EthicsPoint Marketing - from Bill Piwonka

Insight from the SEC

2011-05-01T11:44:00.000-07:00

Image via WikipediaIn preparing for a presentation I have coming up, I ran across a speech SEC Chairman Mary Shapiro gave on March 23, 2011 to the Securities Industry and Financial Markets Association's (SIFMA) Compliance and Legal Society Annual Seminar. While her remarks were certainly aimed at the financial industry, I found them to be relevant to all compliance professionals. Here are just a few snippets for your consideration:

Our examiners will be looking to see if registrants have embraced “a culture of compliance [my emphasis],” including enterprise risk management, within their firms.
A comprehensive approach to enterprise risk management is important for several reasons. For example, inattention to risk management can lead to seemingly minor corner-cutting on compliance issues which eventually snowballs into a serious problem for management and investors.
And, without a commitment to good governance and risk management, silos can form and the interdependence between risk categories can be overlooked.

Further, she elaborated that going forward, their examiners intend to focus on understanding how risk management is embedded in key business processes and decision-making at a number of levels. They will be asking questions such as:

How are the business units of an entity ensuring they are taking and managing risk effectively?
Are key risk management, control and compliance functions structured and funded to be effectively embedded in the business process?
How are senior managers ensuring effective oversight of enterprise risk management?
And how is the internal audit process independently verifying and providing the board and senior management with assurance about the operating effectiveness of the risk management, compliance and control functions?

These comments resonated with me, because this is also what I am hearing from our most forward-thinking clients and from industry analysts. The compliance function is growing up - and it needs to be funded appropriately in order to be effective. Tom Fox, a recognized expert in the FCPA, retells a great anecdote he heard from a former prosecutor: When told by a company identified as violating a compliance regulation that they properly fund the compliance effort, the prosecutor would simply ask, "how much did you spend last year on paper clips/Post-It notes?" If greater than the funding for the compliance department/function, the company would inevitably find itself in more trouble.

But more than just funding, compliance activities must be integrated into the ongoing operational processes of the business in order to be effective. The "whack a mole" approach to dealing with the most pressing compliance issue at hand simply won't suffice as we continue to operate in an environment where governmental agencies are committed to issuing new legislation and aggressively enforcing those and existing laws.

The question going forward won't be, "do you have a compliance program?" It will be, "how can you demonstrate your compliance program is effective?" So what are you doing in this area?

Adaptive GRC

2011-04-15T09:04:00.000-07:00

I spent the first part of this week at the Health Care Compliance Association's Annual Compliance Institute, where I had the pleasure of listening to Daniel Levinson, the Inspector General of the Office of Inspector General give a keynote. (Also heard James B Stewart give an overview of his new book, Tangled Webs, which I think every compliance officer will want to read, but I digress...).

In Mr. Levinson's speech he reviewed what makes a strong compliance program, and I was once again reminded of how similar all the best practice frameworks are in their guidance.
Earlier this year I spent some time reviewing guidance in the US Federal Sentencing Guidelines, those from the OECD on effective compliance, FCPA program advice, and recently the Adequate Procedures from the Ministry of Justice on Anti-corruption programs. All of these shared commonalities, echoed by Mr. Levinson, on what needs to be present in an effective and evolving compliance program:

Tone from the Top - Senior Leadership must be committed to fostering an environment of integrity and compliance, and ensure this culture permeates throughout all employee ranks
Risk Assessment - An organization must periodically review and assess the perceived risks facing it, which subsequently leads to...
Policies, Procedures, Controls and Guidelines - Once risks are identified, appropriate policies and controls must be created and distributed to those likely to be affected. And these stakeholders must be trained, and often attest to their understanding of the policy and their commitment to abide by the expectations set within.
Reporting Mechanism - We are all human, so despite best intentions, it is recognized violations of existing policies will occur. When this happens, an organization must have the ability to effectively collect reports of possible violations where ever they come forward. A hotline is not enough - organizations should challenge themselves to ensure they are capturing reports that surface in face to face meetings with managers, HR business partners, and other local supervisors, exit interviews, through alerts or exceptions that are flagged through technology, etc.
Monitor and Assessment - A compliance program is not static; it needs to adapt as the business changes. New regulations can be mandated by the government, the business environment may be altered through mergers & acquisitions, economic prosperity or downturns, expansion into new markets, etc. Risks that weren't anticipated during the periodic assessments may become visible. An effective compliance program must be able to collect risk-related data, manage it consistently and appropriately, learn from it, and ultimately adapt to these learnings in order to support the overall business objectives.

It is with this understanding as a foundation that is driving us here at EthicsPoint. We understand that every organization is on a GRC continuum - the level of sophistication and complexity of the compliance program will be dictated by the unique combination of different factors - industry, and associated level of governmental regulations, organizational structure (domestic vs multi-national, single site vs multi-site, blue collar vs white collar, etc.) and corporate culture/commitment to compliance. Furthermore, the compliance obligations of today will not be the same twelve months from now.

This is why we have put so much effort into delivering the EthicsPoint Adaptive GRC Framework. We know that our solutions need to be able to fit into your organization today, regardless of where you are on the continuum, and adapt to your own internal processes and needs. Furthermore, we have to be able to support you as your compliance requirements change over time.

Later tonight, we will be launching the latest evolution of our solution offerings, including:

Enhanced Issue and Event Manager capabilities
NEW Benchmarking module, enabling deep analysis of your GRC program and comparisons with other "like" organizations - by industry, company size and even against our entire population of clients
NEW Policy Manager product to help you effectively manage the lifecycle of your policies
Enhanced Visualization Manager capabilities that will assist you in identifying risk hotspots, patterns and trends
New Service Offerings, including Global Whistleblowing Compliance, Third-party Risk Assessments and Third-party Privacy Assessments

This launch - while the largest and most ambitious in our company history - is only the beginning! And I couldn't be more excited about where we all are going as we adapt to ever-changing compliance needs!

