MR - Society of Corporate Compliance and Ethics

Volume Five
Number Three
June 2008
Bimonthly
Earn CEU Credit
see page 33
Meet
Robert T. Morgan and
Carol A. Morgan
Two highly successful corporate
professionals share insights on their jobs
and their roles as husband and wife.
page 22
Also:
What are Boards to do
when Investors Call?
page 40
Global Compliance:
China
page 44
So, What’s Your
Compliance Strategy?
page 6

INSIDE
Advisory Board
Publisher:
Society of Corporate Compliance and Ethics,
+1 952 933 4977, or 888 277 4977
Editor-in-Chief:
Rory Jaffe, MD, MBA, CHC
rsjaffe@gmail.com
Executive Editor:
Roy Snell, CCEP, CHC, CEO, SCCE
roy.snell@corporatecompliance.org
Advisory Board:
Charles Elson, JD
Edgar S. Woolard, Jr. Chair in Corporate Governance, Director of the John
L. Weinberg Center for Corporate Governance at University of Delaware.
Jay Cohen
Global Compliance Leader, Dun & Bradstreet
John Dienhart, PhD
The Frank Shrontz Chair for Business Ethics, Seattle University;
Director, Northwest Ethics Network; Director, Albers Business Ethics
Initiative; Fellow, Ethics Resource Center
Odell Guyton, JD
Senior Corporate Attorney, Director of Compliance,
U.S. Legal–Finance & Operations, Microsoft Corporation
Rebecca Walker, JD
Partner, Kaplan & Walker LLP
Rick Kulevich, JD
Senior Director, Ethics and Compliance, CDW Corporation
Steve LeFar
General manager, Mediregs, Wolters Kluwer Law and Business
Stephen A. Morreale, DPA, CHC, CCEP
Principal, Compliance and Risk Dynamics
Marcia Narine, JD
Vice President Global Compliance and Business Standards,
Deputy General Counsel, Ryder System, Inc.
Ann L. Straw, CCEP, Vice President and Chief Compliance Officer,
Laidlaw International, Inc.
José A. Tabuena, JD, CFE, CHC
VP Integrity and Compliance/Corporate Secretary
MedicalEdge Healthcare Group, Inc.
Greg Triguba, JD, CCEP
ERM, Ethics and Compliance Officer, Intuit
Story Editor/Advertising:
Marlene Robinson, SCCE, +1 952 933 4977, or 888 277 4977
marlene.robinson@corporatecompliance.org
Copy Editor:
Patricia Mees, CCEP, CHC, SCCE,
+1 952 933 4977, or 888 277 4977
patricia.mees@corporatecompliance.org
Layout:
Gary DeVaan, SCCE, +1 952 933 4977, or 888 277 4977
gary.devaan@corporatecompliance.org
Compliance & Ethics (C&E) (ISSN 1523-8466) is published by the Society of Corporate
Compliance and Ethics (SCCE), 6500 Barrie Road, Suite 250, Minneapolis, MN 55435.
Subscription rate is $195 a year for non-members. Periodicals postage-paid at Minneapolis, MN
55436. Postmaster: Send address changes to Compliance & Ethics, 6500 Barrie Road, Suite 250,
Minneapolis, MN 55435. Copyright © 2008 the Society of Corporate Compliance and Ethics.
All rights reserved. Printed in the USA. Except where specifically encouraged, no part of this
publication may be reproduced, in any form or by any means without prior written consent of
the SCCE. For subscription information and advertising rates, call SCCE at +1 952 933 4977, or
888 277 4977. Send press releases to SCCE C&E Press Releases Department, 6500 Barrie Road,
Suite 250, Minneapolis, MN 55435. Opinions expressed are those of the writers and not of this
publication or SCCE. Mention of products and services does not constitute endorsement. Neither
SCCE nor C&E is engaged in rendering legal or other professional services. If such assistance is
needed, readers should consult professional counsel or other professional advisors for specific legal
or ethical questions.
4 Letter from the Leadership — By Rory
Jaffe
SCCE starts LinkedIn group
5 The Business of Ethics— By Deborah E.
Wallace
Surveys show that the way US corporations plan and
conduct business needs reframing to encourage ethical
standards.
6 CEU Article: So, What’s Your Compliance
Strategy? — By Henry Klehm III, David
Schweiger, and Andrew Schweiger
A look inside the strategic planning process used at
Deutsche Bank to foster cultural change and ensure a
successful implementation of their global compliance
initiative.
18 SCCE Advisory Board
19 Letter from the CEO — By Roy Snell
Why are we where we are?
22 Meet Robert T. Morgan and Carol A.
Morgan — an Interview by By Marlene
Robinson
Two highly successful corporate professionals share insights
on their jobs and their roles as husband and wife.
32 Federal Agency Compliance: Applying
corporate lessons in government
settings — By Emil Moschella
Federal agencies, such as the FBI, are adopting a
corporate compliance paradigm to identify potential
weaknesses in their internal controls and to detect
non-compliant behavior.
37 Upcoming Audio/Web Conferences from
SCCE
40 CEU Article: What are Boards to do when
Investors Call? — By Lou Thompson
Shareholders are becoming more like activists in
demanding that boards hear their concerns and act
upon them.
43 SCCE Compliance Academies
44 CEU Article: Global Compliance: China —
By Scott Lane and Robert Leffel
Five compliance and ethics issues to consider as you
navigate the obstacles of doing business in China.
47 Congratulations to New CCEPs
50 Statute Gone Wild?— By Guy Aulabaugh
Under a Deferred Prosecution Agreement, Mantra
Films is serious about compliance.
51 SCCE Corporate Members
52 New SCCE Members
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
3
June 2008

SCCE starts
LinkedIn group
By Rory Jaffe, MD, MBA, CHC
SCCE President
Editor’s note: Rory Jaffe is the new president of the
Society of Corporate Compliance & Ethics and Editorin-Chief
of Compliance & Ethics Magazine. He was the
Executive Director of Medical Services for the University of California, a position
that, as part of a major reorganization of the University, has been eliminated.
I joined LinkedIn, a social network for professionals, about two years ago,
when UC Davis business school announced to its alumni that there was
now an alumni group on the LinkedIn site. I filled out the profile form,
linked up to a few people I knew, then sat back and pretty much ignored
the whole thing. I just could not figure out any use for the site, other than
to collect connections—it felt like baseball card collecting.
Time passed, and then I found myself looking for a new job. I quickly learned
that looking for job listings is almost a hopeless task. It would take a full-time
effort just to scan the thousands of web sites and hundreds of thousands of job
listings. And then, I’d have no way of really knowing what the job was like,
and my prospective employer would have to guess about what Rory was like.
It was only then that I understood the virtues of networking. I had
only two good sources of job information—friends and headhunters.
And I usually found out about the good headhunters from friends.
Social networking suddenly made more sense. It is a wonderful way to
get reliable and useful information about jobs and about prospective
employees. And when you add
not only your friends, but also
friends of your friends to your
social network, the multiplier
effect greatly extends
your ability to obtain reliable
information. I have 52 direct connections
on LinkedIn so far. But when you add in
their connections—that is, friends of friends—the number soars to
over 2700. That’s over 2700 people who may know about jobs and can
provide prospective employers with reliable information about me.
But one of the weaknesses of LinkedIn is the same problem I had
when originally looking for job listings. There are over 20 million
people on LinkedIn. How do I sort through all that to find the people
I know? LinkedIn groups help. LinkedIn groups allow people with
similar interests or backgrounds to readily find each other.
We started the SCCE LinkedIn group for that reason. Current members
of SCCE can join the group and then easily find other SCCE
members to connect with, and network for jobs, advice, or simply to
commiserate. And compliance officers tend to have lots of reasons to
commiserate with each other. I encourage you to explore the benefits
of networking with other SCCE members through our LinkedIn
group. Just make sure you record the same email address with LinkedIn
as you do with SCCE—that’s how we verify membership.
To join SCCE LinkedIn group:
http://www.linkedin.com/e/gis/61769/3D294E6025B3
By the time you read this, I hope to have found a job, but in case not,
consider this a shameless example of networking—contact me if you
know of some interesting opportunities! n
Relationships Matter
Your professional relationships are key to your professional success.
June 2008
4
Want more networking opportunities? SCCE has set up a LinkedIn group for our members. LinkedIn is the “Facebook” for professionals. You
can join for free and set up your professional profile online, then network with colleagues and classmates. You can join the group by visiting this
link: http://www.linkedin.com/e/gis/61769/3D294E6025B3. How can LinkedIn help me? LinkedIn is a place to find and leverage
professional opportunities, now and throughout your career. LinkedIn enables you to:
n Present yourself and your professional capabilities
n Find and reconnect with colleagues and classmates
n Leverage powerful tools to find and reach the people you need
n Build a powerful network of trusted professionals
n Discover professional relationships and opportunities
n Tap into inside connections and information
n Get the edge that gives you competitive advantage
There are already 20 million professionals in the LinkedIn Network and that number is growing fast. Whether you seek a job, a hire, a reference,
a sales lead, an expert, or an inside connection at one of 50,000 companies, LinkedIn is an irreplaceable resource for building your professional
relationships and achieving your goals.
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

The Business of Ethics
The costs of misconduct compromise an
organization’s business performance as well
as its reputation. A 2002 American Family
Voices study, entitled “The Cost of Corporate
Recklessness,” released by the No More
Enrons Coalition, 2 estimated the total costs
of corporate scandals to be in excess of $200
billion dollars. The figure is based on the
accounting “failures” at Enron, Arthur Ander-
By Deborah E. Wallace, EdD
Editor’s Note: Deborah Wallace, Principal sen, WorldCom, Adelphia Communications,
Owner of Boston-based Brinkpoint Consulting,
has more than 20 years of experience in investment savings, pension, and of course,
Tyco, and others and includes the loss of jobs,
the areas of board effectiveness and leadership tax revenue.
development. She may be contacted by phone at
781/259-0550 or by e-mail at
In addition, research conducted in 2007
dwallace@brinkpointconsulting.com.
demonstrated that stock price, earnings as a
percent of assets, and volatility all respond
Results from the 2007 Ethics negatively to allegations and announcements
of misconduct. 3 Specifically, the report
Resource Center’s “National
Business Ethics Survey” 1 reveal a showed that, on average, businesses lose
discouraging statistic: only 9% of US companies
surveyed believe that they have strong misconduct is revealed.
41% of their market value when news of the
ethical cultures. Further, despite a modest
decrease in misconduct following the Enron
debacle in 2000 and the enactment of the
Sarbanes-Oxley Act in 2002, instances of
misconduct have slowly crept back to pre-
Enron levels. In addition, activities associated
with misconduct are increasingly creative.
By way of clarifying the issue, it is important
to distinguish compliance from ethical
behavior. Compliance, more specifically
regulatory compliance, is the adherence to
laws, agency regulations, and recognized
(industry) standards. Compliance programs
and newly respected compliance officers have
flooded US corporations in the last 5 years in
an effort to stem the tide of public mistrust.
Ethical behavior, while central to organizational
compliance, is also central to organizational
values.
On average,
businesses lose
41% of their market
value when news of
the misconduct is
revealed.
We also know that there is a correlation
between market-imposed penalties following
misconduct and a company’s reputation. Reputational
penalties can include loss of sales
and market share by companies convicted of
consumer fraud or by companies who have
been victims of product tampering. Or, when
a firm is dishonest in its dealings with its
vendors and suppliers, reputational penalties
can range anywhere from the imposition of
prohibitive costs to the permanent loss of
services.
With only 9% of US companies believing
that they have strong ethical cultures,
building and re-establishing our reputation
for conducting business ethically and with
integrity will have to be a systemic effort.
Although changes by individual corporate
citizens are essential to repairing our reputation,
this alone will not lead to sustainable
change. What can lead to sustainable change
is a fundamental reframing of how US corporations
plan and conduct business.
In 1988, R. Edward Freeman and Daniel
Gilbert published Corporate Strategy and
the Search for Ethics. 4 In it, they argued that
our business culture needs to become one in
which corporate strategy is built on the basis
of ethical reasoning. We can be more vigilant
in tracking and punishing individual misconduct
and we can require top-down ethics
“training,” but separating ethics from strategy,
as the vast majority of US corporations apparently
do, is not the way out and up.
Systemic change – change that becomes
institutionalized and habitual – is the
responsibility of our boards and CEOs who
must intuitively understand that, no matter
how huge the potential financial gain may be
if ethics are ignored or compromised, there
will always be an even bigger cost down the
line. n
1 ERC’s National Business Ethics Survey available at http://www.ethics.
org/research/nbesoffers.asp. Accessed May 5, 2008.
2 American Family Voices study, The Cost of Corporate Recklessness
released by The “No More Enrons” Coalition October 18, 2002
3 Murphy, Deborah L, Shrieves Ronald E, Tibbs Samuel L: Understanding
the Penalties Associated with Corporate Misconduct: An Empirical
Examination of Earnings and Risk. University of Tennessee, revised
May 2006. This is an unpublished research paper available in full online
through the Social Science Research Network at http://papers.ssrn.com/
sol3/papers.cfm?abstract_id=993479 Its publication is forthcoming in
The Journal of Financial and Quantitative Analysis but access to articles
requires membership.
4 Freeman, R. Edward; Gilbert, Daniel R. Jr: Corporate Strategy and the
Search for Ethics. Prentice Hall, Englewood Cliffs, New Jersey, 1988
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
5
June 2008

So, What’s Your
Compliance Strategy?
By Henry Klehm III, JD; David Schweiger, PhD; and Andrew Schweiger
Editor’s note: Henry Klehm is a partner at Jones department’s improvement and remediation
Day Law Firm in New York City and former of the regulatory crisis that had threatened
Global Head of Compliance, Deutsche Bank, the firm. She whispers that a senior regulator,
AG. He may be contacted by e-mail at
whom she recently ran into in Washington,
hklehm@jonesday.com.
told her that the firm had done the best
among its industry peers in clearing up the
David Schweiger is President and Andrew Schweiger
is a Senior Consultant with Schweiger & cookie for desert as a reward!
problems. Ah, a good day so far. Maybe a
Associates in Columbia, SC, a consulting firm
specializing in strategy development and execution.
Dr. Schweiger can be reached at
curmudgeon) in the next breath, she wonders
But, (and there is always a “but” with this
David@scaas.com.
how the department will handle the increased
regulatory risks associated with the new,
In the wake of an enforcement action major acquisition in a third-world country
by one of your primary regulators two that is being considered in the board session
years ago, the board of directors instituted
numerous governance reforms. You, strategic initiatives suggest entry into new,
that afternoon. Moreover, she notes that other
the CEO, and the General Counsel quickly highly regulated businesses in the quest for
hired a great chief compliance officer (CCO). improved distribution and increased vertical
The CCO, who is also a lawyer by training, integration to capture margins previously
immediately set to work on the remediation paid to retail distributors across developed
of the crisis, while re-building the department
to enhance the quality of compliance will they find people experienced in our busi-
markets. Without a pause, she asks, “Where
staff, expand compliance coverage to previously
uncovered areas of the firm, and imple-
part of the world? How is the department
ness and familiar with the regulators in that
ment new systems and workflow tools to going to cope with the expected substantial
detect and investigate potential wrongdoing. information technology (IT) burden to conduct
surveillance of the retail business?”
Now, the firm’s credibility with its regulators
is re-built, the auditors find little wrong with
the activities of the Compliance department, Your sinking feeling is exacerbated through
and the remediation required as part of the the connection those questions make to your
regulatory settlement is essentially done. memory of the budget session with the senior
team last week, in which every business line
Most importantly, during the break following
the executive session at the close of the improved cost management. In your minds
and department, except Compliance, reported
committee meeting before the general board eye, you recall in precise detail the budget
session, the frequently irascible chair of the book Compliance page which reflected a 70%
board’s Audit Committee sits down next increase in costs over the last two years, and
to you for the informal lunch. Right away, the “Not Available” under the columns for expected
changes for the next three fiscal years.
she tells you how impressed she and the rest
of the committee are with the speed of the
“Those are very important questions that
we have been considering since our board
strategic planning session six months ago.
Compliance will report on that in two
months at the next committee meeting, if
that’s okay with you,” is the best response
you can muster. After she notes that the
agenda is filled for that meeting with the
independent auditor retention review, you
agree that Compliance will report at the following
meeting in four months. With your
desire for the cookie gone and apologies, you
excuse yourself to make a quick call before
the meeting starts in 15 minutes. It’s time to
get some help and figure out how to move
beyond simply having turned around the
compliance organization. As you make your
call, you cannot help but think about all the
compliance challenges facing your organization
and all the others out there. You need a
department that addresses these issues with a
forward-looking strategic approach.
The Context for Compliance Strategy
The questions, posed by our hypothetical
audit chair, boil down to one: “What’s your
Compliance strategy?” Before answering that
though, we should ask why now is the right
time to devote the time and human resources
to the development of a compliance strategy.
The answer is multi-faceted. As a corporate
governance matter, the directors are obligated
by corporate law to use a good faith effort
“to assure themselves that information and
reporting systems exist . . . that are reasonably
designed to provide senior management and
the board itself timely, accurate information
sufficient … to reach informed judgments
concerning both the corporation’s compliance
with law and business performance.” 1 The US
Federal Sentencing Guidelines and the policies
of the US Department of Justice regarding
prosecution of corporate entities drive home
the importance of ensuring effective compli-
June 2008
6
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

