The chief accountant of the Securities and Exchange Commission recently gave remarks about inculcating a strong ethical culture at audit firms. And although he was talking to auditors, he was preaching to the compliance choir.
The chief accountant, Wes Bricker, started with some lines about the bonds between ethical culture and good governance:
Good governance is not an isolated concept. It is intertwined with tone and culture — the understanding of ethical values, risks, and desired behaviors… Poorly diagnosed or designed culture initiatives do not tend to be long-lasting in addressing underlying behavioral norms.
Any ethics and compliance officer can appreciate those points. Bricker is trying to tease out the connection between senior leaders who foster an environment that cares about ethics, and a workforce that then conducts itself in an ethical manner. The compliance function is the mechanism that holds those two groups together.
Bricker next described a corporate culture curve with four phases of maturity:
-
Indifferent: “Requirements do not matter or apply to us.”
-
Reactive: “We respond and address requirements when others tell us to.”
-
Guiding: “We need employees to follow the requirements we set for them.”
-
Pervasive: “All of our people are involved in our requirements and aware of their connection to our and others’ expectations.”
The culture moves from a first state of ignorance (“we don’t know or care about requirements”) to partial obedience (“we respond when we’re required to respond”) to a full appreciation of ethical culture (“everyone knows how we’re supposed to behave and why we’re supposed to behave that way”).
Explore: The Ultimate Culture Assessment Toolkit
Independent Perspective Really Does Matter
The first two phases of Bricker’s culture curve are based on insular thinking: “We don’t bother with ethics and compliance any more than necessary, because we believe it’s not important.”
That idea is wrong-headed, but people aren’t likely to shake it off without prompting. An outsider’s fresh opinion can be that prompt.
Bricker scaled that idea up one level: talking about audit firms’ governing boards giving the same treatment to tone and culture, rather than specific operational and compliance issues.
That’s one reason why an in-house compliance committee, across many departments of the enterprise, is so useful. It provides a practical way to exchange observations about compliance risks. It also lets executives encourage each other to keep focus on the larger picture of good conduct.
Bricker scaled that idea up one level: talking about audit firms’ governing boards giving the same treatment to tone and culture, rather than specific operational and compliance issues. The smartest firms are creating board seats or advisory councils for outsiders, he said. “They understand that the benefits of outside perspectives can translate to audit firm governance as well.”
That’s just as true for any other business. At the board level, or at the operational level, an embrace of outside perspective can push your organization past those lower phases of culture maturity.
Assessment, Measurement, and Connection Matter Too
The key to maturing your corporate culture is knowing where your culture currently sits on the curve. If leaders don’t understand the workforce’s appreciation for good conduct (or their lack thereof) at the beginning, then the ethics and compliance program you implement will be less likely to take the organization where you want it to go.
Foremost, start with a frank, accurate assessment of your corporate culture. Part of that assessment can be an employee survey — but also consider what else tells you something about culture, and especially about employee cynicism toward company statements on ethics.
For example, you could look at case closure times for employee complaints about retaliation. Or what level of management gets the most complaints; or sanctions given for incomplete ethics training (lack of sanctions sends a message too, after all); or even promotion and pay disparities by race or gender.
Those points of data are the tiles that form a mosaic of the corporate culture. Then that outside perspective mentioned above can give more precise, useful feedback about which points seem wrong, and how they might be corrected.
Pushing your company up the culture maturity curve Bricker describes requires a cycle of effort. Compliance officers need to work hard to collect useful data about where the culture really is. Then talk with peers across the enterprise and directors above you at the governance level, about messages, policies, and actions to change employee perceptions and behavior.
Then the data changes. Then you repeat. Over time, ideally, you’ll move up the maturity curve Bricker describes.
Download Benchmark Data: 2018 E&C Hotline & Incident Management Benchmark Report