Congratulations are in order!

2010-11-12T15:04:00.000-08:00

Image by Camera Slayer via FlickrLast night Corporate Secretary magazine presented the third annual Corporate Governance Awards, and the winner's list was chock full of EthicsPoint customers, many of whom I've had the distinct pleasure of meeting. I've said it before, but it bears repeating - the single most rewarding part of my job is interacting with our customers who work tirelessly fostering an environment of compliance and integrity throughout their organizations. Whenever I tire of the negativity endemic in our politics and media, I find solace in knowing the reality is much more positive than what is reported, often based on the character and hard work of clients and individuals like those listed below.

Please join me in congratulating the following winners of the Corporate Governance Awards:

Most Innovative CSR disclosure - Timberland
Best Legal team in an M&A transaction - Kraft Foods
Best proxy statement - UnitedHealth
Corporate governance team of the year (large-cap) - Best Buy
Governance professional of the year (large-cap) - Carol Ward, Kraft

The Cost of Fraud

2010-10-21T11:07:00.000-07:00

I downloaded the 2010 Kroll Global Fraud Report the other day - it's 47 pages of insightful data, analysis and recommendations with section overviews for both geographic and industry segments - I highly recommend downloading a copy. (Also would encourage readers to sign up for our upcoming webinar in which Melvin Glapion, Managing Director, UK Head of Business Intelligence, Kroll and Jeff Cramer, Managing Director and head of Kroll's Chicago office will discuss findings in this report)

To whet your appetite, here are some statistics that caught my eye just in my initial reading:

88% of respondents report they had been hit by at least one type of fraud in the past year - this is across small, medium and large enterprises. How are you collecting reports of suspected misconduct? I ask because I've heard many companies say "they don't have problems in their company - we don't have a need for an easy way to collect, investigate and resolve misconduct reports." Really???? You're one of the 12% of people that haven't been hit by fraud in the past year? Really? If so, Congratulations!
Cost of fraud has risen 20% in the past year - across all size companies. This is NOT just a large enterprise problem
Fraud/Corruption is not a victimless crime - it is hampering the economic development of all countries:
48% of respondents indicate that fraud has deterred them from engaging in business in at least one foreign country. (this is not just a developing country problem - 7% have not operated in North America due to the perception of fraud!)
Corruption was named by 63% of respondents as the main reason for not doing business in Africa and 59% for avoiding Central Asia.
Most companies are not prepared to comply with anti-corruption laws such as the US' Foreign Corrupt Practices Act (FCPA) or UK Bribery Act
Only 36% of companies that fall under one or more of these laws believe these mandates applied to their business!

These statistics (and others in the report) are staggering and sobering in many ways. But at the same time, I'm re-energized and optimistic when I think of all the progress our customers are making to improve their overall ethics and compliance programs. Yet I only have the opportunity to speak with a small percentage of clients and prospective customers, so I ask you: How would you have answered the questions in the survey, and what are you doing to improve?

Deterring and Detecting Financial Reporting Fraud

2010-10-10T13:00:00.001-07:00

The Center for Audit Quality just released a new report - Deterring and Detecting Financial Reporting Fraud - A Platform for Action, which I downloaded. The report focuses on financial reporting fraud at publicly-traded companies of all sizes, and its recommendations are intended to be scalable to different situations. I found it to be a pretty comprehensive report, with guidance that would be applicable for any organization (large, small, public, private, etc.) looking to improve internal operations and mitigate the risk of financial reporting fraud.

As it is a 55 page document, I won't try to summarize all the salient parts here, but I did think their top three characteristics in organizations where this risk in minimized are worth repeating:

A strong, highly ethical tone at the top that permeates the corporate culture
Skepticism - a questioning mindset that strengthens professional objectivity, on the part of all participants in the financial reporting supply chain
Strong communication among supply chain participants

Given the corporate scandals that have emerged over the past few years, have you assessed your compliance and audit strategies with an eye toward mitigating this risk?

Commitment to Ethics

2010-09-23T08:04:00.000-07:00

This morning, EthicsPoint announced the winners of our 2010 Best Ethics Portal Contest, and I'm pleased to congratulate the winners again here:

Best Buy
Bon Secours Health System
Boys & Girls Club of Garden Grove
California Independent System Operator
Chesapeake Energy Corporation
Kraft Foods, Inc
Precision Drilling Corporation
TELUS Corporation

What's especially gratifying in recognizing these organizations is that their ethics portals really are just a small part of their overall commitment to fostering a culture of integrity and compliance. Amid all the negativity we read/hear about relating to companies that fall short in this area, I believe it's extremely valuable to celebrate those who strive on a daily basis to do the right thing. Please join me in congratulating this year's winners!

Visualize your success

2010-09-13T08:43:00.000-07:00

"Never in history has the human brain been asked to track so many data points."

-Dr Edward Hallowell, Psychiatrist, Author of CrazyBusy

On September 10th EthicsPoint announced the release of the first new software application added to the Framework we announced last May - epVisualization Manager. After having previewed it during our Regional User Forums over the past few months, I can sincerely state that you will be blown away by what it can do once you see it and start working with it - the possibilities are bounded only by your imagination!