ance programs for all corporate entities. A
department that is not forward-looking and
strategic cannot be effective at informing directors
about future compliance risks.
More broadly, the corporate scandals in the
early part of this decade had direct impact
on Compliance departments of corporations,
in general, and financial institutions
in particular. Among other things, increased
scrutiny and penalties for missteps drove
substantial increases in the allocation of
resources to preventing and detecting
violations of law and firm policy.
Costs have skyrocketed as firms have
been forced by regulatory, peer, or
non-governmental organization
(NGO) pressure to improve the
quality of the professionals engaged
in compliance activities, and to
substantially enhance the technology
devoted to the task. Full-time staff
devoted to the function is no longer
a small fraction of a percentage
point of the total employee base. As
others have noted, compliance is no
longer a back office, low cost, faceless
function.
Another consequence of the scandals was an
explosion in the pace of regulatory change,
not just in the United States. Attractive new
markets, such as the People’s Republic of
China and India, moved with lightning speed
to tightly regulate business activity and ensure
that scandals do not erupt in their backyards.
Moreover, regulation by policy statement
from senior regulators has become a source
of frustration for CCOs, who must decipher
broad and vague pronouncements into real
policies, processes, and systems that will
meet the ever-skeptical eye of examiners and
investigators.
Finally, the broader economy has a definite
impact on Compliance departments. Since
the burst of the technology bubble and the
economic shocks following 9/11, the general
business climate rebounded and the Dow
reached new all time highs. Merger and acquisition
activity also reached all time highs.
Established businesses began seeking expansion
into new growing markets around the
world and new distribution options. With the
expansion also comes new compliance risks
that must be managed to avoid slip-ups that
can be oh-so-costly to new ventures.
Costs have skyrocketed as
firms have been forced by
regulatory, peer, or nongovernmental
organization
(NGO) pressure to improve
the quality of the professionals
engaged in compliance
activities, and to substantially
enhance the technology
devoted to the task.
More recently, the mortgage bubble burst,
with the full consequences as yet unknown.
And, the colossal control failure at the French
bank, Societé Generale, puts a price tag well
into the billions on the failures of control
systems. How many financial institutions will
see their senior executives testifying before
Congress about the adequacy of borrower due
diligence in “no doc” loans or rogue trader
controls?
Taken together, all these factors demonstrate
that, like never before, assessing the compliance
risks associated with business plans has
become more challenging and critical to
protecting major investments.
Our experience suggests that few major
Compliance departments consider the issues
in comprehensive terms. Many focus on the
effectiveness of their programs vis-à-vis the
expectations of their critical external constituency,
their regulators, or their critical internal
business clients. More CCOs should think
in comprehensive strategic terms. Business
people, on the other hand, absent crisis,
tend to evaluate compliance in terms of cost,
because it is very tough to measure return on
investment (ROI) or internal rate of return
(IRR) for compliance activities. Can
more effective compliance be achieved
at lower cost?
Yes. Reconciling these apparently
conflicting priorities requires the
development of a forward-looking
strategic plan. The plan must be fact
driven and based on a detailed assessment
of existing and emerging compliance
risks, business strategic plans,
and existing compliance capabilities.
Executed with the right process, the
outcome answers the compliance
strategy question before it is asked,
improves transparency to all constituents,
and builds expertise and ownership
of compliance management decisions.
In the end, the planning process develops
sound strategies, initiatives, and action plans
that enable Compliance departments to more
effectively achieve their present and future
missions.
In this article, we start with a description of
the Global Compliance department, and the
challenges it faces. As we search for a solution
to those challenges, we summarize the problems
that strategic planning poses for virtually
any organization. We then review how we
designed and executed a strategic planning
process at Deutsche Bank that addressed the
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
Continued on page 9
7
June 2008

SCCE Introduces
2008 Regional Conferences!
The Regional conferences are one-day programs designed to provide the hot
topics and practical information that compliance professionals need to create
and maintain compliance programs in a variety of industries. We will also offer
the CCEP exam on Saturday, following each of the local programs.
October 17, 2008 | Minneapolis, MN
CCEP Exam October 18, 2008
November 14, 2008 | Atlanta, GA
CCEP Exam November 15, 2008
Purpose SCCE Regional conferences provide a forum to interact with local
compliance professionals, share information about our compliance successes and
challenges, and create educational opportunities for compliance professionals to
strengthen the industry.
Who should attend? Compliance officers, in-house and outside general
counsels, privacy and security officers, regulatory affairs VPs and directors,
billing, coding professionals, government agency staff.
Learning objective Attendees learn about current regulatory requirements,
governement enforcement initiatives, and the management of effective
compliance programs and meet and network with other compliance
professionals locally.
Become a Certified Compliance & Ethics Professional (CCEP)
Becoming CCEP certified demonstrates sufficient knowledge of government regulations
and compliance processes to understand and address legal obligations and promote
organizational integrity through the operation of effective compliance programs.
June 2008
8
Register online at www.corporatecompliance.org
Questions? Call +1 952 933 4977 or 888 277 4977

So, What’s Your Compliance Strategy? ...continued from page 7
unique challenges of compliance departments
today, as well as those inherent in any
planning process. Finally, we summarize the
results of the process.
Strategic Planning
As we began to ponder a comprehensive
solution to the multi-variate equation, we
also recognized that scale and nature of the
Global Compliance department (GCD) at
Deutsche Bank, AG (DB) would also be an
important factor. The GCD serviced a truly
global bank with operations in more than 35
countries and more than 68,000 employees
around the world. The GCD itself had grown
significantly in the previous four years, and
included staff “on the ground” in over 23
different countries who had a broad variety of
educational backgrounds, professional qualifications,
and substantive work experiences. IT
costs had increased substantially also, as regulators
around the world pushed for higher
levels of information technology. Human
resource cost also grew as staff levels increased
and the market for experienced compliance
professionals became highly competitive. Like
many other staff in similar control functions,
the overwhelming majority of the employees
in the GCD had never participated in the
development of business strategy. Given
the wide dispersion in geographic, cultural,
and management experience within the
GCD, successful strategic planning requires
complete senior management agreement on
the need for the effort and the underlying
process.
Senior management had a fairly clear picture
of these challenges, but we needed to know
what the rest of the GCD’s management was
thinking. We conducted an anonymous survey
to assess whether our views were shared.
The results can be summarized as follows:
n Strategy. There was consensus that the
department could do a better job in developing
and communicating its strategy to
the organization.
n Organizational structure. People
believed the organizational structure was
solving local and business line problems,
but there was a belief that global initiatives
were being less effectively executed.
n Systems. These were thought to be very
localized and needed more global alignment.
n Processes. There was general agreement
that processes were generally strong, but
would need incremental upgrades in
certain key areas.
n Resourcing. Human and financial
resources were thought to be adequate but
the development and retention of talent
needed enhancement.
These results suggested that achieving “buy
in” would not be the major challenge. We
then considered what the process for creating
the strategy would entail. We found a
number of complex models and approaches
to planning, but we did not find any that
had been used comprehensively for a large
Compliance department. Further, while the
models varied significantly in effectiveness
and approach to the completion of the actual
process (more about that later), the models
and processes typically involved the following
steps in some form:
n The development of a series of organizational
goals or targets (revenue growth,
margin increase, entry into new markets,
etc.);
n An analysis of the external environment
(e.g., markets/industries in which the organization
plays);
n An assessment of the organization’s internal
capabilities and competencies (i.e.,
strengths and weaknesses);
n An analysis to uncover the gaps between
the organization’s capabilities and the
market/industry it wishes to serve;
n The development of strategic initiatives to
close these gaps (e.g., acquisitions, local
start–ups/greenfield operations, capital
investments, organic growth); and
n The development of three-to-five-year action
plans.
On the surface, strategic planning appeared
fairly straightforward and logical – if we
could understand our external environment
and its direction, along with our own set of
capabilities, then we could effectively make
and execute strategic decisions, right? Maybe,
maybe not. The analytical models help us ask
the right questions and collect and analyze
the right information, but the success of any
strategic planning effort ultimately depends
on an organization’s ability to execute the
initiatives outlined in its plan. Without the
commitment, cooperation, and subsequent
buy–in of all pertinent parties at all levels of
the organization, a strategic plan is only as
good as the 8-1/2 x 11 inch sheet of paper
on which it is printed. Depending upon the
approach we chose, one of two outcomes
seemed likely to result: (1) Strategic planning
– the corporate cliché; or (2) Strategic
development and execution – the catharsis.
Strategic planning – the cliché
Although highly important and vital to the
growth and development of any business
or organization, strategic planning efforts,
unfortunately, have become a bit of a cliché.
Oftentimes in these endeavors, senior-level
executives either go offsite and develop a plan
in a small cabal, or bring in a consulting firm
to do it for them. In the first case, the plan
often lacks the depth of information that is
needed to be fact based.
In the latter, the buzz begins. Strategic
management consultants are brought in.
“Cross-functional teams” are formed within
the organization. Research is cultivated.
Continued on page 10
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
9
June 2008

So, What’s Your Compliance Strategy? ...continued from page 9
Meeting upon meeting upon meeting is
held over a lengthy time period. The result?
A thick PowerPoint deck chock full of data,
market facts and figures, customer satisfaction
surveys, etc. Internal data is generated. The
resulting strategic initiatives will be executed.
The dog-and-pony show presentation of the
findings is made to the leadership team that
optimistically approves some of the initiatives.
Hands are shaken and the “strategically
focused” organization is off and running.
Fast forward one year. The last remaining
copy of the “Plan” is sitting on the shelf of
an executive, collecting dust or becoming
the proverbial doorstop. Occasionally, it is
referred to for specific points of organizational
scripture. By and large, the strategy is
abandoned in favor of the organization’s longtime
status quo – normalcy and resistance to
change.
The failure of strategic planning efforts can
be blamed on numerous people and a host
of factors: Perhaps the executive team wasn’t
fully committed to driving change or did not
do a very good job at communicating it to
the organization. Perhaps middle management,
the notoriously most difficult point of
an organization to change, was either resistant
to the Plan or did not understand how they
could effectively contribute to it. Or maybe,
despite all the data and hard work, the initiatives
were unrealistic, bureaucratic, or stifled
by political barriers. Or one could just blame
it all on the consultants. Many of these factors,
in fact, often combine to doom the plan.
Bottom line: poor execution of the Plan.
The most crucial factor, though, is that
most of the people who will need to
execute the Plan to make it work either do
not understand it, have no ownership of
it, or do not know what they need to do to
contribute to it.
Compliance strategy – the catharsis
Aware of the pitfalls associated with large
global departments in large institutions
discussed above, the GCD leadership team
knew that it needed to develop and execute a
process that would yield more than a glossy
binder of PowerPoint slides. The strategic
planning process, hereafter referred to, as
“Strategic Planning for Effectiveness” (SPE),
needed the commitment, cooperation, and
collaboration necessary from all members of
the GCD to yield positive value. Moreover,
SPE had to be replicable, yet flexible in the
future, across the organization as external
regulatory environments and business priorities
constantly change.
To that end, the leadership team of the GCD
engaged a boutique management-consulting
firm to help it design and facilitate the execution
of the SPE across its complex organizational
matrix. Because we had not found
anyone who had done this before, we decided
a small firm would force ownership in the
GCD leadership team for two reasons. First,
the process would need to be repeated in the
future, and it would be unlikely that separate
resources would be made available to support
such future efforts. Second, as a matter of
professional development, we wanted our
leaders to become strategic thinkers.
From the beginning of the SPE process, we
carefully focused on design. The design process
involved the consultants as well as senior
GCD leaders. More importantly, the leaders
and several middle-level employees from each
of the GCD’s various regional and divisional
operating units were assigned key roles in the
process. We did this upfront to increase the
likelihood that there would be commitment,
collaboration, and ultimately, better execution
across the organization. Within reason,
this would work better than if the plan was
hatched and executed by a select few leaders,
particularly in an organization that had not
done this before.
Furthermore, the entire GCD leadership
team was well aware that the SPE process
would require a cultural shift across the
organization for long-run success. Instead of
spending limited budget dollars and utilizing
scarce resources for training and development
programs to initiate the cultural shift, the
team embarked on developing a process that,
in and of itself, would create a cultural shift
within the organization. By driving ownership
for both design and execution deeply
into the organization, we would move the
entire GCD from a reactive to a proactive
stance that would enable the organization to
operate more efficiently and effectively in the
longer term.
Designing the SPE process
With the proper design team in place, a series
of face-to-face and virtual meetings were held
with the design team, during the month-long
design phase, to discuss and develop the process.
To support the development and critical
“buy-in,” a series of surveys were issued across
the GCD to connect the forthcoming analytical
components of the strategy development
process with organizational commitment,
success, and more importantly, with reality.
Coupled with the feedback from the GCD,
the design team determined that the strategy
development and execution process would:
n Include the proper analytical components
(see below);
n Support the business-line goals and strategies;
n Be fact based;
n Be organic and flexible to material environmental
changes;
n Link regulatory understanding and
business-line priorities to the execution of
strategic decisions;
Continued on page 12
June 2008
10
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

C o r p o r a t e Co m p l i a n c e & Et h i c s :
G u i d a n c e f o r En g a g i n g Yo u r Bo a r d
“This video provides an
overview of the Board’s
role in compliance.”
Odell Guyton
Senior Corporate Attorney,
Director of Compliance,
Microsoft Corporation
www.corporatecompliance.org
“It’s pretty clear that
the best compliance
program in the world
is meaningless, even if
it’s funded with a good
well-meaning compliance
officer, if the leadership
of the company is not
behind it and isn’t
supportive…”
Bringing the vision of
leadership together
with a compliant and
ethical culture
Honorable
Michael E. Horowitz Commissioner,
United States Sentencing
Commission
Order Today! Non-Members $395 SCCE/HCCA Members $345
Name
Title
Company
Address
City
State
Phone
Fax
E-mail
Format: DVD VHS
Zip
Total Payment $ ______________
Purchase Order # _____________
Check/Money Order
VISA MasterCard
Number
Exp. Date
Name of Card Holder
Signature of Card Holder
Please make check payable to:
Society of Corporate Compliance and Ethics (SCCE)
Mail to: SCCE
6500 Barrie Road, Suite 250
Minneapolis, MN 55435
Phone: +1 952 933 4977, or 888 277 4977
FAX: +1 952 988 0146
Online: www.corporatecompliance.org
E-mail: info@corporatecompliance.org
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
11

