effectively with stake holders and help build a better and more transparent compliance and corporate culture.

(1) Example investigations include the Jonathan Martin/Miami Dolphins (Issue of Workplace Conduct 2/14/14) and General Motors Ignition Switch recall, May 29, 2014.