Simply put, epVM allows you to map multiple layers of data to create a location-based dashboard. That data can come from EthicsPoint products (such as the location of your remote offices and all the associated reports of misconduct), RSS and other public feeds (such as weather data), premium data feeds (eg subscription data highlighting corruption trends in third world countries) and proprietary feeds (eg point of sale data from your internal financial applications). By layering data on a map, you can then begin to visualize patterns and trends that simply wouldn't be possible if you were trying to accomplish the same thing through spreadsheets or other methods.

We're demonstrating Visualization Manager this week at the annual SCCE Compliance Institute in Chicago, and next week at the ACUA and ECOA annual conferences. If you aren't planning to attend one of these shows and would like to learn more, contact us and we'd be thrilled to give you a tour!

Unintended Consequences

2010-09-08T09:30:00.000-07:00

Image via WikipediaOur CEO, David Childers, put together a powerpoint slide earlier this year I really liked. The title was "Three Things I Think I Know" relating to the compliance field - the three main bullets and brief commentary follow:

Ever Increasing Legislation (hard to argue this one)
Conflicting Global Mandates (I'll explain more fully below)
Agencies Transitioning to Enforcement (witness the increased prosecutions for FCPA violations for example)

David's point on conflicting global mandates was simple - as governments worldwide enact legislation to decrease the incidents and impacts of unethical behavior, there is a greater chance the various laws will be inconsistent across boundaries. For instance, Sarbanes-Oxley requires publicly held US companies or those listed on US exchanges to offer a way for employees to anonymously report financial misconduct, yet Portugal and Spain have outlawed anonymity. The FCPA allows for facilitation payments in certain circumstances, but the UK Bribery Act forbids them entirely. And so on.

This issue plays out domestically as well, with the latest example the conflict between the updated Federal Sentencing Guidelines and the whistleblower bounties offered through the Frank-Dodd Act. Under the Sentencing Guidelines, companies get credit for having an effective ethics and compliance program. Furthermore, if a serious transgression is discovered, companies get credit for identifying it prior to when it might have been discovered by other means and by self-reporting. Thus, it is in a company's best interest to provide multiple ways for employees, partners and other stakeholders to come forward with reports of suspected misconduct.

Yet the Frank-Dodd Act authorizes whistleblower bounties of between 10%-30% in cases where more than $1 million is recovered, thus creating a financial incentive for employees to both wait until a fraud scheme reaches epic proprotions and not report internally, thus depriving the company of mitigating potential losses due to fraud and the opportunity to self report once discovered.

I've had a number of conversations with clients on this topic, and it is showing up more and more in webinars and online through legal advisories (like this one from K&L Gates), discussions and whitepapers and we at EthicsPoint are endeavoring to further the debate. We will be hosting a webinar entitled Whistleblowing and the New Race To Report: The Impact of the Dodd-Frank Act and Proposed Changes to the Federal Sentencing Guidelines on September 29 with Toby Bishop and Mohammed Ahmed from Deloitte Financial Advisory Services and David Childers will be speaking on the topic on an upcoming webinar hosted by Securities Docket.

Regardless of where all these things eventually shake out, I do believe that companies will be held to a higher standard with regards to their ethics and compliance programs. And from the conversations I've had over the past six months with many of our customers, I know that many forward-thinking organizations have internalized this, as ethics and compliance programs have evolved from a "check the box" mentality to one where the pursuit of a sustainable ethical culture is a top and ongoing priority.

What are your thoughts?

Odds and Ends

2010-08-31T12:48:00.000-07:00

Been a while since I’ve posted, but not for lack of desire or content. Rather, we’ve been extremely busy here at EthicsPoint over the past few months, and I’ve just been remiss in my blogging duties. But no more- today starts a renewed commitment to keeping this space current.

To get started, thought I’d share a bunch of links/news and other material you may find interesting…

For the third straight year, EthicsPoint is hosting our annual Best Ethics Portal Contest – I encourage any of our current customers who have launched a new or revamped Ethics Portal in the past twelve months to nominate their site.

I spent a good part of my late Spring and Summer traveling around the US to EthicsPoint Regional User Forums – one of the best parts of my job. I love meeting with companies that are putting real effort into building a culture of integrity and compliance and seeing the progress of their activities year over year is incredibly rewarding. One of the interesting topics this year was the anticipated impact of the whistleblower “bounties” referenced in the Frank Dodd Act and what this meant to corporate compliance and ethics officers.

EthicsPoint will be hosting a webinar Whistleblowing and the New Race to Report: The Impact of the Dodd-Frank Act and Proposed Changes to the U.S. Federal Sentencing Guidelines with Toby Bishop and Mohammed Ahmed from Deloitte on September 29 for those of you interested in learning more about this topic.

And on the subject of webinars, I’d be remiss if I didn’t direct you to our archives, as we’ve hosted some really valuable sessions over the past few months on topics such as:

...among many others. And we're close to scheduling a number of great sessions for September and October, so watch for your invite or visit our webinar page in the coming weeks:

In the coming weeks, I hope we’ll get a chance to see you at one of the upcoming conferences where EthicsPoint will be speaking and/or exhibiting, including

The Society of Corporate Compliance and Ethics Compliance Institute,
The Association of College and University Auditors annual conference,
The 18th Annual Ethics and Compliance Officers Association conference,
The Open Compliance and Ethics Group GRC360° Executive Forum to be held in the Netherlands in October and
Ethical Corp’s 4th annual Anti-Corruption Summit Europe later in November

Finally, to keep abreast on a daily basis of new research, interesting articles, and EthicsPoint announcements, follow us on Twitter at http://twitter.com/ethicspoint.