So, What’s Your Compliance Strategy? ...continued from page 10
n Develop in-house strategic expertise and
ownership of strategic decisions;
n Create an internally replicable strategy
development process;
n Provide a process to develop teams, individual
managers, and executives;
n Create and nurture cross-matrix strategy
development teams; and
n Minimize long-term dependence on strategic
consultants.
In order to properly roll out this process
across the organization, the GCD senior
leadership team, along with the consulting
group, developed an SPE workbook to help
codify and guide the effort. The workbook
included analytical tools and action components
(outlined in the next section) and was
issued to the leadership teams of the GCD’s
eleven regional units and nine business unit
divisions. Completion was required in less
than three months. Importantly, GCD senior
leadership and the consultants provided support
to all the units throughout the SPE to
enable the teams to develop their plans.
Workbook content – the SPE process
The process was divided into the following
five logical and easy-to-implement steps for
execution:
Step 1: External environmental assessment.
This assessment was divided into two
areas. The first focus was on the regulatory
environment in which we operated. We asked
for comprehensive focus and examination of
new or changed regulation in our key compliance
risks:
n Business conduct
n Organizational duties
n Market conduct
n Reputation risk, and
n Anti-money laundering risk
The result provided a detailed analysis of the
regulatory changes, the regions and business
lines impacted by them, the regulator driving
the change, and the available time to respond.
The second area focus was on key business-line
initiatives. As a support and control function,
the GCD’s role was to enable the bank’s businesses
to succeed in executing their strategies
and delivering on their goals. Through detailed
meetings and interviews by compliance leaders
with more than 300 key business people,
current and future strategic priorities for each
business line (e.g., global banking, private
wealth management) were identified. We captured
data, in a systematic fashion, regarding
their plans for the introduction of simple and
exotic new products and for entry into new
geographic markets (e.g., Islamic countries).
The regulatory changes and business-line
initiatives were examined and prioritized
through a two-dimensional screening matrix
that would become the signpost for guiding
present and future focus for the GCD.
Business-line and regulatory priorities were
rank ordered, based on the following two
dimensions:
1. The importance of an initiative to a
business and the likelihood it would be
implemented by the business
n High – the initiative would be critical
to the success of the business.
n Medium – the initiative would greatly
help the business achieve its goals.
n Low – the initiative would be helpful,
but not have a significant impact on the
achievement key business goals.
2. The impact of the regulation on the execution
of a business initiative
n High – regulation could make the initiative
extremely expensive or prohibitive,
if not properly addressed.
n Medium – regulation could make the
initiative more expensive or have a
material impact.
n Low – regulation is unlikely to make
the initiative more expensive or have a
material impact
Step 2: Internal capability assessment.
Any organization’s ability to respond to the
environmental issues identified is a function
of its resources. To better understand
the GCD’s resources and how they enabled
it to respond to the environment, a detailed
capability analysis was conducted. In prior
exercises, the GCD identified its four major
roles: advisory, advocacy, prevention, and
detection. The capability assessment analyzed
our resources against these four roles.
1. Advisory. In the advisory role, the GCD
provides strategic support to the business,
fosters business growth by providing
guidance and advice to the businesses on
compliant business solutions, monitors
and interprets legal and regulatory focuses,
develops proposals for changes to meet
regulatory requirements, and supports
implementation.
2. Advocacy. In the advocacy role, the GCD
proactively engages in purposeful dialogue
with the bank’s regulators (which number
more than 200 globally), lawmakers, and
various financial-services industry trade
groups. The department seeks to influence
the development of rules that affect the
bank’s business and operating environment;
manage regulatory inquiries, audits,
inspections and investigations; and participate
in the regulatory consultation process.
3. Prevention. In the prevention role, the
GCD designs and implements programs
and processes, such as policy development
and employee training.
4. Detection. In the detection role, the
GCD conducts risk-based electronic or
manual surveillance and monitoring to
identify violations of law and policy, and
to test the strength of compliance controls.
Continued on page 14
June 2008
12
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Compliance Policies/
Document Sharing Project
Our goal: to make
1,000 documents
available to members
If y o u c on t r i b u t e 50 d o c u m e n t s ,
y o u w i l l h a v e 50 c ha n c e s to w i n !
Contribute a document and enter the
iPod/Audio Conference Giveaway!
We are pleased to bring you the iPod/Audio Conference
Giveaway. Contribute one or more documents to the SCCE
Compliance Library, and be registered for a chance to win an
iPod or an SCCE Audio conference. Drawings will be held on a
monthly basis starting in July 2008, so there are many opportunities
for YOU to win. The more documents you add to the
library, the better your chance of winning!
E-mail your document(s) to Caroline Lee Bivona
at caroline.leebivona@corporatecompliance.org
With 2,300 lawyers in
30 locations, Jones Day
One Firm Worldwide is
a proud law firm sponsor
of this giveaway!
www.jonesday.com
June 2008
www.corporatecompliance.org
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org 13
888-580-8373

So, What’s Your Compliance Strategy? ...continued from page 12
A detailed analysis of these roles and the
capabilities that support them was conducted
throughout the entire GCD. The analysis included
an examination of the assets, skills and
knowledge/people, systems, work processes,
organizational structure, and performance
metrics and how they all interacted to enable
the capability. For example, the GCD’s ability
to provide the businesses advice on such areas
as real estate or Islamic lending practices (e.g.,
Sharia law) was identified.
These categories were defined as follows:
Assets. These are things physically used by
the department that can produce future economic
benefit, the measurement of which can
be expressed in monetary terms. An asset
typically is listed on a balance sheet (e.g.,
computer hardware, facilities).
Skills and knowledge/people. The
employee set and unique capabilities,
such as intellectual capital, within a
specific industry that bring value to the
department (e.g., an employee or group
with valuable experience and knowledge
in the regulatory environment).
Systems. Typically, software that allows the
department to manage its flow of information
and make decisions (e.g., transaction surveillance
software).
Work processes. Specific sequences of activities
used to manage workflow and reach a
desired goal (e.g., surveillance “hit” investigative
processes, branch examination processes,
financial management processes).
Metrics. Quantitative and qualitative
measurements, often used to assess the effectiveness
and efficiency of the execution of
an activity (e.g., number of surveillance hits,
training sessions given, suspicious activity
reports filed).
Step 3: Gap analysis. Based on the first
two steps, a gap analysis was conducted to
identify gaps between the GCD’s current
and required regulatory and business focuses,
and the capabilities needed to effectively and
efficiently meet the regulatory and business
priorities. The specific questions included:
n What capabilities add no value and should
be dropped (i.e., they add no value but
consume scarce resources)?
n What capabilities do we need that do not
currently exist?
n What capabilities should be better leveraged
or significantly improved because
they are underutilized or inefficient?
Given a resource-scarce
environment, it was critical
that everyone realized
that not every gap closing
strategy could be supported
and that priorities
needed to be set.
To ensure that “the baby was not thrown
out with the bath water,” each capability was
examined with respect to the assets, skills and
knowledge/people, systems, and work processes.
In some cases, we found the capability
important but in need of improvement in one
or more elements. Frequently, we found the
area for improvement was development and
addition or redeployment of key people.
Step 4: Gap closing strategies. Once the
gaps were identified, initiatives to close them
were developed. The initiatives ranged from
redeploying or better utilizing existing staff,
to changing work processes, to modifying or
developing new systems.
As leaders began to define the optimal gap closing
initiative, we told them to consider options
that were both effective and efficient. “Consider
ways to creatively redeploy and utilize existing
resources within the global compliance organization
as an alternative to securing additional
new resources (i.e., adding new costs to your
budget should be your last alternative).”
The last point was particularly important to
the success of the SPE. People tend to rely
on and guard resources under their immediate
control, and to locally develop solutions
to problems when they occur. The need
for autonomy and the “not invented here
syndrome” often prevail. The tendency often
results in excess costs and slow and inefficient
implementation solutions to problems
that, more often than not, stretch across
locations and individual spans of control.
Through a collaborative strategy development
and execution effort, we sought to
break down these silos and achieve more
effective and efficient use of capabilities
across the GCD.
For each strategy, two costs were identified:
“Change the Bank” (one time
development and implementation costs) and
“Run the Bank” (recurring operating costs).
This injected a healthy dose of reality into the
process by ensuring that there were no blank
checks.
Step 5: Action plans. The final step in the
process was the development of action plans
for each gap closing strategy and an on-going
review process for ensuring that each plan was
implemented. Each plan was championed
by a member of the leadership team and
included individual accountabilities, milestones
and completion dates, deliverables, and
resources (e.g., people and money) needed to
complete the plan.
Carrying Out the SPE
June 2008
14
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Although a sound the design was necessary
to have a shot at success, a good design alone
would not achieve the cultural shift necessary
for success. The interaction and communication
among those involved in the SPE process
and the rest of the organization was a vital
component to achieving an effective plan and,
ultimately, execution of the plan. The following
is a brief overview of the process used to
carry out the SPE:
Introduction of planning process
As we noted above, we surveyed department
management to lay the foundation for achieving
the buy–in among the GCD leadership
team. In that survey, we asked every member
of senior department management to ascertain
precisely what they thought was working
well and what was not in the department
that had grown rapidly over the previous four
years. We collated those responses and hung
every one of them in poster size on the walls
of the conference room where we were holding
the two-day kick-off meeting with the
entire GCD leadership team present. After
two hours of detailed review and comment,
the responses drove home the need for a unified
strategic plan by the GCD.
The meeting then moved to a detailed discussion
of the process, and the reasons for
every step. We covered the following topics:
n The importance of SPE process to the GCD;
n A review of the mission and roles of the
GCD as focal points for the SPE process;
n Introduction and explanation of the SPE
process with the accompanying “analytic”
document;
n The importance of getting buy–in from regional/business
leadership teams and staffs
as well as others with critical knowledge;
n Set post meeting expectations and schedule
with respect to:
o Steps to completion of plan
o Meetings to discuss plan
o Feedback from plan
o Roll out of plan
n Review process for ensuring its execution;
and
n Introduction of the roles of outside strategic
consultants who would help coach them
throughout the entire planning process.
Moreover, an internal point person from the
leadership was identified. This person, in
collaboration with the consulting team, was
responsible for ensuring that the SPE ran
smoothly and on time. The internal point
person was a central point for any issues or
questions faced by any team or individual. This
would lead to quick and effective solutions.
To ensure that everyone understood the SPE
process and bought in, we provided an opportunity
to provide final feedback and changes.
Creation of Teams
Following the kick off meeting, SPE execution
teams were created. With the help of
the consultants, each team addressed the following:
n Identity of team leaders and members;
n The scope of their tasks and deliverables;
n Definition of key activities, resources and
deadlines;
n Identity of any additional resources; and
n Development of localized implementation
plans including organizational communications
with key stakeholders.
Execution of the SPE
Throughout the SPE process, the GCD
leadership, the teams, and the consultants
communicated frequently. For each step of
the SPE, a formal review process, whereby the
leadership team provided feedback to each
team, was held. This ensured that the teams
were on the right track and that emerging
global issues were being captured. These issues
were especially important.
Moreover, as is the case with any process,
improvements were constantly being made to
the SPE based on feedback from the teams.
Rather than bureaucratically execute the SPE,
we wanted to ensure that it worked and that
those involved in it continued to feel that
they had influence over the process itself. We
wanted them to make the SPE “their own.”
The Gala Event
Given the complex nature of the GCD
organizational matrix and its geographic dispersion,
a two-day, face-to-face event was held
upon the completion of the planning process.
This event provided the forum for final debate
on all the initiatives and the development
of the actual global strategic initiatives. We
decided a face-to-face meeting was necessary
for two reasons. First, given a resource-scarce
environment, it was critical that everyone
realized that not every gap closing strategy
could be supported and that priorities needed
to be set. Second, there might be common
initiatives that could better be addressed on
a global scale, rather than by each regional or
business team. We looked for cost savings and
to optimize resources and approaches.
Third, gaining ownership and consensus among
all the teams for the overall GCD plan was critical
to effective execution. Moreover, the session
was a true test of whether a culture of collaboration
and cooperation was emerging and
a barometer of the success of the professional
development component of the SPE process.
During the session, the leadership struggled,
at first, with the sheer number of initiatives
that had been generated and continued to
champion their self-identified priorities. By
forcing the resource constraints and achieving
acknowledgement that only about ten things
could be truly global priorities, the leadership
ultimately developed a list of key initiatives
Continued on page 16
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
15

So, What’s Your Compliance Strategy? ...continued from page 15
that were the most likely to achieve the largest
impact on enhancing the department’s execution
of its four key roles. We then identified
sponsors, owners, deliverables, and deadlines.
The end document was a clear, concise, fact–
based strategy that was executable within given
time and resource constraints.
Review and followup phase
Finally, we implemented an on-going periodic
review process to monitor the execution
of the gap closing strategies and action plans.
We also made the execution of these plans
a part of the performance reviews of those
responsible for execution.
Results of the SPE to date
The evidence, thus far, suggests that the SPE is
running fairly well from both the organizational
development and substantive perspectives. As
an organization, there is greater alignment and
focus. The “silo mentality” has decreased and a
greater focus on the needs and priorities of the
global organization, rather just than those of
the divisions and regions, had emerged. Clearly,
there is more communication and collaboration
across the organization, which helps the matrix
run much more smoothly. Second, there is a
marked shift in the level of strategic thinking
throughout the organization as well as a more
proactive stance. Third, the leaders of the GCD
are working together to more efficiently utilize
scarce resources. Fourth, and perhaps most
importantly, the SPE process has helped the
GCD establish much stronger partnerships
with the business lines. The process required the
leaders to spend more time interacting with the
businesses to learn more about the businesses
and their strategic priorities. This sent a strong
signal to the business leaders that Compliance
was there to help them and the firm to succeed.
From a substantive perspective, the top global
initiatives that emerged addressed the key
results of the survey (summarized above) that
led to the entire process. Ultimately, several
of the global initiatives accurately targeted
global risks that were highlighted in the risk
assessment process. To highlight a few important
items:
n Strategy. At the conclusion of the process,
approximately ten global initiatives
were defined, as well as other initiatives
by location and business division. The
initiatives were clear and executable and
addressed the important challenges and
risks the GCD was facing.
n Organizational structure. Six of the
initiatives addressed important structural
issues and enhanced the networking
and global execution capabilities of the
organization.
n Systems. Two initiatives were addressed
that resulted in systems development,
primarily focused on monitoring.
n Processes. One of the global initiatives
addressed the key process in need of
significant enhancements.
n Resources. Several of the initiatives
targeted talent development and fostered
organizational alignment. The bottom line
was that the process worked.
Finally, as an unanticipated outcome, the
SPE has become a meta-process, under which
a number of other processes and initiatives
(e.g., risk assessment) have become subsumed.
Moreover, the SPE initiatives are not
thought of as “projects,” but as “the way we
do things around here” (i.e., the process has
led to a cultural change in the organization).
This has made for a much more efficient and
less unnecessarily complex organization.
What we learned
Clearly, we have learned a number of things
from the SPE process. First, although the
process appears to be solely about strategic planning,
it has also proven to be an effective organizational
development and culture change tool.
It has gone a long way in building DB’s GCD.
Second, how you implement the SPE is just
has important as its analytical components.
More specifically, the involvement and engagement
of people throughout the organization
is key to its effectiveness.
Third, strategic thinking is more important
than strategic planning. The SPE is a process
of engaging people to think about strategic
issues facing the organization (e.g., emerging
compliance issues and business priorities). It is
not about filling in and submitting a bunch of
planning forms. When people become comfortable
with thinking strategically, the process
becomes a part of the day-to-day culture of
the organization, and people naturally become
more proactive and anticipate and prepare to
respond to emerging strategic issues.
Finally, anything that is worth doing takes
time, resources, and commitment to succeed.
This was something that the leadership team
understood and did well. It was this commitment
that caught the attention and enthusiasm
of the organization. However, the SPE
cannot be viewed as a one-time event. It is a
management process that needs to continue
to be supported, nurtured, and driven. n
The authors would like to thank Alan Greatorex,
the Head of Global Compliance Training and
Development for Deutsche Bank for the invaluable
role he played in the design and execution of the
strategic planning process described in this article.
1 In re Caremark International Inc. Derivative Litigation, A2d; (Delaware
Chancery Court, 1996).
June 2008
16
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Call for Authors
Compliance & Ethics Magazine
Compliance & Ethics Magazine is published bimonthly
by the Society of Corporate Compliance and Ethics
(SCCE). Professionals in the compliance field are
attracted to SCCE because it is the ultimate source
of compliance and ethics information, providing the
most current views on the corporate regulatory
environment, internal controls, and overall conduct
of business. National and global experts provide
informative articles, share their knowledge and
provide professional support so readers can make
informed legal and cultural corporate decisions.
We welcome all who wish to propose corporate
compliance–related topics and write articles.
Articles, when the topic allows, should include “how
to” tips. Articles generally run between 1,250 and
2,500 words.
If you are interested in submitting an article for
publication in Compliance & Ethics Magazine, please
contact Marlene Robinson:
marlene.robinson@corporatecompliance.org
+1 952 933 4977 or 888 277 4977
Topics to consider:
• Developing and managing effective compliance
programs
• Compliance and ethics training: senior
management versus non-management
• Conflict of interest
• Code of conduct
• Security
• Investigations: attorney privileges
• Sarbanes-Oxley Act updates
• Professional liability, audit, accounting
• Enterprise risk management: risk-based
assessments
• Compliance & ethics program assessments
• Information on new laws, regulations, and
rules affecting international compliance and
ethics governance:
• Articles addressing current “hot” compliance
and ethics issues
All Aricles are due by the 15 th of the
month 45 days prior to issue date.

