Challenges and the mindset

So, without being able to itemize all of the challenges, generally speaking, it’s important to understand that as a compliance professional, you’re not an advocate for your CEO, the leadership team, the nonmanagerial staff, or any other interest in your organization. You are an advocate for your policies and procedures. That’s why I created the phrase, “If you’re not talking to me about a written policy, then you’re only talking to me about an unwritten fantasy!” Everything you do should be according to what’s written, and it is your policies and procedures that should drive your compliance program.

You may have someone whom you report to, but in reality, the policies and procedures of your organization are the boss. That is your true north. Being true to that and having the ability to ensure that your colleagues and everyone up and down the chain of command understands is key. I don’t care if it’s your first day on the job or your 30th year; that standard in compliance excellence should remain the same.

Without getting too technical, as a foundation, I think it would be wise to mention the Federal Sentencing Guidelines (Chapter 8) on the two fundamental elements of an effective compliance and ethics program, which are:

1. “[Exercising] due diligence to prevent and deter criminal conduct; and

2. “Otherwise [promoting] an organizational culture that encourages ethical conduct and a commitment to compliance with the law.”^[1]

In many ways, it’s a rather simple edict, but on the other hand, depending on the complexities of your organization, it can present some profound challenges as well, especially if you have weak leadership in place.

For at least the initial purposes of this article, I’d like to focus on a critical element of these guidelines that presents significant challenges to compliance programs and leadership in general: “[Promoting] an organizational culture that encourages ethical conduct and a commitment to compliance with the law.”

In my travels consulting and performing assessments of organizations both large and small, it is the “[promoting] an organizational culture” part that gives firms the most challenges. Why? Because many compliance programs consist of less than proactive paper pushers who simply evaluate the pain points and issues brought before them. And then, after they address the issue, either through recommending discipline, training, a tweak in a policy, the creation of a new policy, or other peripheral recommendations, that’s it! In the eyes of many compliance programs, by virtue of the fact that they may have addressed an issue that popped up in their inbox, that’s their way of promoting organizational culture when in fact it is not. It is one of the top reasons why I always proselytize that training and compliance need to go hand in hand. If the core compliance mission is to shape the culture of an organization, we know that the number one way that organizations are shaped is via training. The culture of an organization literally consists of everything that you train on and the failure or absence of everything that you don’t train on.^[2]

In order to be hyper-successful in this role—and really any other role of severe responsibility and leadership—there must be a special cohesiveness, synergy, and accountability between compliance, what’s being recommended, what the training actually looks like, and how it embeds into the culture of your organization. The problem is, when it’s fragmented into several different moving parts, divisions, sections, and leadership, the seamlessness, fluidity, and accountability of what compliance is saying can get lost downstream and become diluted. So, on the one hand, you may have a compliance team who offered 10 really good solutions, but on the other hand, they may be siloed from seeing how they’re presented and received at their root to the staff receiving the information. Thus, a potential disconnect. Yes, after some time, the compliance team should receive the data to ascertain the effectuality of what was offered. But remember, if there are significant failures that have continued, then it’s too late, and the compliance team will be made to reevaluate what was done that led to the poor performance and impotent risk mitigation efforts, and at least for some period of time, your firm would have continued to potentially operate outside of your risk tolerances. My counsel on this matter is to always say, “why potentially fail twice when we can ensure success the first time and follow the process from the root to the fruit.” That success relies on having compliance professionals who are willing to roll their sleeves up and come out of the locked compliance office. Being successful in this role requires a leader to have a team willing to go to the ensuing classes and review measures firsthand downstream in order to evaluate and monitor processes through their state of success.

All of this is to say that an outstanding compliance leader ensures that their teammates get involved in a more detailed level at times to ensure the quality of what’s being administered. If done with vigor, not only will the culture of the organization be better promoted and shaped, but the need to follow all of the processes so closely (all the time) will be diminished because expectations will be clearer, and a more deliberate mold of excellence would have been established. Thus, a great culture of compliance throughout your enterprise. From leading mission work initiatives in Haiti to professional development in compliance to being a lifeguard and swimming instructor when I was 17, that equation for success remains the same for every role I have led in.