A Proud Time

2010-06-08T16:02:00.000-07:00

As we all go through our careers, we have opportunities to observe and experience many different leadership styles. Sometimes, the style may be orthogonal to your values or preference. In other cases, you may appreciate the success achieved, but not the methods. But sometimes you find yourself in a situation in which all things seem to come together - you’re just proud to work for someone because of the vision they display, the integrity they embody, the gusto with which they lead and so on. Today, I describe myself as fortunate and proud to work for David Childers, EthicsPoint president and CEO, and thrilled to announce that he’s been named a finalist for the Ernst & Young Entrepreneur of the Year 2010 Award in the Pacific Northwest region. This designation publicly recognizes David for the talent and work ethic we here already know. Recognizing him for the extraordinary success in the areas of innovation, financial performance and personal commitment to his business and community, the acknowledgment couldn’t be given to anyone more deserving in those aspects.

Early on, David recognized the potential of EthicsPoint long before the current boom in ERM and GRC – before governance, risk and compliance (GRC) even had an “industry.” Coming off a successful stint as Oregon Scientific’s CEO, he was looking for a new opportunity to sink his teeth into and found the product EthicsPoint was built around – an anonymous telephony and web-based reporting system for ethics and compliance violations – to be one with potential to change the business world. A couple years after investing his time, energy and resources in the company, Sarbanes-Oxley was passed and what had previously been a "nice-to-have" hotline for employees to report misconduct became a mandate for publicly traded companies, making EthicsPoint a success – quickly. Having someone at the helm with David’s experience in business management and high-growth industries was one of the keys to EthicsPoint success through that period and on into our current state of maturity. The gradual transformation of our company under his leadership into an overall organizational risk management provider was a natural progression from EthicsPoint’s roots and his foresight has benefited this company from the ground up – from product strategy to acquisitions to the legal and cultural implications of that growth – and we look forward to where we’ll be going next with him at the helm!

Congrats again to David and we look forward to the announcement of the PNW regional winner on June 18, 2010 at the Pacific Northwest Region Award Gala at the Sheraton Hotel in Seattle! More information about the Ernst & Young Entrepreneur of the Year Awards can be found here:

Survival of the most informed

2010-03-25T14:22:00.000-07:00

Image via Wikipedia

Read a fascinating study from KPMG today - The Convergence Challenge, which is a global survey into the integration of governance, risk and compliance, originally published in February 2010. I literally wore out my highlighter as I tried to capture all the data, quotes and other material that jumped off the page to me.

For example, in the opening foreward they write, "...Fearful of both business failure and the penalties of non-compliance, many organizations have reacted by swelling their GRC departments. This has lead to a costly and complex web of often uncoordinated structures, policies, committees and reports, creating duplication of effort. Worse still, GRC has lost sight of its prime objective: to improve performance and efficiency. In short: the solution has become part of the problem! (my emphasis)

In recent years, internal auditors, risk officers, compliance offivers and information technology chiefs have begun to work together more closely, finding commonality between disparate GRC projects. Some organizations even formed GRC committees..."

I have seen first-hand at numerous client sites this scenario playing out. Departmental/Organizational silos are being struck down by foreward thinking leaders, because they know the value that is derived when GRC is done right. When we are able to share EthicsPoint's vision for GRC with organizations that have reached this stage of maturity, magical moments happen. The energy in the meeting ratchets up, and we get into really fruitful conversations on how value is created through these programs. As Oliver Engels, the European Head of GRC for KPMG in England states, "GRC convergence is an idea whose time has come. It is not simply a technology tool; it is a way to rationalize risk management and controls, giving management the information they need to improve business performance and achieve compliance."

Some other interesting statistics from the survey:

64% of respondents say GRC convergence is a priority for their organization
78% agreed strongly or slightly with the statement,"We see compliance encompassing internal policies, not just external rules and legislation."
59% believe the ability to identify and manage risks more quickly is among the main benefits of convergence
33% list improved corporate performance among the main benefits

What strikes me is that while accurately determining ROI on GRC activities is extremely difficult (how do you put a price on what doesn't occur?), so many leading companies inherently understand that GRC requires doing more than the minimum required, and by taking a proactive, enterprise approach, benefits accrue to their organization. Yet these companies are in the minority - silos still exist in most companies, and many see GRC as an expenditure as opposed to a benefit (just 34% see resources expended for GRC as an investment rather than a cost). When considered in conjunction with Ethisphere's data that Ethical companies outperform their peers and the general market, I do wonder why the momentum and pace of convergence isn't even faster?

World's Most Ethical Companies

2010-03-23T15:32:00.000-07:00

Ethisphere announced the winners of their 2010 Most Ethical Companies Award earlier this week, and despite criticism in some quarters, I look forward to announcements such as this. The criticism in Slate highlights that Ethisphere's sister organization, Corpedia, consults on ethics and compliance, so there is the potential for conflicts of interest. I won't argue this point, and will leave it to others to determine for themselves whether to regard such rankings as gospel or with a grain of salt.

But I do believe there is value in rankings if for no other reason than to highlight the great work companies are doing in this space. For the past 1.5 years I've had the good fortune to speak with a broad spectrum of ethics and compliance leaders - across large, medium and small size organizations, across all industries, non-profits and educational institutions, and I do believe that most companies are ethical and working to constantly evolve and improve their compliance programs. Celebrating the efforts of the few recognized still brings positive reinforcement to the profession and helps to underscore the importance of a strong program.

Further, Ethisphere has tracked the stock performance of the companies named to their list, and as you can see below, the companies they recognize as ethical outperform their peers and the market in good times and bad. More justification for the resources companies are devoting to fostering a culture of integrity and compliance!