SCCE Advisory Board
Urton Anderson
Chair, Department of
Accounting and Clark W.
Thompson Jr. Professor
in Accounting Education,
McCombs School of
Business, The University
of Texas at Austin
Marjorie Doyle
Practice Leader,
Ethics & Compliance
Solutions
LRN
Charles Elson
Director of the
John L. Weinberg
Center for Corporate
Governance and Edgar
S. Woolard, Jr. Chair in
Corporate Governance,
University of Delaware
Odell Guyton
Senior Counsel and
Director of Compliance,
Microsoft Corporation
SCCE Advisory Board
Co-Chair
Keith Halleland
Ex-officio Advisory
Board Member
Founding partner of
Halleland Lewis
Nilan & Johnson, PA
David J. Heller
Chief Ethics and
Compliance Officer
Vice President Risk
Management
Qwest
Gary Hill
Vice President and
Chief Ethics Officer
Wal-Mart Stores, Inc.
Michael Horowitz
Litigation partner, member
of the Business Fraud
and Complex Litigation
Group, Cadwalader,
Wickersham & Taft LLP,
and Commissioner, U.S.
Sentencing Commission
Shin Jae Kim Hong
Partner,
TozziniFreire Advogados
São Paulo, Brazil
Michael
LaFontaine
Chief Compliance Officer,
U.S. Bancorp
Sean Martin
Vice President,
Commercial Law,
Amgen
Joseph E. Murphy
Co-Founder,
Integrity Interactive
Co-Editor, ethikos
F. Lisa Murtha
Managing Director,
Huron Consulting
Group
Dennis Muse
Chief Executive Officer,
Global Compliance
Haydee Olinger
Vice President–Chief
Compliance Officer
McDonald’s
Corporation
Mollie Painter-Morland
DePaul University Associate
Director, The Institute for
Business and Professional
Ethics; Director, Center for
Business and Professional
Ethics, University of Pretoria,
South Africa
Daniel Roach
Vice President
Compliance & Audit,
Catholic Healthcare
West
SCCE Advisory
Board Co-Chair
James G. Sheehan
Medicaid Inspector
General, Office of the
Medicaid Inspector
General, New York State
Leonard Shen
Senior Vice President–
Chief Ethics and
Compliance Officer,
American Express
Roy Snell
CEO, Society of
Corporate Compliance
and Ethics
Debbie Troklus
Assistant Vice President,
Health Affairs/
Compliance, University
of Louisville Health
Sciences Center
Sheryl Vacca
Senior Vice President/
Chief Compliance
and Audit Officer,
University of California
Cheryl
Wagonhurst
Partner, Foley &
Lardner LLP,
LA Office, Regulated
Industries Team
Rebecca Walker
Partner,
Kaplan & Walker LLP
Professionals representing a broad range of industries make up this board.
The level of diverse experience and professional accomplishment is impressive. These industry leaders are
enthusiastic and poised to lead the Society of Corporate Compliance and Ethics into the future. SCCE promotes
the compliance profession by offering valuable programs and tools to enhance knowledge and expertise in the
compliance and ethics field.
We are very excited to have such a diverse and experienced group of people leading this organization.
Roy Snell, CEO
June 2008
18

Why are we where we are?
We have more opportunities for members to get involved, because of the
non-bureaucratic culture of our organization. Most importantly, we are
a successful organization because of the talent of our membership.
We have problems and frustrations just like any other organization.
However, we don’t have the kind of problems that other organizations
do. Our problems are associated with our entrepreneurial, fast-paced,
risk-oriented approach. We want to get as many people involved as we
can. As a result of our 50 compliance conferences, 48 audio conferences,
four certifications, two magazines, and a myriad of other activities,
we get a lot of people involved. You may see some people whose names
come up regularly. Because of the number of things we do, we have
to rely on some people to help regularly. The real question is, “How
many people get to be involved in our organization compared to other
professional organizations?”
Opportunities come from growth and risk. Growth and risk comes from
entrepreneurial behavior. If you want to see limited opportunity, join a
bureaucratic, constipated, committee-run organization. “No” is the word
of the day. Everything has to be approved, overseen, changed, analyzed,
and watered down to make sure everyone is happy and on board.
If you count meaningful work, not just superficial, resume stuffing
committee assignments, I would put our organization up against any
other for generating opportunities for members to get involved. We
want more people involved and to do that, we have to keep growing,
take risks, move quickly, delegate, and trust. We must also manage and
tolerate the challenges associated with that approach.
Other organizations have pre-meeting meetings to discuss who should
be invited to meetings. There are meetings to examine all of the political
ramifications of the topic to be discussed at the meeting. They
discuss who would be offended or not offended by being included or
not included. We, on the other hand, think of an idea and take action.
We ask someone to get it done. If someone else is offended by not being
included, we try to find something for them to do and we get that
done too. We have more resources to accommodate
all these requests to be involved,
because our resources are not tied up in
meetings, political discussions, and endless
ruminating about ramifications.
We have approximately 150 people writing
ROY sNELL
articles each year. If you count people who promise to write articles,
that number mushrooms to well over 300. Approximately 50 people are
involved with our certifications annually. With 50 conferences, we have
over 750 new speaking opportunities annually. No association anywhere
near our size can touch this number. We have approximately 100 people
involved in the speaker selection process for our 50 conferences. Approximately
100 people help with the audio conferences annually. Many
people are involved in product development, Website content, and a
myriad of other projects.
In this article I talk about our very talented, experienced, intelligent
membership and our organization’s operational culture. As I mentioned,
we have our own problems, but in the long run we grow faster,
do more, and have more opportunities than other organizations. To
create more opportunity, we all can’t be involved in every decision. We
have to be willing to take risks and make mistakes. We are better off
because we often delegate to individuals and trust them, rather than
delegating to committees. It’s not easy to do it the right way. In this
article I discuss why we are the way we are, and the challenges and
compromises associated with our approach.
Why are we the largest compliance and ethics organization in the
world? I must admit, it is an assumption on my part, that with 6,600
members (5,500 HCCA and 1,100 SCCE), we are the largest compliance
and ethics professional association in the world. It is the largest
I have ever heard of. Nevertheless, we are very successful because we
do things differently than others, and we have people who know this
profession better than most.
We are where we are because we have a large number of people who
know what they are doing. We have people who know the profession
and where it’s going. They know what is important and what is not.
They are not trying to push their own agenda or trying to cash in on
the compliance/ethics surge. We also have a system that allows them to
be effective. The system or culture we have is unlike many non-profit
membership organizations that become bureaucratic, indecisive, and
compromising.
Continued on page 20
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
19

Why are we where we are?. ...continued from page 19
The People
Our members, speakers, conference program
chairs, authors, our board, and our committee
members have practical knowledge
of our profession. We have many people
making hundreds of good decisions every
month. Our people are practical. They get to
the point. They know what they are doing
because they have lived this profession. They
are not caught up in glamorous fringe issues,
but rather, they understand the profession
at its core. More than anything, they know
where this profession is going, because they
know where this profession has been, and
they know what is important.
Generally speaking, people are not picked to
work on projects because of who they are,
who they work for, what degree they have,
or how much money they are willing to give.
Volunteers aren’t assigned to tasks because
they are the most vocal or most powerful.
People are assigned to tasks because they
know what they are doing. We have the
courage to assign the right task to the right
person. Because we put the right people on a
project, we have a greater return on investment
(ROI). That increased ROI gives us
more resources to get more people involved.
This is not always easy. It’s often easier to go
with the flow and assign tasks to people who
insist on working on something. It often
easier to pick the person who would be the
most upset if they were not chosen. It is also
a temptation of many organizations to assign
everyone who wants to work on a task to the
task. The world is full of people who can’t
say no and believe more is better. Sometimes
more isn’t better. Others accomplish tasks
through extreme collaboration and by setting
up a series of committees. If you work hard
enough on anything, you can ruin it and
waste resources. There is so much to be done
that there is no need to be so inefficient. We
try to think about long-term gain as opposed
to short-term gain.
There are too many people to mention who
exemplify the knowledge of this profession.
Just look at the Website, magazine, or brochures.
Not only do people know what they
are doing, but they come from many different
perspectives. They represent the best of the
best: compliance and ethics officers, consultants,
academics, regulators, risk managers,
auditors, certified fraud examiners, outside
lawyers, CEOs, vendors, etc. We have specialists
in ethics, risk, law, compliance, hotlines,
auditing, disclosure, education, etc.
We now have experts from 45 different
industries and 12 countries. Collectively,
these people have a deep understanding of
the profession and all its components. With
the aforementioned diversity of thought
and experience, we minimize group think.
Because we have involvement from many sectors
of this profession, we get a balanced and
realistic look at the practical implementation
of compliance and ethics programs.
Tasks are delegated to a limited number of
experts who get input from others, but they
are not forced to over-engineer everything to
keep people happy. It is difficult for people
on the fringe of our profession to keep things
simple, because they are inexperienced and/
or lost in the details. We delegated tasks to
volunteers who get along, are trusted, avoid
minutia, and pick a date and finish. Sometimes
a project requires attention to minutia
or a hard-charging pit bull. It is not often,
but we make sure we get the hard chargers,
and we back them when the going gets tough.
Our members are experienced. People who
know what they are doing can keep projects
simple and too the point. People who don’t
know what they are doing have to include
everything they can think of in a project.
They do that because they don’t know what’s
really important and can’t sort the wheat from
the chaff. Our volunteers are not theoretical.
Our people want to get it right, but they understand
the practical limitations that we have
to deal with in the real world. Over the last
12 years we have been very fortunate to have
assembled some of the very best compliance
and ethics professionals in the business.
The System
We don’t do it with a committee when a
collaborative and knowledgeable individual
will do. We don’t write a white paper when
a memo will do. Authority, accountability,
and responsibility are often delegated to an
individual or two, and we trust them. Much
more gets done in our system. We get a better
result than others do. A great example of this
is Debbie Troklus, who runs our certification
program. She has a Board, but they
don’t meet just to meet. They don’t meet to
think big things and tell others what to do.
They get the right people together when they
have a specific and a defined task. They hire
experts to guide them, and follow their lead.
If someone decides they know better and they
don’t, we don’t cave in just because they are
powerful, loud, confident, or just to keep the
peace.
Joe Murphy shared an old saying with me
“Don’t let perfection be the hobgoblin of
the good.” That may apply to professional
associations more than any other type of
entity. Many people think that if they can
make something a little better, it should be
changed. Things rarely ever get done on time
with that approach. Some things just fall by
the wayside altogether, because people get
frustrated and tired of the endless additional
ideas and change. Some believe most of the
important work on a project is accomplished
in the first 20% of the effort. The remaining
June 2008
20
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

80% of time is spent perfecting the project,
changing their changes, and it results in
marginal improvement. That time could have
been put to better use. Our people don’t add
things on just because they can think of more
to do. They understand the ultimate mission
and get the task done. They then move on to
another unaccomplished task.
We are clear of purpose. We often have a
single task in mind when we start a project.
In most organizations, when people get
together to work on a specific project, they
see all kinds of other knobs on the dashboard
that could be turned, twisted, or tweaked.
Our leaders keep our volunteers on track and
focused. For example, our conference planning
committee focuses on program content
and leaves the conference management to
the conference managers. They don’t change
the timing of sessions just because they can
think of another way to do it. They don’t
worry about how to register people. Our
leaders focus their activities within their area
of expertise. As a result, the content of our
meetings is second to none.
Sometimes people get involved in projects
and inevitably see something related to the
task at hand but outside their project scope.
They think there is a better way to do it.
Many organizations will go along to get
along, even though what they are suggesting
to change was just changed. Oftentimes there
are many ways to do something. The variation
of benefit between the choices can often
be minimal. A change may result in a better
outcome, but the effort to reengineer something
may not outweigh the time required
to change it. There are lost opportunity costs
too. That time could have been spent getting
something done that had never been done
before. Our volunteers don’t change things
because someone can think of another way
to do it. Our volunteers don’t cave in to
reinventing the wheel to keep the peace. We
get so much more accomplished because we
don’t change our changes, but rather, we use
that time to accomplish new things.
We have meetings with up to 200 speakers.
Our main planning committee is never more
than three people who select track chairs who
are delegated responsibility, authority, and
accountability for selecting speakers within
their track. We also have specific groups
working on specific tasks, such as certification
or the magazine. These groups perform
a function. They don’t get together to think
of things others could do for them. Things
happen between meetings because they stay
focused, develop task lists, and follow up.
Each working group has someone in charge
that can make sure that things are accomplished.
We don’t delegate all the decision
making to the group, but rather to the leader
of the group. Unlike other organizations,
we don’t always have to wait until the next
meeting to make a decision or get approval.
The leader gets feedback from the group and
makes decisions. In other organizations, committees
can’t do anything without everyone
on board. These groups act slowly and often
water down what ever they are working on to
get agreement. They wait until everyone signs
off on it; therefore, things can take forever.
People working in our system have a greater
chance of feeling a sense of accomplishment.
Generally speaking, we delegate to those who
can make a decision and who can get work
done in a reasonable amount of time. We
delegate to those who are collaborative and
can keep it simple. We delegate to those who
can take direction and keep their word. We
are not successful because of an individual
or two. We are successful because of the
incredibly large number of experienced and
knowledgeable people in our organization,
how we assign tasks, and the system we ask
people to work within.
It is harder to do it the easier way. People
sometimes get mad because they can’t decide
things they want to decide, or can’t get
involved in things they want to get involved
in. People get mad because they can’t change
something they want to change. It’s frustrating
not to be involved in everything and
know everything that is going on.
However, we disappoint fewer people in the
long run, because we get more done and the
things get done better. Most importantly, this
system results in growth and that means there
are more opportunities for more people to get
involved. It’s not always true; however, it’s true
a materially significant amount of time. At the
end of the year, we see the significant accomplishments
because of our systems and people.
The results at the end of the year more than
make up for the compromises that are made
along the way. It is significantly more rewarding
than the alternative. As a result, we have an
organization we can all be proud of. n
Contact Us!
www.corporatecompliance.org
info@corporatecompliance.org
Fax: 952/988-0146
SCCE
6500 Barrie Road, Suite 250
Minneapolis, MN 55435
Phone: 888/277-4977
To learn how to place an advertisment
in Compliance & Ethics, contact
Jodi Erickson Hernandez:
e-mail: jodi.ericksonhernandez@
corporatecompliance.org
phone: 888/277-4977
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
21

