Framework for Assessing Ethics/Compliance Programs

Other ethics & policy tools

Ethical/Legal Context

Effectiveness of an ethics/compliance program depends in large part upon how effectively the organization deals with the ethical/legal context in which it operates. An organization not actively considering its context-and adept at managing change within it-is unlikely to be able to design, implement, and maintain an effective ethics/compliance program.

Moreover, research and experience demonstrate that an effective ethics/compliance program is congruent with, or "fits," the culture of the organization. This organizational culture is a product, in part, of the ethical/legal context or environment of the organization itself: the demographics and laws of the nations in which it practices, the cultures of its stakeholders, the nature of its industries, and many other factors. This context can be expressed in terms of the pressures the organization faces: threats, opportunities, demands, restraints, and uncertainties.

Also placed in the context of the organization is its history and strategies: its key events, responses to crises, leaders, formal purpose and values, myths and stories, and rituals.

Organizational Climate/Culture

The principal predictor of an effective ethics/compliance program is the climate/culture of the organization itself. Climate/culture is a function of the ethical/legal environment of the organization, its formal structures and systems, the informal arrangements through which work gets done, and the congruency or "fit" between them. Some factors are more or less measurable; others are not. For an organization, we have found it helpful to organize both qualitative and quantitative data into five "characteristics" of a highly-effective organization and other, more generic influential factors.

Essential characteristics of organizations and communities

1. Extent to which leaders and members alike embrace the organization's core purpose and values, and are adept at preserving them while stimulating progress.
2. Extent to which leaders and members hold themselves responsible-and others accountable-to high standards
3. Extent to which leaders encourage members-and members welcome/accept the opportunity-to participate in organizational/community affairs,
4. Extent to which leaders and members have the knowledge they need, when they need it
5. Extent to which conflict and mistakes made in good faith are seen as opportunities for learning and growth

Measurable influential factors of organizational climate/culture

1. Perceiving that leadership cares about ethics/values as much as the bottom line
2. Openly talking about ethics and values
3. Using values in decision-making
4. Feeling treated fairly
5. Feeling pressure to compromise values
6. Believing ethical behavior is rewarded
7. Believing unethical behavior punished

Program Orientation

Management's motivation in designing and implementing the program is an important predictor of program effectiveness. It is helpful to think of management's motivation for a program as being of four broad, nonexclusive types: values-based, rules-based, external stakeholder based, and protecting top management. Research and experience demonstrate that values-based programs tend to be more effective though, depending upon the ethical/legal context of the organization, including rules and the aspects of rules-based programs may also be valuable.

Formal Program Characteristics

In the 1996 In re Caremark opinion (C. A. 13670), the Delaware Chancery Court signaled that members of an organization's board of directors had a duty to establish programs to prevent and detect wrongdoing. The Court held that "A director's obligation includes a duty to attempt in good faith to assure that a corporate information and reporting system . . . exists and that failure to do so under some circumstances may . . . render a director liable for losses caused by noncompliance with applicable legal standards."

The most obvious component of an effective ethics/compliance program is its organizational structures and systems. Research and experience suggests, however, that while necessary, these formal characteristics are not sufficient. Indeed, this is the least significant of the six components of the framework we employ here.

In the current legal context of organizations in the United States, the accepted minimum structures and systems of effective compliance programs are defined by the Federal Sentencing Guidelines for Organizations (FSGO) promulgated in 1991 by the United States Sentencing Commission, the FSGO expressly apply to labor unions. Though the FSGO are voluntary, they have come to set the de facto minimum standards for compliance programs. Under the FSGO, industry standards and government laws and regulations augment these minimums.

The best developed program, and the one most closely approximating the fiduciary relationships many organizations owe stakeholders, are the procurement regulations governing Defense Department contractors. Defense Federal Acquisition Regulations Supplement (DFARS) 203.70 sets Department of Defense requirements for an effective ethics/compliance program. The Defense Industry Initiative on Business Ethics and Conduct (DII), which predates the FSGO, sets emerging industry requirements, which include annual ethics training for all employees, attendance at Best Practices Forums, accountability to the public, and filing an annual 18-question certification of compliance.