Please join me in congratulating all the EthicsPoint customers who have been recognized for their high commitment to ethical decision making:

AstraZeneca
Avaya
Best Buy
Cummins
Flint Hill Resources
General Mills
Henkel
IKEA
Johnson Controls
Noblis
Parsons
Premier
Rezidor Hotel Group
Ricoh
Salesforce.com
The Hartford
Wisconsin Energy Corporation
Wisconsin Physicians Service

March Madness Dilemmas

2010-03-16T16:46:00.000-07:00

Image by ruralocity via Flickr

Once again, my beloved Stanford Cardinal men's basketball team declined to participate in the NCAA Basketball Championship tournament (I am, however, predicting the Mighty Cardinal women will avenge their only loss of the season by beating the University of Connecticut for the title!). But my son still wants me to fill out a bracket, and thus have to make some tough decisions...

Can Vermont be the first 16 seed to upset a number one seed when they play Syracuse? Will 10th seeded Georgia Tech upset #7 Oklahoma State? Can West Virginia prove the selection committee was wrong by not seeding them #1 and run through their side of the bracket to the Final Four? What makes these questions so difficult for me is each of them is an EthicsPoint customer, so I'd like to see each of them do well.

If you're like me and your bracket falls apart after the first weekend leaving you to find some team to cheer on through the next few weeks, perhaps you'll find a favorite in the schools above, or one of the other EthicsPoint customers in the tournament:

Baylor
Butler
BYU
University of California
University of California Santa Barbara
Cornell
Georgetown
Marquette
Minnesota
Northern Iowa
Ohio
Ohio State
Robert Morris
Sam Houston
Texas A&M
Utah State

Congratulations and Good Luck (even to the Cal Bears) to all our customers in this year's Championship Tournament!

Standing Ovation

2010-01-27T07:43:00.000-08:00

Image by yuichi.sakuraba via Flickr

I just read Scott McNealy's farewell letter to Sun employees and was struck by a couple of paragraphs I'd like to share:

"What we did right and wrong at Sun over the years might make for interesting reading. However, I am not a book writer. I am a husband, father of four, and a builder and leader of people who want to make a difference.

But spare me a bit of nostalgia. Not of the mistakes we made, and lord knows I made a ton. But of the things we did right and well.

First and foremost, Sun innovated like crazy. We took it to the limit (see Eagles). And though we did not monetize our inventions as well as we could have, few companies have the track record in R&D that we had over the last 28 years. This made working at Sun really cool. Thanks to all of you inventors and risk takers who changed how we live.

Sun cared about its customers. Even more than we cared about our own company at times. We looked at our customer's mission as more important than ours. Maybe we should have asked for more revenue in return, but our employees were always ready to help first. I love this about Sun, which I guess makes me a good capitalist, if not a great capitalist.

Sun did not cheat, lie, or break the rule of law or decency. While we enjoyed breaking the rules of conventional wisdom and archaic business practice, and for sure loved to win in the market, we did so with a solid reputation for integrity. Nearly three decades of competing without a notable incident of our folds going off course morally or legally. Not all executives and big companies are bad. Really. There are good companies out there. Special thanks to all of my employees for this. I never had to hide the newspaper in shame from my children."

While tempted to comment on all I find admirable in these paragraphs, I think it's better to let them stand on their own. I tip my hat to Mr. McNealy and all the employees at Sun.

2009 Most Influential in Business Ethics List

2009-12-23T08:17:00.000-08:00

Last week I had the opportunity to spend a day with one of our newer clients, learning about their Compliance and Ethics program, goals for next year and overall philosophy on fostering a culture based on ethical decision making and caring for their customers. One of our topics for discussion was quantifying the return on their ethics and compliance programs, which is often a difficult number to ascertain. While it's somewhat straight forward to calculate time savings in various stages of the various business processes that are part of your GRC programs, it becomes more difficult to calculate the full impact. For instance, how do put a number on not being fined for FCPA violations, or not having a class-action lawsuit filed against you for bad labor practices, or increased sales from consumers who trust your business more than your competitors? It was a lively discussion, and one that I hope to have more often in 2010 as I visit more of our customers.

I was reminded of the conversation when I saw Ethisphere's 2009’s 100 Most Influential People in Business Ethics list last week. The list is comprised of people in eight different categories spanning government, non-profits, education and corporations. When you look at the names of the companies represented by these individuals and consider their market success, you can begin to get a good idea that while it may be difficult to exactly quantify the ROI of a culture of integrity, there clearly is a strong correlation between culture and business success.

I was especially pleased to see a number of EthicsPoint's customers represented on the list, and would like to congratulate the following people for their outstanding efforts and accomplishments in the field of business ethics over the past year:

Peter Solmssen – General Counsel, Siemens
Sharon Allen – Chairman, Deloitte
Bill Gates – Founder, Bill and Melinda Gates Foundation
Kathleen Edmond – Chief Ethics Officer, Best Buy
Brian Martin– SVP and General Counsel, KLA-Tencor
Pascal Bourdin – SVP, and GM of European Chocolate Business, Kraft

Congratulations to all the winners!

Lies, Damn Lies and Statistics

2009-12-01T08:38:00.000-08:00

Seems to be the season for publishing the results of surveys and other research - I just got finished reviewing PricewaterhouseCooper's excellent report,

Image by TW Collins via Flickr

The Global Economic Crime Survey which contains some great data for those of us concerned about fraud and other financial misconduct to consider.

One of the things that stuck out to me - especially considering the results from the ERC's 2009 National Business Ethics Survey - was that PwC did not see any statistical difference in the level of economic crime for companies that had suffered during the economic downturn from those that did not suffer. Hence, they conclude that economic crime remains a pervasive business risk, which does not discriminate among its victims based on the relative degree of their financial performance. They do note, however, that organizations sufferng from the downturn did report higher levels of accounting fraud.