feature article
Meet Robert T. Morgan, CCEP, CFE
Group Investigations Manager, Financial Integrity Unit, Microsoft Audit Group
& Carol A. Morgan, CCEP, CFE, CPA, CIA, CISA
Vice President, Audit & Risk Management Services, World Vision
Editor’s note: Marlene Robinson, Story
Editor for Ethics and Compliance Magazine,
conducted this interview with Bob and Carol
Morgan. Bob may be contacted by e-mail
at Bobmorg@Microsoft.com or by phone at
425/722-1586. Carol may be contacted by
e-mail at CMorgan@WorldVision.org or by
phone at 253/815-2460.
This month we are offering a special interview
with two highly skilled corporate professionals
who are committed to living out
their deepest values at home and at work.
They share the same beliefs, not only in the
compliance and ethics profession, but in their
roles as husband and wife.
Bob and Carol have been married more than
38 years, have raised two daughters, and are
now enjoying their role as grandparents to two
growing boys. They have moved eleven times and
lived in five states and seven different cities. Each
started in a profession very different from where
they find themselves now. Changes in careers
and unexpected opportunities helped mold the
roles they now hold. It is not so strange that the
choices they made complement not only their
home life, but the workplace as well.
According to a recent study conducted by the
Families and Work Institute it is now necessary
for 78% of married couples to work in
order to maintain the lifestyle that they desire.
MR: Bob, what is Microsoft’s Financial
Integrity Unit (FIU)?
Bob: The FIU is an investigative unit
embedded in the Microsoft Audit Group.
The FIU is one of three entities that compose
the group. Internal Audit and Enterprise
Risk Management are the other two. The
FIU’s mission is to assist Microsoft and the
board of directors in the effective discharge
of their responsibilities over financial integrity
and compliance with Microsoft’s Standards
of Business Conduct and policies.
To accomplish our mission in serving a
multi-national company like Microsoft, the
FIU has professional investigators assigned to
Microsoft offices located in the United States,
Asia, and Europe. Our primary focus is to
prevent, detect and investigate violations of
Microsoft’s Standards of Business Conduct,
but the FIU takes great pride in the contributions
that it makes to the company’s control
and compliance environment by making
recommendations for process improvements
and policy enhancements.
MR: Bob, how was Microsoft’s Financial
Integrity Unit formed?
Bob: In setting the tone at the top,
Microsoft’s executive management recognized
the importance of being a good corporate citizen.
To create an environment of exemplary
corporate governance, Microsoft established
the Office of Legal Compliance in 2002. After
conducting an in depth study, the company
then decided it needed a group of professional
investigators whose sole responsibility
would be to identify and mitigate the risks of
financial fraud and abuse. This was a timely
decision, as you will remember Congress
passed the Sarbanes-Oxley Act during the
summer of 2002. Martin Biegelman was hired
as the FIU’s first director and was immediately
tasked with staffing the FIU with competent
and qualified investigators. A retired U.S.
June 2008
22
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Postal Inspector, Martin looked for and found
people with similar backgrounds in federal
and local law enforcement, forensic accounting
and data analysis. He also placed significant
emphasis on individuals holding professional
certifications, such as the Certified
Public Accountant (CPA) and Certified Fraud
Examiner (CFE). I was the second person
to be hired in December 2002. We now
have eleven investigators located in five cities
around the world and are looking to place
investigators in two more cities.
MR: Why label it an FIU rather than the
more common name, Special Investigation Unit?
Bob: Microsoft wanted to place greater
emphasis on corporate governance, which
entails more than conducting investigations
in the traditional reactive mode. I believe the
name, Financial Integrity Unit, connotes a
broader and more positive meaning to the
approach that Microsoft wishes to convey
to its employees, customers, and partners
about compliance. Because our unit is an
integral part of the Microsoft Audit Group,
it is important that we have a comprehensive
fraud risk management strategy that is
aligned with the company’s business objectives
and organizational structure.
MR: Being a part of a global team of
investigators that detect and prevent fraud in
non-US locations sounds very intriguing and
would probably make a good James Bond
movie. What is your professional background
and how did you get into the fraud and compliance
field?
Bob: After teaching high school physics
and mathematics for four years, I joined the
Philadelphia Police Department for which I
served as a patrolman and detective for six
years. I then became a US postal inspector
and in that capacity held numerous criminal
investigative assignments. My experience as
a postal inspector taught me skills on how
to conduct effective investigations of a wide
variety of white-collar crimes, such as mail
and wire fraud, identity theft, and financial
embezzlement. More importantly, I learned
the necessity of having effective crime prevention
and security programs, which go handin-hand
with identifying, recommending,
and implementing strong internal controls,
process improvements, and well-defined policies.
The US Postal Service is a business and
therefore, has an organizational structure and
strategies like any business. As a result, it was
not too difficult for me to make the transition
from federal law enforcement to Microsoft
and apply those same skills that I learned in
the government to the compliance and investigative
work that I now do in the FIU.
MR: Bob, in your position you supervise
a very diversified group of individuals, not
all are US citizens, and many are of different
nations. Is it difficult to understand the specific
cultures, social mores, and national laws?
Bob: I believe going to work for a company
with a global presence like Microsoft’s
posed the biggest challenge for me. I had
traveled extensively throughout the U.S. as a
postal inspector, but I had never traveled to
Europe, Asia, or Latin America until I joined
Microsoft. Although learning new cultures,
social mores, and foreign national laws has
been a challenge, it has also been the most
interesting and rewarding aspect of my job. I
never in my wildest dreams imagined that I
would visit some of the places where I have
been and meet people with such diverse
backgrounds. I have found that if you treat
everyone with respect and dignity, they will
treat you the same way, regardless of their
ethnic or cultural backgrounds. I must say
that I have learned a great deal from the people
with whom I have worked and believe I
am a much better person for the experience.
MR: Tell us about the role ethics and culture
plays in the operation of your program.
Bob: That is why it is so important to
identify and recruit personnel for the FIU
with cultural backgrounds that are as diverse
and reflective of the countries where the
company does business. I rely on our foreignbased
investigators for advice on how to handle
situations in the countries where they are
assigned, because they know the laws, culture,
and social mores better than I do. Our diverse
team speaks eleven different languages, has
over 200 years of investigative experience, and
nearly everyone on the team possesses at least
one professional certification.
MR: How does the FIU work with
Microsoft’s Ethics and Compliance Program?
Bob: The FIU works hand-in-hand
with the Office of Legal Compliance (OLC),
which reports directly to Microsoft’s General
Counsel and Senior Vice President of Law
and Corporate Affairs. The attorneys
assigned to the OLC provide legal guidance
and counsel for all our investigations in a
very collaborative process. The OLC manages
our external vendor, which receives
and documents complaints and issues that
are submitted to the company’s 24/7 business
conduct line (hotline). The OLC refers
issues to the FIU that fall within our area
of responsibility. We then work with the
OLC to prepare an investigative plan that
will effectively address and resolve the issue.
Management and Human Resources are kept
informed along every step of the investigative
process. When an investigation is concluded,
we work together to identify and correct any
process or control weaknesses that may have
contributed to the problem.
MR: Why do you find the FIU system
better than other departmental anti-fraud
solutions?
Bob: The investigative process may
Continued on page 24
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
23

Meet Robert T. Morgan & Carol A. Morgan ...continued from page 23
June 2008
24
differ from one company or organization
to another. The differences are frequently
based on the nature of the business and
the organizational structure. Microsoft is a
technology company and highly innovative.
We therefore try to use and leverage the
company’s technology in our never-ending
pursuit to be as proactive as possible in our
risk assessment efforts. We have also learned
from other companies and adopted industry
best practices to improve our program. We
periodically meet with our counterparts from
similar and other industries to discuss new
methodologies and emerging risks. These
benchmarking sessions have proven to be
invaluable learning experiences that make us
all better at carrying out our responsibilities
and organizational missions.
MR: Bob, how have the FIU and
Microsoft benefited from its relationship
with SCCE?
Bob: As you know, Odell Guyton,
Microsoft’s Director, Office of Legal
Compliance, is on the board of SCCE.
Odell is responsible for introducing us
to the HCCA [Health Care Compliance
Association] symposiums that he sponsored
at Microsoft, beginning nearly six years
ago. It was through my attendance at these
symposiums that I learned about the seven
principles of an effective compliance program.
When I received the first literature and e-mail
about the SCCE, I recognized the importance
of pursuing the SCCE’s professional
certification designation (CCEP) and how an
ongoing relationship with the SCCE could
vastly improve the expertise of our unit, just
like the benchmarking sessions do with our
industry counterparts. We think so much of
the value that the SCCE has to offer through
the Compliance Academy training I recently
attended, that we are encouraging others of
the FIU to become members of the organization
and pursue the CCEP designation.
MR: Carol, can you tell us about your
position and the mission at World Vision?
Carol: As the Vice President for Audit
and Risk Management Services (ARMS), I
am accountable to the Audit Committee of
the World Vision US Board of Directors for
all aspects of the audit function. Our department
mission is to promote stewardship
of resources through objective, cost effective
assessments designed to add value and
improve operations.
MR: Carol, what is your professional
background and how did you get into the
audit and compliance profession?
Carol: I began my working career
in health care as a laboratory technician
at Holy Redeemer, what was then a small
Catholic hospital in suburban Philadelphia.
After taking a break to spend time with my
children, it became apparent that the field
had exploded with the use of technology. I
recognized that I would have to be retrained
to just catch up with all the innovations that
occurred during my sabbatical. It was then
that I made the decision to change careers
and, with the advice of my husband Bob, I
chose accounting. During my education process
I took my first auditing class and knew I
had found my niche.
I started my auditing career with the
Defense Contract Auditing Agency (DCAA)
in Washington, DC. This expanded my audit
focus to include government compliance. A
move to the West Coast made it necessary
to change direction, so I took a position
in the Internal Audit department at Safeco
Insurance. This blended well with my audit
compliance experience because, as you know,
the insurance industry is highly regulated. I
really missed government auditing, but it was
apparent that federal positions were few and
far between. Instead, I did the next best thing
and went to work for Todd Pacific Shipyards,
a government contractor, as the manager of
the Internal Audit department. Then Sarbanes-Oxley
hit the profession, and I realized
I would need public accounting experience
to stay current. I accepted a position with
McGladrey and Pullen, a CPA firm, where
I expanded my experience to not-for-profit
accounting specific to credit unions. It was
during this time that I received a call from a
former co-worker, whom I worked with at
Safeco, about the opportunity with World
Vision. So here I am. I guess you could say I
was called to work at World Vision.
MR: Carol, when you made your choice
to work for World Vision, what unique
qualities or qualifications did you bring to
this position?
Carol: I think my eclectic background
and varied experiences prepared me for my
role here at Word Vision. Did I mention
I had a decorating business while I was a
stay-at-home mom? Bob’s work and job in
the government necessitated frequent moves,
eleven in all, that strengthened my project
management and decision-making abilities.
I got to the point where I could sell our
existing property and choose a new home
all within the span of four weeks. Meeting
new people during these relocations helped
sharpen my listening skills, and that is what
an auditor does best, listens. I believe I cope
well with stress because at a young age, as a
laboratory technician, I worked in the blood
bank. Talk about stressful situations! One
wrong action and a real live person could be
irreparably harmed. That is not to say I do
not become impatient or anguish about outcomes.
It just means I believe I do a good job
of putting a situation into perspective. Also,
it was a very easy transition from safeguarding
the taxpayer dollar as a government auditor
to championing the needs of the poor
through the stewardship of donated funds.
Continued on page 26
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Want to become certified in
Compliance & Ethics?
Earn your Certified
Compliance & Ethics
Professional (CCEP)
certification today,
and be recognized for
your experience and
knowledge.
www.corporatecompliance.org
The Society of Corporate Compliance and
Ethics (SCCE) offers you the opportunity to
take the Certified Compliance and Ethics
Professional (CCEP) certification exam.
The CCEP gives individuals from all industries
the platform to demonstrate their knowledge
and expertise in compliance and ethics.
In the U.S., the exam is available at an H&R
Block near you. The exam is also available in
more than 30 countries.
CCEP Certification
Benefits
• Demonstrate professional standards and
status for compliance professionals
• Heighten the credibility of compliance
practitioners and enhance the credibility
of compliance programs staffed by these
certified professionals
• Ensure that each certified practitioner has
the knowledge base necessary to perform
the compliance function
• Facilitate communication with other
industry professionals, such as government
officials and attorneys
• Demonstrate the hard work and dedication
necessary in the compliance field
qUALIFICATIONS
See the CCEP Candidate Handbook at
www.corporatecompliance.org/handbook
Cost: $250 for SCCE members
$350 for non-members
Credits Required: 20
You may obtain all twenty credits by:
• attending SCCE-sponsored conferences
• speaking at conferences regarding
compliance and ethics
• attending conferences, seminars, or
workshops sponsored by other companies
(please fill out an Individual Accreditation
Application for each)
TAKING THE EXAM
There are several opportunities to
take the CCEP exam:
• At SCCE’s Compliance and Ethics Institute,
SCCE’s Academies, or SCCE’s Regional
Conferences
• At an H & R Block near you:
visit www.goAMP.com to register
• In more than 30 countries: visit
www.corporatecompliance.org/CCEP
for more information
Questions?
Please contact SCCE via phone at
+1 952 933 4977 or 888 277 4977
or e-mail info@corporatecompliance.org
Or visit our Web site:
www.corporatecompliance.org/CCEP
Society of Corporate
Compliance & Ethics
6500 Barrie Road, Suite 250
Minneapolis, MN 55435, United States
www.corporatecompliance.org
“We sought the assistance of a
professional certification consulting firm,
Applied Measurement Professionals,
for the development of this certification.
Many experienced compliance and
ethics professionals were involved in
the 18-month process. We had more
than 100 people sit for the first exam. I
couldn’t be more pleased with the effort
and response. This is a big step in the
maturation process for the compliance
and ethics profession.”
— Roy Snell, CEO, SCCE
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
25

Meet Robert T. Morgan & Carol A. Morgan ...continued from page 24
June 2008
26
MR: World Vision has been very successful
in building a better world for children.
Can you tell us more about their program?
Carol: World Vision is a Christian
humanitarian organization dedicated to
working with children, families, and their
communities in nearly 100 countries around
the world, to reach their full potential by
tackling the causes of poverty and injustice.
Citizens in the United States have helped
to sponsor more than 920,000 children by
giving them access to critical resources, such
as clean water, better nutrition, health care,
education, and economic opportunities. In
fiscal year 2007, we raised more than $957
million. These funds were used to drill 194
water wells in Nigeria, Mali, and Ghana
alone, respond to 85 humanitarian emergencies,
and assist an estimated 7 million disaster
survivors. We moved more than 147,000
metric tons of food donated by the United
States government and World Food Program
equaling 4,900 semi truckloads of freight.
Together with churches and businesses, we
facilitated the assembly of 70,000 caregiver
kits for use by volunteers in Africa to care
for the needs of people affected by HIV and
AIDS. We have made more than $355 million
in small micro-enterprise loans with a
repayment rate of 98%. To achieve all this,
we partner with more than 12,000 churches
and work with more than 7,200 volunteers.
In our advocacy efforts, we have coauthored
the Child Soldier Act, which
limits assistance to countries using children
in armed conflict, and stressed the importance
for Congress to extend the President’s
Emergency Plan for AIDS Relief. Last year
we began a tour of more than 80 churches
with the “World Vision Experience AIDS,”
interactive exhibit, which gives visitors a reallife
look into the lives of children and AIDSaffected
communities.
World Vision does not just stop with relief
work. We know that by helping to build resilience
and self-sustainability, we are equipping
communities to handle disasters themselves,
meaning reduced long-term impact and fewer
lost lives.
MR: World Vision has six core values that
are central to its identity. How do these affect
your work in Audit and Risk Management
Services?
Carol: Where other organizations have
codes of conduct or ethics, World Vision has
a statement of core values. These basic values
guide our behavior and require us to demonstrate
we are Christian, we are committed to
the poor, we value people, we are stewards,
we are partners, and we are responsive. As an
individual and an employee of World Vision,
I am responsible to uphold the core values,
honor them in my decision-making, express
them in my relationships, and put them into
practice consistently in my work ethos.
MR: It must make you feel good to know
that you are working for an organization that
has such a strong purpose and truly makes
a difference in so many lives each day. But,
I can also see that your position as Vice
President of Audit and Risk Management
Services could be a very important job,
because you have to ensure that proper values
are enforced and justice is served to accomplish
their mission. How do you see the
Audit department supporting an ethics and
compliance program?
Carol: I am humbled by the passion
and dedication displayed by my colleagues.
They work directly with donors and the poor
we are committed to serving. Although Audit
does not always have the opportunity to participate
in these invaluable relationships, our
role is truly considered by the organization
as a value-added effort. Just as a for-profit
businesses are heavily regulated, so too is the
world of fundraising. World Vision is a taxexempt
organization under Section 501(c)
(3) of the US Internal Revenue Code. This
may limit our compliance with Sarbanes-
Oxley, but because we receive government
grants, we are bound to comply with the
Office of Management and Budget (OMB)
Circular regulations. Add to that the fact that
each state has specific regulations relevant to
conducting fundraising activities within their
borders, and your compliance burden has just
become heavier. Because we are a faith-based
organization and also work with children, we
have elected to abide by governing bodies,
such as the Evangelical Council for Financial
Accountability (ECFA), which sets standards
for fund-raising practices, and InterAction,
a coalition of non-government organizations
(NGOs) that self-review and evaluate controls
over the protection of children and the most
vulnerable populations. We also receive large
qualities of surplus goods from manufacturers
and pharmaceutical companies. These items
must be valued and recorded in a consistent
and reasonable manner. Consequently,
we add another level of compliance with
the Association of Evangelical Relief and
Development Organizations (AERDO) to
guide practices for organizations handling
gifts-in-kind. As we perform each audit effort,
we look to these standards as benchmarks and
educational opportunities.
MR: Sharing the fruits of your labors,
both of you attended SCCE Academies and
received your CCEPs this past year. What
influenced your decision to take time out
of your already busy schedules to attend an
academy and to become CCEP certified?
Carol: In November 2007, language
was added to the Federal Acquisition
Regulations (FAR) requiring contractors
(those receiving federal funds under government
contacts) to have in place a formal
compliance program. It has been my past
observations that whatever is added to the
FAR filters down to the OMB Circular in
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

