Tosin Umukoro (tosin.umukoro@stryker.com) is the Senior Compliance Officer for Stryker Europe.
Over the years, corporate compliance programs have developed helpful frameworks of dos and don’ts for people in worst-case scenarios. Although generally considered effective in addressing significant and known risks faced by organizations, these programs, typically heavily rules-based, have been criticized for creating a series of box-checking routines, or so-called “paper programs,” primarily aimed at assuring legislators of the adequacy of self-policing and internal policies and procedures.
To create a culture of integrity, given the complex requirements governing business today, organizations need to continually evolve to address new and emerging risks and embrace both reactive and proactive approaches to compliance. In recent years, principles-based compliance programs have grown in prominence due to their potential to empower people to make the right ethical decisions, particularly in difficult or unique situations. This article presents some considerations for compliance professionals seeking to implement this approach to improve the effectiveness of their compliance programs.
The emergence of principles-based regulatory systems
Principles were introduced in the United Kingdom financial services regulation in 1990.[1] Essentially, this was a move away from dependence on prescriptive, detailed rules toward relying more on overarching, broadly stated principles that form the obligations of organizations to which they apply.[2] In the UK financial services regulatory regime, principles have several characteristics:
-
They are generalized, with the intention that they should be overarching requirements that can be applied flexibly to a rapidly changing business environment.
-
They contain terms that are qualitative, not quantitative: relatively general terms (“fair,” “reasonable,” “suitable”) as opposed to bright-line rules (“within two business days”).
-
They express the reason behind the rule.
-
They have very broad application in various scenarios.
-
They are largely behavioral standards.[3]
One of the compelling arguments for this strategy is that there is shift of emphasis from the process carried out by organizations toward the outcomes they seek to achieve.[4] A policy briefing from the Institute of Chartered Accountants states that rules-based systems can create a box-ticking mindset and compliance cultures, where the focus is upon meeting the letter rather than spirit of the regulation, or an attitude of anything goes so long as it is not prohibited.[5]
The limitations of a rules-based approach
In his white paper, Principles-Based Regulation and Compliance: A Framework for Sustainable Integrity, Harlan Loeb, a recognized expert in crisis and reputational risk management, highlights a Deloitte survey of global executives who list reputation risk such as ethics/integrity and cybersecurity among the most important risks their companies face.[6] Loeb advises that the increasing complexity of the global risk environment and the importance of corporate reputation as a strategic asset requires organizations to adopt pioneer thinking and innovation beyond product lines and services.[7]
Loeb asserted that as the focus of many global organizations is the efficiency of their systems and operations, the mindset and agility required to understand and address reputational risk and its underlying drivers was often not prioritized. In addition, Loeb warned that corporate dependence on rules-based compliance systems to manage risk compounded this challenge.
In contrast to a principles-based approach, rules-based compliance systems are solely motivated by legal and regulatory constraints rather than (and some would say, frequently at the expense of) moral and ethical imperatives. Although rules describe how to behave and require less interpretation, Black et al. argue that they are not a perfect regulatory instrument and have several limitations, including:[8]
-
Rules are just a “best guess” as to what is ahead, and therefore, new situations may occur that were not predicted when the rule was developed. Moreover, the rule may be construed and applied in ways that were not intended by the author.
-
Rules are underinclusive by either failing to catch things that the rulemaker might want to incorporate or overinclusive by incorporating things not intended when applied in specific contexts.
-
The impact of the rule on behavior does not depend solely on how prescriptive the rule is. The organization’s own approach to regulation and the incentive structures for compliance are also critical.