Among the other data I found interesting:

Tips were the detection method in 34% of the cases - with the hotline system accounting for only 7% - reinforcing the need to both foster an environment in which your employees and others feel comfortable bringing issues forward in conversations as well as the need for a consistent approach to capturing and investigating these issues
While internal audit is consistently detecting less of the reported frauds over time, the combination of anti-fraud controls and a strong ethical culture appears to be improving the detection of economic crime
There is a correlation between reported frauds and the frequency of fraud risk assessments - In other words, if you look for it, you will find it.

Finally, and what should concern you if you hold a leadership position within your organization, respondents have consistently underestimated their exposure to fraud. Regardless of the research you're reviewing, the data is pretty compelling - fraud and other misconduct occurs in good economic times and bad. Having a strong ethical culture and good controls reduces the amount of fraud, and its associated losses. So what are you doing to reduce your risk?

Ethics Bubble?

2009-11-20T15:43:00.001-08:00

Image by ecstaticist via Flickr

Just spent some time reviewing the Ethics Resource Center's 2009 National Business Ethics Survey . There's some very interesting data in the report - some of which seems contradictory, which means I'm going to be spending more time this weekend digging into the details.

On the positive side, the survey revealed that:

Misconduct at work is down
Reporting of observed misconduct is up
Ethical cultures are stronger, and
Pressure to cut corners is lower.

But before we start congratulating ourselves too much, however, there were some cautionary data as well. For instance, 30% of people who observed behavior that constituted a "red flag" (activities that may be indicative of material fraud or questionable actions taking place) said they did NOT report it. You can't take appropriate action to mitigate potential misconduct if you aren't aware of it!

Furthermore, there is an interesting analysis of results from past Business Surveys that may suggest we are in an "ethical bubble."

If you look at the chart, you'll see that in the last economic downturn, reported misconduct also decreased, but as the economy improved, misconduct rose with it. While the sample may be a bit small, the parallels between the S&P Index and observed misconduct are fairly consistent. The ERC surmises this may be because in hard times management may talk (and inspect) more on the importance of high standards. Thus, misconduct goes down.

This really has me thinking...On one hand, I know that most of our clients are putting their money where their mouth is - allocating resources to ethics and compliance programs and making a true commitment to fostering an ethical culture. I don't see this changing as we exit the down turn. But the chart is revealing. Curious as to your thoughts - are we really in a bubble? Is this latest good news fleeting?

I'll leave you with the advice the ERC has for Ethics and Compliance Professionals:
Focus on culture and collect data! Now is the time to assess your culture and put in place processes - especially regarding the collection of potential violations of your stated code of conduct - for how you manage issues and events that expose your organization to risk.

Quick Links

2009-11-09T16:49:00.000-08:00

Image via Wikipedia

I've come across a number of really great research reports over the past few weeks, and wanted to share them with you. In each case I'm finding myself going back and finding a new nugget that directly relates to Governance, Risk and Compliance, and the challenges our customers and prospects face. I'd encourage all of you to download these reports if you have not already done so.

Kroll Global Fraud Report
This is the latest of the Kroll Fraud reports, where they survey hundreds of senior executives across the world to understand the impact of fraud and corruption, both in individual industry segments and in specific geographic regions. One of the things that stood out to me on first reading was that the overall incidence of reported fraud did not increase significantly during the past year, despite what was expected. But there are differences across the various industries and countries worth understanding.

If you'd like to get a quick overview of the contents in the report, you can attend a webinar we are hosting with Blake Coppotelli and David Holley of Kroll.

Transparency International's Global Corruption Report 2009
Learned about this one from the excellent FCPA Blog. This is a really comprehensive report (weighs in at 496 pages!) which definitely requires multiple visits. But to give you a taste of what's inside, consider:

90% of the top 200 businesses worldwide have adopted business codes, but fewer than half report they monitor compliance!
Companies with anti-corruption programs and ethical guidelines are found to suffer 50% fewer incidents of corruption. While that may seem obvious -especially based on other research - the question I would have is why, then, do not all companies have business codes, and why do relatively so few monitor compliance?

Fulbright's 6th Annual Litigation Trend Survey
Stumbled on the 5th annual survey last year, so was pleased to learn the latest version is out. Interestingly, as opposed to what Kroll reports, this survey of mostly General Counsels, Head of Litigation, and people with titles just below those (e.g. Senior Counsel, Associate General Counsel, etc.) reported that the incidence of companies reporting corruption/bribery investigations over the past 12 months has nearly doubled since last year! But bribery/corruption is not the only thing with which these respondents are challenged. According to the survey 40% have seen increases in wage & hour, multi-plaintiff and employement cases over the past year.

As I said, there is a lot of great information in these reports - hopefully you'll learn something as well!

The New Normal

2009-10-01T09:41:00.000-07:00

Image via Wikipedia

With Less, Do More

The other day I read Microsoft CEO Steve Ballmer’s latest executive e-mail, entitled The New Efficiency. A few of his thoughts resonated with me, and in my opinion, have broad applicability to the market segments and business functions we serve at EthicsPoint. I’d encourage you to read all his comments, but want to highlight a few here.

Ballmer’s email starts with,

In all the talk about the economy, one term that comes up more and more frequently is something called “the new normal.” I like this phrase because it speaks to the fact that economic reality has undergone a fundamental shift over the course of the past 12 months.

So what is the nature of this shift? After years of economic expansion fueled by unrealistic rates of consumption and unsustainable levels of private debt, the global economy has reset at a lower baseline level of activity. Today, people borrow less, save more, and spend with much greater caution.