some form. I wanted to be prepared with
information from an authority source on
what a formal program looks like. I also
believe it is a sign of commitment to excellence
for an individual to seek certification
in a body of knowledge to be accepted as
a technical expert. I believe World Vision
has all the building blocks. We just need to
pull them all together. It is very much like a
jigsaw puzzle with the straight outer edges in
place. We hope to fill in the middle gaps over
the next year using the tools provided at the
SCCE Academy.
Bob: I agree with Carol that pursuing
professional certifications relevant to your
field of expertise is part of being a consummate
professional. Professionals should possess
a commitment to excellence in order
to be recognized as a subject matter expert.
Attending the SCCE Compliance Academy
this year was a very good decision for me personally
and professionally.
MR: Do you think it was time well spent?
What are your expectations and goals now
that you are certified, and what benefits do
you think you have gained from this experience?
How do you think that being certified
will enhance your personal and professional
growth?
Carol: I truly believe that the time I
spent at the academy was very beneficial. It
provided a networking forum that cut across
business lines and time zones. I intend to keep
in contact with many of the other attendees
whom I was fortunate to meet and exchange
ideas with during our short week together. As
I delve into this process, I am sure attendance
at additional conferences will be required
to reinforce what I initially learned. As to
attaining the certification, I believe education
should be a constant in everyone’s life
and completion of a certification requirement
strengthens this commitment.
Bob: Attending the SCCE Compliance
Academy this year was time well spent and
very worthwhile. It was the most relevant
training that I have taken so far, relating to
what I do on a daily basis at Microsoft. The
training set forth in simple and understandable
terms what constitutes an effective compliance
program for any organization. A bonus
for attending the academy was being able to
meet and network with the other compliance
practitioners who deal with the same issues
that I do. I look forward to maintaining the
contacts that I made at the academy, as well
as attending future conferences to sustain my
personal and professional growth.
MR: Why did you become involved with
SCCE and have you worked with other associations
in ethics and compliance?
Carol: Because I hold the Certified
Fraud Examiners (CFE) certification, I was
in attendance at the Association of Certified
Fraud Examiners conference in July 2007,
and it was there that I first became aware of
your organization. This coincided with an
individual goal to begin to look at compliance
at a more detailed level within World
Vision. I stopped by the exhibit booth and
requested information to be sent to my
home. What a surprise when Bob opened the
envelope because he thought it was for him.
We were both on the same journey, unaware
that each of us had targeted the same goal.
Did I mention that Bob also holds the CFE
designation as well?
Bob: SCCE complements my membership
and participation in the Association of
Certified Fraud Examiners (ACFE). I joined
the SCCE and pursued the CCEP designation
to expand my knowledge of the corporate
compliance discipline. I have also learned
and expanded my knowledge by being able
to meet and speak with others who have a
common interest and mutual concerns in this
discipline.
MR: As SCCE continues to grow, we
want to add more membership benefits.
What do you think would be an additional
benefit that SCCE could add?
Carol: I would like to see a more extensive
library of source references. It would also
be great to begin to have self-study guides or
Web-based training events.
Bob: I agree with Carol. I would like to
see some Web-based training and a library
of resource material. You might also want to
consider posting a job bank for resumes and
a blog for communicating and exchanging
ideas on compliance issues of mutual concern.
[Editor’s note: Job postings are available
on our Web site. Click on “Careers” on the
far right side of the top menu bar on the
home page.]
MR: What are the biggest compliance
risks that your organization faces today?
Carol: Our core activities around
fundraising will always carry a compliance
burden. As compliance requirements increase,
the cost to meet these requirements escalates.
This develops a decision tension between
meeting a compliance need that will most
likely reduce the amount of resources we can
forward to the field in our continuing efforts
to reach our mission goals. In addition, the
added cost to meet these compliance requirements
may increase our overhead rate that is
viewed by many members of the public as an
unnecessary burden.
Bob: My biggest concern is the possibility
that we are not receiving all the compliance
and ethics issues that we should, because
employees are reluctant to report them.
There are many reasons for this, some of
which may be cultural, because Microsoft is a
multi-national company with offices in over a
100 countries where reporting issues may not
be culturally acceptable or may even violate
local laws. According to research conducted
Continued on page 30
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
27

Your Compliance and Ethics
C o n n e c t i o n
SCCE is the premier provider
of compliance & ethics
education and certification
Join Us Today!
Connect with an organization
dedicated to improving
the quality of corporate
governance, compliance,
and ethics
www.corporatecompliance.org
info@corporatecompliance.org
+1 952 933 4977 or 888 277 4977

SCCE Membership Application | Fax to +1 952 988 0146
Please print:
Mr. Ms. Dr. Other
First Name MI Last Name
Credentials
Title(s)
Organization
Street Address
City State Zip Country
Telephone
Fax
E-mail Address
What year did you start in the compliance and ethics field?
What is your industry?
How did you hear about SCCE? Booth at meeting Magazine ad Colleague Mailing Conference brochure Other
(If you check “Other,” please list on the line above the publication, meeting, or colleague name)
What is your primary function? Please check only one. (If you check “Other,” please list above)
Privacy
Auditing
Investigations
Banking
Fraud examiners
HR
Legal
Risk management
IT
Education
Environmental
Safety
SOX
Security
Corporate secretary
Other (please list above)
YES, p l e a s e a c c e p t m y a p p l i c at i o n f o r m e m b e r s h i p:
Individual Membership ...............$295
Group Employee Membership .........$250
(four or more from same company: fill out one form for each applicant)
Corporate Membership ..............$2,500
(includes four individual memberships plus corporate publicity benefits)
Student Membership .................$150
(full- or part-time students enrolled in a program related to compliance
that leads to a baccalaureate degree, or a graduate student who is not
employed in a full-time compliance position)
Academic Membership ...............$150
(must be a full-time faculty member working for a college or university)
Total Enclosed $
Society of Corporate Compliance & Ethics
6500 Barrie Road, Suite 250
Minneapolis, MN 55435, United States
+1 952 933 4977 or 888 277 4977 • Fax +1 952 988 0146
www.corporatecompliance.org
Check enclosed (payable to SCCE)
Invoice me Purchase Order #
Charge my Credit Card: MasterCard Visa AmEx
Credit Card Number
Exp. Date
Name of Cardholder
Signature of Cardholder
Federal Tax Identification Number 23-2882664
FAX OR MAIL TO:
Society of Corporate Compliance and Ethics
6500 Barrie Road, Suite 250, Minneapolis, MN 55435, United States
Fax +1 952 988 0146
June 2008
29

Meet Robert T. Morgan & Carol A. Morgan ...continued from page 27
by the Compliance and Ethics Leadership
Council in 2007, the number one indicator
for misconduct in organizations is a culture
of retaliation and discomfort of employees to
speak up. Employees must have the ability to
report unethical behavior or practices without
fear of retaliation. Although Microsoft
embraces openness and honesty as two of its
core values and has a strong anti-retaliation
policy, I believe it is only normal human
nature that makes employees reluctant to
seek advice about ethical dilemmas or challenge
current practices.
MR: What compliance issues are you seeing
with global companies who operate in
different countries?
Carol: This is a real issue for organizations
working in countries where laws and
cultures are so different than those here in
the U.S. For examples, we just need to look
at the difficulties with the implementation of
a hotline reporting mechanism or compliance
with the US Patriot Act. All these compliance
frameworks are US driven and are not welcomed
in some foreign countries. It is important
to be in tune with your legal department
and to work within your sphere of influence.
It is important to find that common thread
that unites our government-imposed requirements
with non-US counterparts.
Bob: In addition to compliance with the
Patriot Act that Carol mentioned, I believe
multi-national companies need to provide
training and establish controls to prevent violations
of the Foreign Corrupt Practices Act
(FCPA). Violations of the FCPA could have
far-reaching repercussions, such as loss of
reputation, fines, and other severe penalties
like disbarment from government contracts.
MR: How is the compliance profession
changing, and how do you see it changing in
the future?
Carol: It is evident that the internal
audit function of the future will move
from an internal control focus to an enterprise
risk-management centric framework.
Compliance is a critical building block of
this framework. I tend to be an early adopter.
Consequently, I will be molding our audit
team with an eye to this future.
Bob: Effective risk assessment is a
fundamental ingredient to any compliance
program. More training in this area will be
required to make compliance professionals
more proficient in this skill.
MR: Clearly, couples must learn to adjust
when you both have high powered jobs and
very busy travel and work schedules. There
has been a definite shift in the workplace and
home. Many of our readers are in the same
situation. Can you tell us if you have found
a workable solution to managing your career,
family, friends, stress, and relaxation? Do you
have special hobbies? Is there anything that
you think would be helpful to other corporate
professionals?
Carol: Work-life balance is tricky for
everyone today. There are times when it cannot
be helped where travel will interfere with
that special day or planned event. We do try
to minimize this whenever possible. However,
for this to work, not only do mom and dad
need to be in tune, but the rest of family has
to contribute grace and understanding as
well. Our daughters were almost always quick
to understand. However, there are always
those little sacrifices we all must make, but
until now, I think we have weathered this
rather well. It does help that both Bob and I
have a good understanding of our work-related
responsibilities. Having a common focus
removes that pain-point misconception that
work is more important than family. Most
important, we have come to understand our
limitations as to time and talent.
As to hobbies, I tend to like a bit of quiet
time where Bob needs his exercise routine.
Outside of this, we tend to do most things
together and oftentimes include the rest of
the family. And now that we are empty nesters,
we have discussed beginning to make
time to golf together.
Bob: We all know there is a delicate balance
between satisfying the commitments of
work and home. I am fortunate that I have
enjoyed a wife and two daughters who always
supported me throughout my career. Their
understanding and consideration made it
easier for me to do my job, especially during
extremely sensitive and critical criminal investigations
that took me from home for considerable
periods of time as a federal agent.
That is why it is most important that the
time that you do spend with your family is
quality time that everyone will remember. It’s
all about making fond “memories” which we
are now trying to do with our grandchildren.
As for my personal time, I enjoy exercising at
the gym and working around the house.
MR: From the tone-at-the-top to the tone
at home, how do you keep a healthy balance
in your daily lives?
Carol: I like to stay connected to our
daughters and their families. I do try to
carve out some time on the weekend to be
with them. A rule hard learned is not to take
on more than you can manage. There is no
shame in realizing you should not be spreading
the peanut butter too thin.
Bob: I try to keep the weekends free so
I can devote time to my family and personal
commitments. I use the time to unwind,
exercise, and be with my daughters and their
families. Carol and I have had this common
goal forever, and it seems to have worked well
for keeping our peace of mind and family
harmony. n
June 2008
30
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Society of Corporate Compliance and Ethics
Compliance & Ethics Magazine Advertising Order Form
Compliance & Ethics Magazine
The Society of Corporate Compliance and
Ethics (SCCE) publishes Compliance &
Ethics Magazine bimonthly. SCCE is an
organization dedicated to enhancing the role
of compliance professionals and advancing
corporate governance,
compliance, and ethics.
Purpose
Compliance & Ethics
Magazine provides current
compliance regulations,
topics, and issues that
affect today’s compliance
industry.
Professionals in the
compliance field are attracted to Compliance & Ethics Magazine
because it is the ultimate source of compliance and ethics
information, providing organizations with the most current views
on the corporate regulatory environment. National and global
experts provide informative articles, sharing their knowledge and
providing professional support so readers can make informed legal
and cultural corporate decisions.
Please fill out the following information for your advertisement:
Name of Company Placing Advertisement
Dates of Insertion (please check all insertions on the line below):
AD DEADLINES 45 days before publication date
publication dates
February
April
Size of Advertisement (please check one):
Full-page: trim size 8.5" x 11" (include additional ⅛" bleed)
½ page horizontal: 7" wide x 4.5" high (no bleed)
½ page vertical: 3.5" wide x 9.5" high (no bleed)
¼ page: 4.625" wide x 3.5" high (no bleed)
*Note: all ads are black-and-white except for cover ads, which are full-color.
If purchasing a color cover, please check below:
Inside front cover Back cover Inside back cover
Full-Page Black-&-White Ad
Cost Per Insertion
1-2 insertions………$605.00
3-4 insertions………$490.00
5-6 insertions………$405.00
½ Page Black & White Ad
Cost Per Insertion
1-2 insertions ……..$420.00
3-4 insertions ……..$355.00
5-6 insertions ……..$305.00
June
August
Compliance & Ethics Ad Prices
October
December
¼ Page Black & White Ad
Cost per insertion
1-2 insertions…… $250.00
3-4 insertions…… $225.00
5-6 insertions…… $215.00
Full-Page Full-Color Ad:
Cost Per Insertion
1 insertion …………$1,150
3 insertions……….. $1,050
Audience Profile
Compliance & Ethics Magazine has grown to become one of the leading
publications for compliance professionals. Compliance & Ethics Magazine
has a current distribution of over 2,500 readers and is distributed at
all SCCE conferences, academies, and workshops. Recipients of this
national magazine are executives and others responsible for compliance:
chief compliance officers, risk/ethics officers, corporate CEOs and board
members, chief financial officers, auditors, controllers, legal executives,
general counsel, corporate secretaries, government agencies, and
entrepreneurs in various industries.
Why Advertise With SCCE?
The wealth of news and resources provided by SCCE attracts
a desirable business market of compliance professionals. We
believe public relations are a great way to build your business, and
Compliance & Ethics Magazine offers you the opportunity to create
awareness and access a targeted audience.
Rapid Growth
SCCE has grown significantly over the past 5 years, and we look
forward to continuing our expansion with your support.
visit www.corporatecompliance.org/CE
for a rate sheet and insertion order form
Contact Person:
First Name M.I. Last Name
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
Title
Place of Employment
Address
City State Zip
Phone
Fax
E-mail
Total Cost
Check enclosed (please make your check payable to SCCE).
Invoice me PO #
Charge my credit card: Visa MasterCard AmEx
Account No.
Exp. Date
Name on Card
Signature
Fax to: +1 952 988 0146 (ATTN: Marlene Robinson)
Mail to: SCCE | 6500 Barrie Road, Suite 250 | Minneapolis, MN 55435, USA
June 2008
31

Federal agency compliance:
Applying corporate lessons
in government settings
By Emil Moschella, Attorney-at-Law
Editor’s Note: Emil Moschella has more than
28 years of experience as an FBI agent-attorney.
He retired in 1996 as Chief of the General
Counsel’s Legal Advice and Training Section. In
1997 he became Director of Corporate Compliance
for Horizon Blue Cross Blue Shield of New
Jersey. He is currently assisting the FBI in the
implementation of its compliance program. He
may be reached at emoschella@gmail.com.
In March 2007, the Department of
Justice (DOJ), Office of Inspector
General (OIG) issued a highly critical
report regarding the Federal Bureau of
Investigation’s (FBI) use of “National Security
Letters (NSL).” This resulted in congressional
oversight committee hearings 1 and numerous
editorials critical of the FBI and calling for
change. 2 The FBI moved quickly to fix the
problems identified by the OIG, and was
properly lauded for that effort in a March 26,
2008 Washington Post editorial. 3 However,
the larger story is still unfolding. FBI
Director Robert S. Mueller, III authorized
the adoption of corporate-style compliance
program to prevent similar shortfalls from
occurring in the future.
The corporate rationale
Corporations have adopted the discipline of
the integrity and compliance program methodology
for a number of reasons. For many
companies, it is the prudent thing to do,
because it is effectively required by a number
of federal enactments. The 1991 Federal
Sentencing Guidelines for Organizations
(FSG), various guidance issued by regulators,
and specific legal requirements (Health
Insurance Portability and Accountability Act
in the medical area, Bank Secrecy Act in the
financial area, Sarbanes Oxley for all publicly
traded corporations). In 1986, a substantial
number of major defense contractors, in
response to a series of prosecutions and other
reported irregularities, established the Defense
Industry Initiative on Business Ethics and
Conduct. In doing so, they agreed to have a
written code of ethics, establish appropriate
ethics training programs for their employees,
establish monitoring mechanisms to detect
improper activity, share their best practices,
and be accountable to the public. This organization
remains viable to this day.
In January, 2003 Deputy Attorney General
Larry Thompson issued a memorandum
to all United States Attorneys captioned
“Principles of Federal Prosecution of Business
Organizations.” 4 In what is now known as the
Thompson Memorandum, he stated that one
of the factors to be considered in determining
whether to bring federal criminal charges
against an organization and negotiate a plea
agreement is “the existence and adequacy of
the corporation’s compliance program.” 5
Having a corporate compliance program
became a matter of the corporate director’s
duty of care. In December, 1996, the
Delaware Chancery Court, In re Caremark
International Inc. Derivative Litigation 6
identified a type of directorial behavior that
would breach the fiduciary duty of care. The
court in dicta 7 stated: “I am of the view that
a director’s obligation includes a duty to attempt
in good faith to assure that a corporate
information and reporting system, which the
board concludes is adequate, exists, and that
Emil Moschella
failure to do so under some circumstances
may … render a director liable for losses
caused by non-compliance with applicable
legal standards.” The ruling created a fiduciary
obligation to assure that a legal compliance
mechanism existed within the organization.
The FSG, as amended in November 2004,
anticipated the full involvement of the governing
body by requiring it to be “knowledgeable
about the content and operation of
the compliance and ethics program” and to
exercise reasonable oversight with respect to
the implementation and effectiveness of the
compliance and ethics program. 8
This has been an evolutionary process, but it
seems to be the case that corporate ethics and
compliance programs are well entrenched in
the way that modern corporations operate.
The question presented here is, “Should
government agencies also establish formalized
programs that are geared to prevent
and detect agency non-compliance with
laws, regulations, policies, directives, orders,
memoranda of understanding, and similar
requirements?”
The federal agency rationale
The FBI has as strong tradition of personal
and institutional integrity and those concepts
Continued on page 34
June 2008
32
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Earning your certification,
keeping your certification current,
and applying for advanced
certification just got easier!
Beginning with this issue, SCCE will offer continuing education credits
(CEUs) for completing the quiz that accompanies selected articles
in Compliance & Ethics. Receive one (1) CEU for each quiz* you
successfully complete. You could receive up to six (6) CEUs per year.
To apply for credit: read the articles
and answer the questions on the insert
in the envelope with this magazine.
Fax your answer form to us at 952/988-0146
or mail it to us at:
Society of Corporate Compliance & Ethics
Attn: Liz Hergert
6500 Barrie Road, Suite 250
Minneapolis, MN 55435
* The quiz is inserted in the envelope with
this issue of Compliance & Ethics
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
33

