Ethics & Policy Integration Center
1717 K Street, NW * Suite 600
Washington, D.C. 20036
(202) 547-1789
November 6, 2002
United States Sentencing Commission
One Columbus Circle, N.E.
Suite 2-500, South Lobby
Washington DC 20002
Subject: Testimony/Statement Before the Ad Hoc Advisory Group on the Organizational Sentencing Guidelines: November 14, 2002
Background. As the Advisory Committee pursues its work, I urge that it specifically consider that the Federal Sentencing Guidelines for Organizations (FSGO) are establishing a de facto framework for ethics and compliance programs worldwide.
While the United States Sentencing Commission has no specific mandate to do so, of course, one can no longer discuss ethics and compliance programs, even internationally, without referring to (explicitly or not) the FSGO. This is the case despite its specific provisions being compliance minimums. With this in mind, I recommend modifying the “types of steps” to reflect their nature as a framework. Let me demonstrate why and how.
In international dialogue, of course, practitioners do not generally urge organizations in other countries, especially transitional economies, to follow the FSGO because they reflect law in the United States. For obvious reasons, that would lead to virtually wholesale rejection in many cases. Recommending that a foreign organization follow the FSGO in designing an ethics and compliance program is more palatable where it has aspirations of being ‘world class,’ because such organizations accept the argument that it is a competitive advantage to be able to point explicitly to their compliance. The same logic provides where the foreign organization aspires to be a strategic partner or preferred provider of an FSGO-compliant organization.
These “benefits,” however, do not apply for most organizations, foreign or domestic. But, the FSGO are nonetheless a de facto framework nonetheless because they provide the foundation for the ‘best practices” and ‘benchmarks” in ethics and compliance program design and implementation. But, many of these structures and systems are neither effective nor practical for foreign organizations or the small to medium enterprise (SME). They tend, as a result, to be ignored as “impractical” or “not culturally applicable.” Moreover, incorporating specific current legal requirements or best practices risks stifling creativity and moral imagination. It puts the FSGO at further risk of being perceived as less the floor for effective ethics and compliance programs than the ceiling.
The FSGO as a Framework. This being said, where there is, or is expected to be, resistance to the FSGO per se, I have had great success with an exercise styled, “If the FSGO are the answers, what were the questions?” The pursuit of this exercise points out the value of the FSGO as a framework, suggests that a general approach is better that more detail, and points to one additional “type of step.”
Without belaboring the point, the exercise pursues the standard journalist questions (who, what, where, when, why, and how). It concludes that the FSGO offers a framework with a summary that goes something like this:
We can agree now that an ethics and compliance program is a fundamental aspect of good management practice(s) for a self-governing organization. Given a sound set of beliefs, including an organizational vision, what questions must leadership ask itself and its stakeholders if the organization is to guide the [business] conduct of its members and other agents and establish reasonable expectations among its stakeholders?
First, what standards should we to set to guide the [business] conduct of our employees and other agents and establish the reasonable expectations of our stakeholders? (FSGO.1)
Second, consistent with these standards, how should leadership, authority, and responsibility be exercised at all levels? [FSGO.2]
Third, how can we ensure that our members and other agents are motivated and capable of contributing to achieving our organizational vision? [FSGO.3]
Fourth, how can we effectively communicate our standards in order to guide our employees and other and establish reasonable stakeholder expectations? [FSGO.4]
Fifth, given that management needs to know how its organization is performing, how can we know that our employees and other agents are following our standards and we are meeting our stakeholders’ reasonable expectations? [FSGO.5]
Sixth, how can we encourage our employees and other agents to follow our standards and manage our stakeholders’ expectations? [FSGO.6]
Seventh, when things go wrong—through mistake, misconduct, or misunderstanding—how should we respond? [FSGO.7]
Eighth, how do we know our ethics and compliance program is effective?
Discussion. These general questions suggest that the FSGO will be effective if they set general requirements for an effective program and an obligation on the part of the organization to explain how its ethics and compliance program satisfies these requirements with specific reference to its own context and culture. I believe to my core that Federal sentencing will be more rational and uniform if these two conditions prevail: (1) organizations will be expected to justify their program design and implementation and (2) the Federal Judiciary will exercise its Constitutional prerogatives to find whether their explanations are adequate with due process and such expert opinion as it might deem appropriate. With all due respect to Congress, layering on significant details, especially recent, unproven reform legislation, is an undue restriction on organizational and judicial judgment. Today’s organizations must be dynamic to survive and thrive. Ethics and compliance programs must invite the same “justifiable flexibility.”