This is the new normal and it will be with us for some time to come. The issue now is how to respond.

I think Mr. Ballmer is spot on with this line of thinking – despite some encouraging signs of economic recovery, I think it’s going to take longer and be more difficult than any of us want, and even after the recovery has been achieved, the marketplace in which we all compete will be completely different than it was prior to the meltdown.

Mr. Ballmer goes on to stress the importance of cutting costs, but points out that no company ever cut their way to greatness. Rather, to ultimately succeed, you need to do two things – increase productivity and provide value to your customers – the trick is how you achieve these two objectives simultaneously. He writes:

For years, we’ve talked about how information technology enables companies to do more with less. But during this economic reset, IT provides business leaders with the answer to a slightly different question: Can my company with less, do more?

Other trends give this question even greater urgency. Workforces are more distributed and employees are more mobile. Government regulations are increasing and compliance requirements are mounting. Data security is more important to preserve and more difficult to maintain.

At EthicsPoint, we’re seeing Mr. Ballmer’s comments play out in our customer base every single day. Compliance mandates are mounting, governmental enforcement is strengthening (witness the increase in FCPA prosecutions and Corporate Integrity Agreements), rates of employee misconduct – if not increasing – are at least holding steady, and compliance, audit, HR and other budgets are being cut. The only way to effectively manage in this environment is to find ways to build efficiencies into your processes – increase the level of collaboration, communication and insight across the enterprise, while eliminating waste, and the barriers that create and maintain organizational silos.

As I’m going through our own internal 2010 budgeting and strategy-setting sessions, I’m challenging myself and my team to think about Ballmer’s question: how can we – with less, do more?

What are you doing?

Detecting Fraud

2009-09-01T17:03:00.000-07:00

KPMG released their Fraud Survey 2009 the other day. Among some of their findings were:

Nearly a third of executives expect some form of fraud or misconduct to rise in their organizations
66% of respondents reported that inadequate internal controls or compliance programs at their organizations enable fraud and misconduct to go unchecked.
Roughly a quarter of respondents lack effective protocols on how investigations should be conducted and what point the board of directors should be alerted to potential concerns. (check out our website in the next few days to sign up for a webinar addressing internal investigations)

There was a lot of thought-provoking data in addition to the stats above. But the one thing that got me thinking was their finding that 47% of executives believed that Internal Audit, Legal or Compliance would be the most likely to uncover fraud in their organization - the number one source for detection. Yet they note in their report that this contrasts with the findings in both the ACFE Report to the Nation 2008 (tips were identified there as the number one source) and their own KPMG Integrity Survey 2008-2009 that cited Internal Audit as among the least likely channels to which employees would feel comfortable reporting misconduct.

From an EthicsPoint perspective, we've always said the venue is not important - whether fraud is detected by people reporting via a hotline, though face to face conversations with their manager, HR or other appropriate personnel, through controls or other methods - what's important is that your organization have a strong ethical culture, a way to collect reports of misconduct, and a system to consistently investigate, document, resolve and ultimately analyze each report.

But I'm curious as to your reactions - In your own organization or experience, what do you think is the most important channel for detecting fraud?

(Hardly) The Lazy Days of Summer

2009-08-04T08:39:00.000-07:00

Image by NatalieMaynor via Flickr

Summer is definitely in full swing here in the Northwest -we've had a couple of weeks of record heat, the farmers markets are full of beautiful produce, my boys are filling the days between their recently completed summer camps and the start of football and band camps with the final week of swim team practice before the championship meet, and 24 of my colleagues are in their final training days for the 28th annual Hood to Coast 197 mile relay race. With all this and more going on, one might be lead to believe we're firmly entrenched in the fabled Lazy Days of Summer.

Fortunately, that's not the case at all - our whole company has been rallying around the launch of the Summer 09 Release of the EthicsPoint Issue and Event Manager Professional and Enterprise solutions. This is the first big release I've enjoyed since joining our company last Fall, and I am incredibly proud of the effort of the whole team. Our engineers have put in many long hours and truly produced a fantastic solution for our customers. Our Client Services, Professional Services and Marketing teams have also worked diligently to ensure that we are fully prepared to support this new release in the market - we've got new training videos, new services offerings, enhanced documentation, updated content on our community forum and more. Combined with our announcement last week of our new web report forms, we really are delivering on our promise to clients to better help them gather information, manage that information and ultimately gain insight from that data with respect to the risks facing their organization.

I know this post is a bit of self-congratulatory - which I try not to do very often - but I believe it's important to celebrate and recognize great teamwork and effort. And I'd love to hear feedback from all of you who logged on to a brand new experience - are you as happy with the release as I am????

Hit the Road, Jack!

2009-07-22T07:07:00.000-07:00

Image by express000 via Flickr

It's been a while since I've posted an update here, but not for a lack of interest - I've just found myself to have been extremely busy the past few weeks.

One of the things (and there are many!) that have taken up my time has been traveling to meet with customers, partners, prospective clients and other individuals within the GRC ecosystem. As I was being told I could feel free to unbuckle my seatbelt and walk around the cabin on a flight earlier this week, I was reminded of a conversation I had with a colleague at a different company many years ago.

I had just had a blowout argument with my CEO (long story...) and was really questioning whether I wanted to stay with the firm. My colleague suggested I hit the road and meet with customers, as doing so always rejuvenated him. I took his advice, and came back exhilarated! As a marketing guy, I always find it inspiring to talk with my customers and prospects - even if they're unhappy. These conversations give me so much insight into the challenges my target audience faces, ideas for how we can improve, but also how what we offer makes life easier/better for our users. I really don't see how you can't come back fired up!