Federal agency compliance: ...continued from page 32
are part of the FBI value system and imbedded
in its motto of Fidelity, Bravery, and
Integrity. In addition, the FBI leadership is
constantly aware that it walks the fine line of
protecting the country from the next terrorist
attack and protecting the individual rights of
the very citizens it is guarding. It is with this
organizational cultural background that the
FBI decided to adopt the corporate compliance
methodology in the face of the systemic
failure. The larger question presented here
is, “What should be the impetus for other
agencies of government, to adopt a similar
methodology?”
Unlike many corporate codes of business
conduct, I have found no positively stated
government-wide policy to comply with the
letter and spirit of the law. But, it can be
found, at least inferentially, in the federal
employee oath of office. Federal employees
take an oath on commencement of service
to “well and faithfully discharge the duties of
the office” they are entering and to support
and defend the Constitution of the United
States. 9 Especially in a country that rightfully
takes enormous pride in being governed by
law and not by men, if the oath means anything,
it certainly has to mean that the duties
of the office are discharged in compliance
with law.
Accepting that premise, it seems that it would
give rise to an obligation to the American
people and to reciprocal obligations between
the government as an employer and the
government employee. The first obligation
is that government executives, as custodians
and defenders of the public trust, have an
affirmative responsibility to assure the American
people that the agencies responsible for
enforcing the law are doing that in compliance
with the law. To carry out that obligation,
the government as the employer has the
job of ensuring that personnel responsible
for discharging the law governing the agency
have been given appropriate guidance, usually
in the form of policy, have been trained, and
are appropriately monitored (See below: the
Compliance Control Environment). On the
other hand, government employees must
know the rules that guide their official activities,
act in accordance with the rules, and
report to their supervisors on perceived weaknesses
in the policies, training, or monitoring.
The compliance control environment
A compliance program’s aspirational goal
is to prevent non-compliance with the law.
Compliance is a management process that
provides a reasonable level of assurance to
line managers, executives, and those charged
with oversight responsibility (including the
Congress and the American people) that
there is compliance with the rules. Invariably,
when going through this process (i.e., risk
analysis, receiving information directly from
employees, etc.), actual non-compliance with
the rules may be detected and of course will
have to be addressed promptly. Compliance
and integrity go hand in hand. Compliance is
a business process. Integrity represents an institutional
commitment to a set of values, and
in this context, the values are stated in terms
of honoring the rule of law through a commitment
to compliance with the law. For ease
of discussion, the term “Compliance Control
Environment” is used throughout this article
to describe the policies and procedures, training,
monitoring, and auditing that define
how an organization controls its business to
affect compliance with the law.
Other compliance program elements
For corporations, in addition to a well conceived
and executed compliance control environment,
due diligence in preventing and
detecting violations of law includes:
n high level buy-in into the compliance
program;
n boards of directors being knowledgeable
about the compliance processes in place
and monitoring those;
n training appropriate personnel, including
the board;
n systematic risk assessment;
n promotion of the compliance program
through human resource policies that
are consistently enforced throughout the
organization;
n anonymous and confidential reporting of
compliance concerns; and
n monitoring and auditing.
“Compliance is the business of the
business”
Corporate compliance programs operate on
the underlying premise that “Compliance
is the business of business.” In essence, this
means that the business units, in addition
to managing other internal risks, including
operational efficiency and effectiveness and
all-around profitability, are also accountable
for the risks associated with non-compliance
with legal and regulatory requirements.
Under the corporate compliance paradigm,
federal program managers would be required
to identify potential compliance risks evident
from weaknesses in the compliance control
environment before actual non-compliant
behavior is detected.
Oversight mechanisms are not enough
Government agencies are under tremendous
scrutiny from the oversight community,
including agency inspector generals, internal
auditors, the Government Accounting Office
(GAO), congressional staffs, and committees.
The press, public policy groups, the general
public, and their access to government
records through the Freedom of Information
Act provide another layer of oversight. This
oversight is absolutely necessary, but it is not
enough, because it represents only one piece
Continued on page 36
June 2008
34
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

2300 lawyers in 30 locations. www.jonesday.com

Federal agency compliance: ...continued from page 34
of the compliance control environment - the
audit function. The question that an adverse
audit result should raise, in addition to “Here
is a problem – fix it,” is: “What else is out
there?” A viable compliance program will
be instrumental in answering that question.
Indeed, much oversight is issue-specific. In
addition to addressing specific issues, oversight
might be effectively directed to testing
the processes and procedures that an agency
has, to provide a level of confidence that the
agency is carrying out its responsibilities in
compliance with the law.
An agency compliance program does not wait
for the internal audit, inspector general, or a
congressional committee action to identify
and address issues. It is a process driven by
an ongoing analysis of the risk of non-compliance
that is prioritized on the basis of the
impact and probability of non-compliance.
In its simplest form, the current state of
traditional agency oversight is “quality
control” which comes at the end of the
business process cycle. In effect, a compliance
program would close the circle that
was started with the creation of the inspector
general corps more than 30 years ago. A
compliance program would further enhance
agency awareness of weaknesses in their
compliance control environment, so that they
can address compliance issues while they are
inchoate. The compliance control environment
represents the first line of defense
against non-compliant activities. This process
will not assure perfection from a compliance
standpoint. In fact, perfection is not expected
under the FSG 10 where it is stated that “the
failure to prevent or detect the instant offense
does not necessarily mean that the program
is not generally effective in preventing and
detecting criminal conduct.”
The starting point for this proposal is not that
the government is in a runaway mode from a
legal compliance standpoint or that government
employees are intentionally violating
the law. 11 In fact, the proposal is premised on
proposition that a corporate-style compliance
programs will work well in the government,
because they will fully leverage the integrity
and desire of the agency officials and
individual employees to do the right thing.
The focus of ethics and compliance programs
is not on employee personal conduct, but on
the agency business processes controlling legal
compliance.
This process does not present short term
fixes. It is long term. It looks to the causes of
non-compliance and not the effects. It looks
to management processes and not individual
short-comings. It looks to cease reliance on
the inspection process and to achieve quality
by building quality into the process in the
first place. It is a process of constant improvement.
Benefits of a corporate-style
compliance program
The benefits of a corporate styled compliance
program for the government agency are that:
n It will demonstrate to agency constituencies
(i.e., the public and established
oversight mechanisms) a concrete process
by which its commitment to the execution
of the law in compliance with the law is
carried out in a holistic, structured, and
disciplined way.
n It will demonstrate that the agency, in a
collaborative but structured framework,
will help employees fulfill their oath to
faithfully discharge their duties.
n It will help agencies detect internal management
control weaknesses.
n It will give life to agency values of individual
and organizational integrity.
n It will allow agencies to solve issues across
functional lines and in the process gain
effectiveness and efficiency of operations.
n It will be cost effective by creating streamlined
process that will get the job done
right the first time and avoid the costly
fixes.
Initial steps
In order to achieve a reasonable assurance
that the agency has done what it can to provide
for a robust system of internal controls
to achieve legal compliance, it should take
the following steps:
n Require agency executives who are responsible
for the operations and activities of
the agency to identify and resolve weaknesses
in the compliance control environment
(i.e., the policies, employee training,
and monitoring that guide employees in
their day-to-day activities) and to work
in a methodical and disciplined way to
address those weaknesses.
n Executives will need to actively solicit
information from employees at all levels,
in an environment of confidentiality/anonymity
(if requested), and always backed
by a non-reprisal policy, rather than waiting
for the “whistleblower.”
n Establish a code of conduct that includes
compliance with all legal/policy requirements.
The Office of Government Ethics
regulations state 12 that public service is
a public trust and that: “Each employee
has a responsibility to the United States
Government and its citizens to place
loyalty to the Constitution, laws and
ethical principles above private gain.” This
is an extremely important concept, but it
addresses only personal financial conflicts.
There must be an institutional commitment
to carrying out agency business in
compliance with the law that goes beyond
addressing personal conflicts of interest.
n Establish high-level buy-in and active support
by agency executives. As mentioned
Continued on page 38
June 2008
36
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Register online at www.corporatecompliance.org
Compliance Audio/Web conferences from SCCE
Tone At The Middle – June 10
Speakers:
Jeffrey Kaplan, Partner, Kaplan & Walker LLP
Cherie Raven, Manager Corporate Compliance
Programs, ITT
In many ways, mid-level managers are on the “front lines” of
their companies’ compliance and ethics challenges. This Web
conference will explore practical measures that organizations
can take – through training/communications, auditing and
monitoring, performance evaluations, and other steps – to
promote the right “tone at the middle.”
All conferences begin at 12:00 pm Central
for 90 minutes and qualify for 1.2 CEUs
Also upcoming:
Foreign Corrupt Practices Act
Part II (fall 2008)
Past Web/Audio Conferences
n Compliance Week - April 25, 2008
n Law & Compliance: State and Local Government Compliance
& Ethics Programs - March 05, 2008
n Lessons Learned from the Student Financial Aid Scandals:
Where Do We Go from Here? - January 29, 2008
n New Rules for Federal Contractors: How to Develop an
Ethics and Compliance Program - January 10, 2008
n Human Resources Compliance - December 06, 2007
n Code of Ethics - November 16, 2007
n CCA vs. CIA - November 15, 2007
CDs are available at www.corporatecompliance.org
Leading Integrity: Is Your
Compliance and Ethics
Function Positioned for
Success? 2 part series Part 1: June 5 –
Part 2: June 24
Speakers:
Joe Murphy, CCEP, Of Counsel, Compliance
Systems Legal Group, Co‐Editor, ethikos
Donna Boehme, Principal, Compliance Strategists,
LLC Special Advisor, Compliance Systems Legal Group
Next to strong management commitment, the positioning
of the compliance and ethics function is probably the
single most critical barometer of whether a program will
ultimately achieve its twin goals of driving an ethical culture
and detecting/ preventing wrongdoing. This is because
you can have all the bells and whistles of a “best practice”
program, but if the people responsible for its day-to-day
operation and oversight are not empowered to effectively
“drive the car”, it won’t make it out of the garage. Is your
compliance and ethics team empowered, with clearly
defined rule and mandate, and positioned for success? If
not, what are the strategies for making this happen within
your company?
June 2008
37

Federal agency compliance: ...continued from page 36
above, the FSG requires both board level
and high-executive level involvement in
this process. Similarly, the spirit of this
concept must be carried through in the
federal agency.
n Adopt the underlying philosophy that
“Compliance is the business of the business.”
Although a “Compliance Office”
with a compliance officer who has the
mission of being the facilitator, compliance
program standard-setter, and overall
compliance program advisor and monitor
must be established, the responsibility for
compliance must remain with the business
units that own the governmental activity.
Who better knows where the weaknesses
are in the compliance control environment,
if any, than the personnel who are
performing the functions on a daily basis?
n Recognize that the program must be risk
driven. Whether you are operating in a
corporate or governmental arena, funding
and personnel resources are not unlimited.
Therefore, there must be an analysis of
agency activities, prioritization of the risks,
review of the compliance control environment,
and mitigation of any deficiencies
detected in an orderly but ongoing and
disciplined manner. 13
n Establish a compliance committee structure
that is organized along the established
lines of agency business. The committee
will have regularly scheduled meetings
(quarterly at a minimum), be chaired
by the highest level official in that line,
and will receive regular reports on the
identification of possible weakness in the
compliance control environment and the
status of efforts to mitigate those concerns.
n Address all aspects of agency business
processes and decision making. The
compliance program should encompass all
aspects of the agency activities, from the
mission-specific to the support functions
common to all agencies – personnel,
finance, facilities, information, and
security to name a few. This program
requires a change in organizational
culture. This cannot be done by simply
addressing the mission-specific activities.
n Involve all employees in the process by requiring
them to know the rules governing
their activity, act in accordance with those
rules, and report (without reprisal) when
they express a concern about compliance.
Issue human resource policies in support
of that involvement.
It should be noted that what is advanced
here, in many ways, is analogous to the
requirements placed on government agencies
in the management of financial systems by
the GAO Standards for Internal Controls,
and OMB circular A-123, dealing with the
assessment of those controls.
Conclusion
Executive branch executives are guardians of
the public trust. That guardianship comes
with a fiduciary duty to assure the citizens
that existing internal controls are sufficient
to prevent agency non-compliance with legal
requirements. Our legal system effectively requires
this of our corporate leaders. It should
be no less for the government agencies that
enforce the law.
One agency, the FBI, has done just that.
Under Director Mueller’s leadership, the
FBI has taken the first steps in advancing
the management of legal risk by establishing
a corporate-style compliance program that
covers all aspects of its operations. The initial
results will not be as dramatic as the headlines
that prompted the change, but the change
is, in fact, dramatic and meaningful. This is
not a one-time effort, and results will not be
overnight. If the corporate experience is any
measure, it may take years to see the actual
benefits. n
Note: The views expressed are those of the author
and do not reflect those of the FBI.
1 See, “Senators Cite F.B.I. Failures as Chief Promises Change” by Scott
Shane, NY Times, 3/28/07.
2 See, “Make the FBI Follow the Law”, Boston Globe, 3/13/2007; “Break
up the FBI”, LA Times, Opinion by John Yoo (former DOJ official),
3/21/2007; “Revise the Patriot (sic) Act”, Editorial, LA Times, 3/26/07.
3 See, Oversight Results – The FBI tightens it procedures for using
national security letters, Editorial, Washington Post, 03/26/2008, p.
A-18.
4 Available at http://www.usdoj.gov/dag/cftf/corporate_guidelines.htm
5 This was updated in December, 2006 by Deputy Attorney General Paul
J. McNulty. (See http://www.corporatecompliance.org/Content/NavigationMenu/Resources/ComplianceBasics/mcnulty_memo.pdf)
6 In re Caremark Int’l Derivative Litig., 698 A.2d 959 (Del. Ch. 1996).
7 See also, Stone v. Ritter, 911 A.2d 362 (Del. 2006) where the Court
confirmed that the Caremark dictum is the law of Delaware, holding
that “Caremark articulates the necessary conditions for assessing director
oversight liability.”
8 Federal Sentencing Guidelines § 8B2.1.(b)(2)
9 http://www.opm.gov/constitution_initiative/oath.asp
10 FSG at 8B2.1(a)2
11 The Associated Press reported on an Ethics Resource Center report
stating: “Overall, three out five government workers acknowledge
witnessing violations of ethical standards, policy or law over the past
year. . .” (See, http://ap.google.com/article/ALeqM5ivPvlvc-f0uGdm7zkd5jBjTr8rMQD8UFKS8G0).
Also see, http://www.ethics.org/
12 At 5 C.F.R. § 2635.101
13 The FSG at § 8B2.1.c requires organizations to engage in a risk analysis
process.
Be Sure to Get
Your CHC CEUs
Inserted in this issue of Compliance &
Ethics is a quiz related to the article:
n So, What’s Your Compliance Strategy?
— By Henry Klehm III, David
Schweiger, and Andrew Schweiger on
page 6.
n What are Boards to do when Investors
Call? — By Lou Thompson on
page 40
n Global Compliance: China — By
Scott Lane and Robert Leffel, page 44
To obtain your CEUs, take the quiz
and print your name at the top of
the form. Fax it to Liz Hergert at
952/988-0146, or mail it to Liz’s attention
at SCCE, 6500 Barrie Road,
Suite 250, Minneapolis, MN 55435.
Questions? Please call Liz Hergert at
888/277-4977.
Compliance & Ethics readers taking
the CEU quiz have one year from
the published date of the CEU article to
submit their completed quiz.
June 2008
38
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Call For Audio/Web Conference
Presentations
Audio/Web Conferences are SCCE’s way to communicate important
“issues and challenges” that affect today’s corporate professional. If you
are a compliance professional/legal/consultant, we are looking for your
expertise to help us develop new programs. These programs are 90-minute
sessions, with 60 minutes for presentation and 30 minutes for Q&A.
Audio/Web Conferences are a new way to do business. They are an excellent
opportunity to bring people together and to share your professional
knowledge.
If you or your organization are interested in presenting an Audio/Web
Conference for SCCE please contact:
marlene.robinson@corporatecompliance.org | 1-888-277-4977
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
39