Justification for the first question relating to standards would include who issued the standards. Certainly the better view is that the board either initiates or directs their implementation, but I would not require that subject to a reasonable justification of who promulgated what standards—and why—to allow flexibility for foreign firms, foreign operations, and the SME.
The fifth question for self-governing organizations is particularly important for capturing a major issue in the United States and many transitional economies. The specific answers of an organization must at least implicitly address both the context and culture of the organization. In most countries—foreign and domestic—there is a serious reluctance to report misconduct and no means by which an organization can make an enforceable promise of confidentiality. This is particularly true is some of transitioning economies though it is nowhere near as general in practice as many would have it.
Where this reluctance to report misconduct prevails in an organization, the follow-up question is based on two assumptions: (1) that management needs to know what is going on and (2) that knowledge is embedded throughout the organization.
Follow-up question: The FSGO suggest that there are two sources of this important knowledge: (1) the employees and other agents will inspire trust from management who will rely on them to regularly seek advice and report misconduct or (2) management will not expect employees and other agents to report misconduct and will have to look over their shoulders through auditing and monitoring. If you will not speak up— and you agree that management needs this information—how much auditing and monitoring do you think is reasonable? And, what will that do to the overall effectiveness of the organization?
This follow-up question generally counters the knee jerk employee reaction to reporting misconduct, at least for purposes of further dialogue. Though it may not be obvious, it captures an essential values issue: if the culture of the organization is such that its employees and other agents are not willing to report misconduct, then, management must necessarily do extensive auditing and monitoring. Employees must make the choice: does it want management to trust them because they can reasonably expect them to report the information management needs to know, or do they want management using important organizational resources looking over their shoulders?
An important contextual issue, of course, is whether the organization can make an enforceable promise of confidentiality through privilege. Without such a privilege, it is very difficult for organizations to design mechanisms that are truly free from the fear of retribution as many studies suggest. Here, as the organization justifies its fifth step process, public policy considerations would suggest that a privilege to support an enforceable promise of confidentiality would require a policy of fullest restitution for harm and disclosure to appropriate authorities.
You will note that the eighth question for self-governing organizations does not have an equivalent FSGO answer. FSGO.7 does refer to the organization learning from its response to misconduct to include: “including any necessary modifications to its program.” This is not the same as evaluating whether the program itself is effective.
Management today is adept at measuring performance effectiveness in the nearly ubiquitous total quality programs such as ISO 9002. The same is true for governments such as the Federal government and State of Maryland. The latter recognize that what is important are not structures, systems, and actions, but results and outcomes. See, e.g. Government Performance Results Act and the State of Maryland’s Measuring for Results Program. There is no reason why organizations should not be required to demonstrate that they routinely evaluate the effectiveness of their its ethics and compliance programs to explicit, measurable outcomes.
Being able to demonstrate why the organization believes its ethics and compliance program is effective suggests adding an eighth step: “The organization must have taken reasonable steps to regularly evaluate its program for its fitness for purpose and effectiveness in realizing explicit, well-considered program outcomes.”
In my experience, this ethics and compliance program evaluation requires attention to at least two categories of information: (1) certain aspects of organizational culture and (2) expected program outcomes. For example, how does the organization know what the proper balance is to strike between trusting employees to report misconduct and auditing and monitoring unless it has asked focused questions over time about the willingness of its employees to speak up? Or, how does it know its ethics and compliance program is worth the effort (and worthy of consideration on sentencing) if it does not have explicit, measurable program outcomes that it is progressing toward?
Recommendations. Walking through this exercise suggests the following recommendations:
1. Err on the side of establishing general requirements within each step, but require documentation as to why the program was designed and implemented as it was—with specific reference to each step. For example, in arguing that it has an “effective program,” the organization must be able to demonstrate precisely why the standards adopted were adequate—and who promulgated them—with documents contemporaneous to their adoption. The sentencing judge would make findings as to adequacy of its justification.
2. Modify the fifth step to provide that “The organization must have taken reasonable steps to determine whether its standards are being followed, for example, by striking the appropriate balance between monitoring and auditing systems and providing a mechanism by which employees and other agents could seek advice and report criminal conduct by him or herself or others within the organization without fear of retribution.” This proper balance could only be justified by demonstrating an understanding of its organization culture and program effectiveness.
3. Add an eighth “type of step” requiring the organization to demonstrate that it regularly evaluates its program for effectiveness with specific reference to specific cultural conditions and expected program outcomes, such as: “The organization must have taken reasonable steps to regularly evaluate its program for its fitness for purpose and effectiveness in realizing explicit, well-considered program outcomes.”
Hope these comments and suggestions are of value to your important work. Please do not hesitate to contact me if you have any questions. I will send this by email with follow-on letter.
Sincerely,
KENNETH W. JOHNSON