For those of you who agree with me, I'd like to point you to an article written in 1995, but one I find to still be relevant today. It was written by Edward F. McQuarrie, a professor at Santa Clara University (coincidentally, an EthicsPoint customer!). The article is titled, Taking a Road Trip; Customer Visits Help Companies Recharge Relationships and Pass Competitors. I highly recommend it!

Some notes on my recent (and upcoming) travels:

I had an opportunity to speak at the annual ACFE conference last week. I have to hand it to the organization - I thought the conference was one of the best run events I have attended in my career - they really do a good job! Harry Markopoulus spoke during lunch one day - most people found his speech to be one of the highlights of the show. Personally, while I enjoyed it, he left me wanting much, much more. There is a big story behind the Madoff affair that has yet to be told, and Harry is a central figure in it. He did mention a forthcoming book - I will definitely be putting my order in ahead of time on Amazon!

One of the things that keeps coming up in my conversations with organizations is that they want a way to capture all the important reports of conduct violations that are conveyed in face to face meetings between employees and managers. I'm happy to report we announced an easy way for our customers to do just this via EthicsPoint Issue and Event Manager Report Forms yesterday.

I've gotta wrap this up - need to head to my afternoon meetings with a couple of customers here in the Cincinnati area and then plan for our Portland and Bay Area User Forums next week. If you'd like to share your comments or thoughts with me, please just reach out!

Ethics on the Cheap????

2009-06-18T17:05:00.000-07:00

Image by shainelee via Flickr

I just ran across a recent thought-provoking article in the Christian Science Monitor, called "Are Ethics Too Expensive? about companies cutting back on ethics training due to budget pressures.

This got me thinking on a number of fronts:

How can we measure the long-term ramifications of these decisions? I spend a good part of my time at work thinking about how to prove the positive return on investment for ethics programs. So little hard data exists I find the same statistics being used over and over in the media (the cost of fraud, according to the ACFE, the increased shareholder value for the Ethisphere "Most Ethical Companies," etc.). But if there's a lack of hard data to prove the positive, there's even less to show the adverse affects of a poor ethical culture (unless you take what's written in the popular media every time a company on Wall Street fails). I'd love to know which companies are cutting back and track their performance over time - I'll bet they suffer.

Given that we're all under pressure to keep costs down, you can't just argue to keep spending flat to previous years, much less increase it. So - instead of cutting training altogether or severely cutting back on it, have these companies looked at new ways to deliver the training? I filled in for our CEO David Childers today on a "Use of Social Media in Compliance" webinar and talked about ways companies can use Web 2.0 technologies and sites such as Twitter, Facebook, Blogging, LinkedIn, etc. within their compliance programs. Based on the instant polls we conducted, not many organizations have embraced Web 2.0 yet. There are a lot of cool and inexpensive ways to deliver your training if you're willing to try new things.

I'm curious - what are you doing to make your ethics training more efficient and effective?

Back to School

2009-06-01T19:44:00.000-07:00

Image via Wikipedia

I'm currently sitting at my son's dance studio, waiting for him to finish his hip/hop rehearsal in preparation of the big recital in two weeks. Ironically, in one of the studios nearby, the class is working on a dance to Alice Cooper's 1972 hit, "School's Out," while I'm writing this blog announcing the new EthicsPoint Fund for the Discovery and Dissemination of Ethics Research with The University of Arizona's Department of Management and Organizations in the Eller College of Management. School is definitely NOT out for EthicsPoint!

The first of its kind for the University and EthicsPoint, the Fund will support research, education and collaborative programs designed to redefine the focus and impact of business ethics research. One of the things that attracted us to the work being done at The University of Arizona is they share our view that the teaching and research of business ethics needs to transition from the philosophical to the practical.

As a result of our partnership, we'll be working with the faculty of the Department of Management and Organizations in a number of ways, including:

Establishing a Business Ethics Symposium later this year in which industry ethics and compliance officers and faculty from M&O will jointly participate in panel discussions that tie best practices from industry with budding research from academia.
Publicizing the work of the M&O faculty in the area of business ethics through webinars, whitepapers and other communication vehicles.
Working with the faculty on their research projects into business ethics when appropriate.
Collaborating with the faculty within their classrooms, with EthicsPoint senior management participating as guest lecturers, providing students with the perspective of private industry to augment their studies.

This announcement is just the start in our relationship with The University of Arizona, one that I see having great promise and potential, and I can't wait to see where it goes!

Is That a Pledge Pin, Soldier?

2009-05-31T13:31:00.000-07:00

Image via Wikipedia

Forgive the reference to one of the favorite movies from my early teenage years, but it came to mind when I read a NY Times article about the Harvard MBA's who were taking a pledge to act responsibly, ethically, and refrain from advancing their "own narrow ambitions" at the expense of others.

Don't get me wrong, I'm all for people acting with integrity and ethics, but I find this news somewhat disturbing. First, only 20% of the graduating class has signed it so far. I refuse to believe the rest of the 80% don't believe in what the oath stands for. Instead, I'm very hopeful that those 80% feel a bit like me - why do I need to sign an oath to do what should be considered normal course of action?
As a father of two boys (12 and 14), I certainly hope they don't need to sign an oath to remember to do what's right - I know that the values my parents, coaches, teachers, Sunday School leaders and other adults instilled in me helped form the basis for my actions. Likewise, I would hope that the future leaders of business already had formed a moral compass that will guide them as they encounter ethical challenges in the workplace. If an oath helps them remember to do the right thing, great. But hopefully it's only a reminder to do what they would have done otherwise, and not the sole thing guiding them.

Perhaps I'm being a bit cynical - what do you think?