The Department of Health and Human Services first established a model compliance plan in 1997, and has published additional plans approximately every six months since for the entities it regulates.

The Department of Justice, in its 1999 Guidance on Prosecutions of Corporations, refused to set forth standards to follow in determining whether organization had an effective compliance program, but directed prosecutors to consider the existence and adequacy of the organization's program. The guidance refers prosecutors to the FSGO for more detailed treatment.

Organizations such as the Ethics Officer Association and the Ethics Resource Center research, develop and disseminate best practices.

Federal Sentencing Guidelines for Organizations

1. Established compliance standards and procedures
2. High-level personnel responsible for compliance
3. Due diligence in personnel assignment in high-risk areas
4. Communication of the standards and procedures through dissemination or training
5. Monitoring and auditing of the organization's activities, and a mechanism for employees and other agents to report wrongdoing without fear of retribution
6. Enforcement of standards through appropriate mechanisms, including discipline of those failing to detect the offense
7. Responding appropriately and to prevent further similar offenses, which includes modifying the program itself

The organization must also follow developing governmental and industry standards and self-disclose to the appropriate governmental agencies when misconduct occurs.

Best practices

Reason and experience are employed to determine what structures and systems, practices and protocols should be employed to create effective ethics and compliance programs. Research and experience over the last 15 years suggests that the primary best practice is to design a Corporate Responsibility Program that goes beyond mere compliance.

Our experience suggests that, with few exceptions, an effective program embraces aspects of the five primary approaches to organizational ethics:

1. An organizational integrity approach, which advocates a morally correct environment.
2. A human resource approach, which advocates organizational ethics as a means to the fullest development of human resources.
3. A loss prevention approach, which advocates organizational ethics as a deterrent to wrongdoing.
4. A legal compliance approach, which advocates organizational ethics as a means to satisfying legal requirements.
5. A social responsibility approach, which advocates organizational ethics as an integral approach to regulating operations so as to be consistent with the organization's responsibilities to society.

Beyond the design of the program itself, best practices have emerged as means to achieve program objectives. A short list of such best practices includes such diverse topics as:

1. The optimal format/content of ethics/compliance codes
2. The experience base/reporting relationships of the ethics/compliance officer;
3. Centralization versus decentralization of the ethics/compliance offices;
4. Composition of ethics/compliance councils;
5. Processing and styling of systems to seek advice and report misconduct, especially promises of confidentiality;
6. Ethics training, education, and development; and
7. Assessment techniques

Program Follow-through

More important than formal program characteristics is employee perception of management's follow-through. Management's adherence to the FSG requirements 6 and 7 above regarding enforcement standards, consistency of discipline, and appropriate responses to prevent similar offenses are critical in shaping those perceptions. The FSG and DFARS also require self-disclosure of wrongdoing and cooperation with appropriate government agencies.

Reason and experience suggest that management must also be perceived to be working to detect wrongdoing, follow-up on reports made by employees and other agents, and have consistent policies and actions. Key here are stakeholder perceptions about management's follow-through rather than the actual efforts themselves. Also significant are stakeholder perceptions that management avoids applying a double standard in following-through on its own program.

Ethics/compliance Program Outcomes

Finally, an ethics/compliance program can be tested for effectiveness by looking at eight elements of stakeholder activity. These more or less measurable elements are:

• Observing misconduct
• Recognizing/awareness of ethical issues
• Ok to deliver bad news
• Looking for ethics/compliance advice
• Reporting ethics/compliance violations
• Feeling satisfied with/committed to the organization
• Believing that the ethics/compliance program contributes to better decision making
• Satisfying external stakeholders

This basic approach was suggested by Trevino et al., California Management Review. Reprints available. It has been substantially modified, however, to include the component of "context," and the analysis of organizational culture is substantially different. In our practice of assessing Corporate Responsibility Programs, the relationship between measurable organizational conditions and program outcomes is often employed for diagnostic purposes.

Copyright 1999 Kenneth W. Johnson