What Are Boards to Do
When Investors Call?
By Lou Thompson
Editor’s Note: Lou Thompson is Managing Director
for Kalorama Partners, LLC and a Compliance
Week columnist. Lou is the former CEO,
President, and board member of the National
Investor Relations Institute, and an internationally
recognized expert on corporate disclosure,
governance and other strategic management issues.
He was also the Assistant White House Press
Secretary to President Ford. He may be contacted
by e-mail at lou@kaloramapartners.com.
A
wake-up call for directors and
senior management came recently
from this country’s oldest nonprofit
organization devoted to the advancement of
high ethical standards in organizations. The
Ethics Resource Center reported that while
progress has been made on the compliance
front, few advances have occurred in creating
an ethical business culture. 1 Its study found
that the risk of ethical misconduct in corporate
America has risen to pre-Enron levels.
The Center found that more than half of employees
have seen ethical misconduct in their
companies, but most do not use the hotlines
or other means to report misconduct out of
fear of retaliation. Yet, companies with strong
ethical cultures have reduced their ethics risk
by a very significant measure.
It therefore behooves boards to take the appropriate
preventive measures to better protect
themselves, given the heightened liability
that directors face in today’s environment.
Some may argue that passage of the Sarbanes-
Oxley Act (SOX) was an overreaction to
the debacles at Enron, WorldCom, Tyco,
and others, but the devastation wrought on
investors, employees, and other stakeholders
was catastrophic. As a result of SOX, serving
as a director today places one in the glare of
public scrutiny like no other time in the history
of corporate America.
Commensurate with SOX, came a wave
of shareholder activism that has increased
significantly each proxy year, and the appetite
on the part of the activists has been whetted
by the growing number of successes when
challenging boards of directors and senior
managers on proxy issues. In 2007, activist
investors scored better than an 80% success
rate in achieving a majority vote for short
slates of their director candidates.
Add hedge funds to the activist mix whose
battles with management and boards are not
so much timed with the proxy season, but
can occur anytime they believe that a company
is not living up to their expectations of
its valuation potential.
The two key proxy issues for 2008 were related
to executive pay and proxy access for nominating
directors. A record 135 new activist
campaigns were announced during the fourth
quarter of 2007 for the 2008 proxy season.
According to RiskMetrics Group, Inc. activist
shareholders submitted say-on-pay proposals at
more than 90 US companies this year – a 73%
increase over 2006. 2 Even though these are
non-binding, given the current environment,
it would be difficult for boards to ignore sayon-pay
proposals that receive a majority vote.
Aflac, Inc. this year and Verizon Communications
in 2009 will be giving shareholders an
opportunity to cast a non-binding vote on the
companies’ executive compensation plans.
The Securities and Exchange Commission
(SEC) stirred the hornets’ nest at the end of
Lou Thompson
November when it maintained the status quo
on proxy access for director nominations. SEC
Chairman Christopher Cox recognized that
the commissioners were sharply divided over
the issue and were not going to reach agreement
on an access proposal in time for the
2008 proxy season. So, in a three-to-one vote,
the Commission adopted an amendment to
Rule 14a-8 that allowed companies to exclude
proposals pertaining to the election of directors.
This issue is not likely to go away and will
probably be addressed again this year.
In the meantime, the American Federation
of State, County and Municipal Employees
(AFSCME), planned to submit binding proposals
that called for reimbursement of proxy-fight
solicitation expenses in connection with nominating
one or more candidates in a contested director
election. Charles Elson of the University
of Delaware’s Weinberg Center for Corporate
Governance said, “If the reimbursement proposals
do well, they may, in the end, supplant
access. I think it’s the ultimate solution.”
The inability to nominate directors could
result in activist investors marshalling support
to withhold votes for specific directors,
particularly in companies that have adopted
majority voting. And, we could see an increase
in activist hedge funds and other major inves-
Continued on page 41
June 2008
40
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

tors attempting to pressure boards to nominate
specific individuals to the board. Boards should
have in place a policy on how they will handle
investor requests to meet with the board.
In my Compliance Week column “Barbarians
At the Gate: Do You Open Up?” 3 I suggested
that boards consider:
n The investor’s track record in communicating
with the company. An investor who
has made no attempt to talk with management,
but goes straight to the board for
the first time, does not deserve the same
access as one who has made a number of
attempts to communicate with management,
even though they may not have
achieved their desired results.
n Whether the investor is offering shortterm
solutions to perceived problems for
short-term gains or has come forth with
recommendations that could bring longterm
increases in shareholder value.
One guiding principle, with respect to board
members meeting with investors, is that
directors must be accompanied by an officer
who is intimately familiar with the company’s
disclosure record. This is a measure to guard
against violating Regulation Fair Disclosure
by unknowingly discussing material, nonpublic
information.
In general, ignoring or deciding not to meet
with major investors can be a zero-sum game
leading to a loss of good will and, very likely,
negative publicity for doing so. Besides, it
doesn’t hurt to listen. You don’t have to accept
what they say, and someone might even come
up with a good idea.
For several years after the SEC created the
rules called for by the Sarbanes-Oxley Act,
there was heavy emphasis on the role of the
board audit committee until internal audit
controls were in place. Then, as executive
compensation became a hot issue, particularly
as the SEC instituted its new rules on disclosing
executive compensation, the board emphasis
shifted to the compensation committee.
Now, with heightened emphasis on the
director nominating process, the nominating
and governance committee is in the spotlight.
One of the most progressive efforts on the
part of a board reaching out to major investors
occurred recently when Doug Leatherdale, as
chairman of UnitedHealth Group’s nominating
and governance committee, created an advisory
committee comprised of some of the company’s
major investors and members of the medical
profession. The corporation is a leader in managed
care programs. Leatherdale, who had been
chairman and CEO of the St. Paul Companies
for 11 years, asked the advisory group to describe
what characteristics they were looking for in
directors. He also invited them to submit names
for consideration. There was actually a match
between a person the nominating committee
was considering and who the investors recommended.
While companies may be reluctant to
voluntarily engage their major investors in the
board nominating process, the success of the
UnitedHealth Group’s model should serve as a
positive example for others to consider following.
The company also included in its proxy an
extensive “plain English” discussion of how it addressed
its options backdating issue and the steps
it has taken to resolve its issues with investors.
The SEC made another decision last November
in which it urged companies and others to establish
electronic shareholder forums that would
facilitate discussion among investors of proxy issues,
but could not be used for proxy solicitation
purposes. There is some evidence that companies
will monitor forums created by others, as they do
the blogs, but they are unlikely to establish their
own corporate sponsored forums. Many view
these forums as “the devil’s playground.”
The board should be kept apprised of significant
information discussed in these forums,
who the key players are, and whether the
company should respond. Under the theory
of “keep your friends close and your enemies
closer,” companies might want to consider
creating a shareholder e-forum to have a
better handle on what’s going on among
their activist investors. Moreover, they might
even derive some benefit by demonstrating
that they are taking the initiative to listen to
investors’ ideas and engage in a discussion of
what is best for the long-term future of the
company and its shareholders.
Yahoo and Motley Fool have already established
these forums where investors – mostly
institutional – communicate with one another
all the time. Imagine a shareholder-activist like
Eric Jackson, chief executive of Jackson Leadership
Systems, using one of these electronic
forums to marshal support behind a withholdvote
campaign for specific directors. Jackson
used his blog and videos posted on YouTube
to band together some 100 shareholders with a
combined stake of $60 million in Yahoo. That
resulted in a 33% “against” vote for seven of 10
Yahoo directors at the company’s annual meeting
in June 2007. CEO Terry Semel quickly
became Yahoo’s former CEO.
Moving now to what board members should
expect from their investor relations officers
(IROs). According to a National Investor
Relations Institute survey, 4 some 80% of IROs
provide written reports to the board on their
activities and various aspects of the company’s
stock performance. But, fewer than half are actually
in the boardroom where directors can ask
questions about what the investors are thinking,
whether the investors understand the company’s
strategy, and if so, are they buying it?
Given the liability that directors shoulder,
Continued on page 42
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
41

What Are Boards to Do When Investors Call? ...continued from page 41
they should want the best possible information
from the IRO so they can avoid surprises.
IROs should not review their written
reports before the board, but should use their
time to provide strategic insight as to the
key issues investors are concerned with, and
respond to the board’s questions.
Lastly, there are five areas where the IRO and
the corporate secretary should provide assistance
to the board:
1. Participation in a periodic discussion on
the issue of earnings guidance and whether
the company’s policy with respect to guidance
should be continued or revised.
2. Along with the general counsel and the
corporate secretary, the IRO should work
with the board in developing guidelines
for shareholder access to the board.
3. The IRO and the corporate secretary
should be proactive in talking with investors,
prior to the start of the proxy season,
on potentially contested issues to see if
there are areas of compromise before they
become proxy proposals.
4. Companies should be proactive in meeting
with the proxy advisory services, prior to
the proxy season, to explain the company’s
position on various issues before being
rolled into the advisory service’s blanket
recommendations.
5. The IRO and corporate secretary should
also be meeting with the people in the
major investor firms who actually vote the
proxies, and these are generally not the
same people. CEOs, CFOs and IROs normally
meet with the people who manage
the funds.
How directors relate to the IRO varies
considerably. For example, the vice president
for investor relations at Nike has confidential
meetings with her board members. Some
directors are calling the IRO directly to ask
questions about investors. Obviously, IROs
don’t enjoy being the messenger when it
comes to giving the board bad news, but
CEOs should avoid killing the messenger.
Some companies retain an outside third party
to conduct periodic perception surveys of
the company’s major investors and analysts,
and these reports are provided to the board.
This way the IRO doesn’t have to serve as the
intermediary. No IRO wants to be in the position
of telling the board, for example, that
the “street” lacks confidence in the CEO.
In closing, as the shareholder democracy
movement takes on greater momentum,
boards of directors need to be prepared to
work with management in dealing with the
various issues before them. As a close friend,
who was a career McKinsey partner, a chairman,
and CEO who now serves on three
boards recently told me, “We came away
from Sarbanes-Oxley spending too much
time looking over our shoulders at compliance
issues, rather than looking ahead and
doing the things directors are supposed to do
in helping management chart the strategic
direction of the corporation.”
Directors want to make sure their house is
in order by establishing best practices for
the board and to take advantage of their
corporate resources – including the IRO – in
executing their duties to the company and its
shareholders. In this current environment, if
one follows the old axiom that an ounce of
prevention is worth a pound of cure, it could
make life as a director more predictable and
allow one to breathe more easily. n
1 Available at http://ethics.org/research/nbes.asp. Accessed May 1, 2008.
2 Available at http://www.riskmetrics.com. Accessed May 1, 2008.
3 Compliance Week magazine, published March 20, 2007.
4 National Investors Relations Institute, Executive Alert “NIRI Releases
2004 Trend Survey Report.” January 21, 2005.
2nd Annual SCCE
Volunteer Project
SCCE’s 7th Annual
Compliance & Ethics Institute
September 14-17, 2008
Greater Chicago Food Depository
Saturday, September 13, 2008,
12:00 – 4:00 p.m.
We had a great experience with our First
Annual volunteer project last year working
with Habitat for Humanity! This year, join
us for another unforgettable event in Chicago
with the Greater Chicago Food Depository
(GCFD). As Cook County’s food
bank, the Greater Chicago Food Depository
distributes more than 40 million pounds
of food each year. A large portion of this
food must be inspected or sorted and then
packaged before it can be safely distributed
through a network of 600 member agencies
(food pantries, kitchens, shelters, etc.).
Volunteers complete much of this work.
We will be repacking food in the warehouse
and getting it ready for distribution.
Your volunteer experience includes:
n Transportation to and from the facility
n Lunch
n Beverages and snacks
n A rewarding community service and
networking experience
This is just a part of a great
experience in Chicago. Be
sure to register for this event
when you’re completing your
conference registration. Visit
www.complianceethicsinstitute.
org or please contact Lizza
Catalano at lizza.catalano@
corporatecompliance.org for more
information.
June 2008
42
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

SCCE Co m p l i a n c e Ac a d e m i e s
Become a Certified
Compliance & Ethics Professional (CCEP)
Attend one of the SCCE 2008 Academies
and sit for the exam on the fifth day
following a four-day intensive training session
“This four-day course was the most robust theoretical support on the compliance & ethics discipline I could ever attend.
And the caliber of the invited speakers was impressive, as well. The feedback to my colleagues was very short: a firstclass
course. I strongly recommend this course.” — Zaur Ahmadov, Compliance & Ethics Advisor, Group Compliance
& Ethics, BP (British Petroleum)
August 4–7, 2008
Chicago, IL
CCEP Exam August 8, 2008
September 22–25, 2008
Zurich Switzerland
CCEP Exam September 26, 2008
November 17–20, 2008
San Francisco, CA
CCEP Exam November 21, 2008
The Compliance Academy is a four-day intensive training course
designed for participants with a basic knowledge of compliance concepts. The Academy
covers specific subject matter in depth and is a great preparation course for the CCEP
exam. (The course provides you with sufficient credits required to sit for the exam.)
Becoming CCEP certified demonstrates sufficient knowledge of government regulations
and compliance processes to understand and address legal obligations and promote
organizational integrity through the operation of effective compliance programs.
Register online at www.corporatecompliance.org
Questions? Call +1 952 933 4977 or 888 277 4977
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
43
June 2008

Global Compliance:
China
By Scott Lane and Robert Leffel
Editor’s note: We’d like to thank Ethisphere
Magazine for allowing us to reprint a series
of articles featuring compliance and ethics in
selected foreign countries. This article about
China is the first in this series.
Historically a nation opposed to
foreign investment, the Chinese
economy has recently shifted into
a modern, market-oriented system that caters
heavily to international business. Today, the
country is a major player in several important
industries, such as manufacturing, food
processing, petroleum and textiles. (see table
& graph on page 45)
Now, business leaders across the world eagerly
turn their eyes towards China and notice a
country that relishes its new-found power
and the attention that comes with it. Such
change doesn’t come without its share of
obstacles–with thousands of years of history
come deep-rooted traditions, some of which
test the boundary of moral principles as they
are understood in the western world. Bribery
and corruption, for example, are not just
common, but each runs rampant throughout
the nation’s business practices. In order for
Western companies to enter China’s booming
market, it is first necessary to understand the
unique cultural and legal processes involved
in conducting business in the country.
The ethical climate for foreign enterprises
When international business managers and
chief executives open dialog about expanding
their business to China, they discuss
topics such as intellectual property protection,
stifling government bureaucracy, lack
of product quality standards, discrimination
issues, and rampant corruption in business
dealings. While the government is making
attempts at improving these categories, many
concerns remain unaddressed.
Although China has significantly strengthened
its intellectual property laws since joining
the World Trade Organization (WTO) in
2001, the country still has the highest piracy
rate in the world–an estimated $1 billion is
lost each year to Chinese piracy alone. Even
though the Chinese government formed the
State Intellectual Property Office in 1998 to
help enforce patent, trademark, and copyright
laws, this organization is considered
relatively ineffective by outside sources.
The government was also forced to reexamine
its quality standard regulations after a series
of scandals involving contaminated or harmful
toothpaste, pet food, and most recently,
toys. New committees were formed to tackle
these issues but it remains to be seen how
productive they will be.
Discrimination issues run rampant
throughout the country. Gender
discrimination against women has been
documented for years. More complicated are
the discrimination issues involving migrant
workers moving from rural farmlands to cities
and towns. There have even been reports
of height and other physical requirements
neccessary for obtaining certain Chinese
government positions.
Business dealings with the government are
notoriously strewn with unethical practices,
both under-the-table and overt. A strong
sense of family and loyalty to ones friends
leads to a very nepotistic business environment.
Some Chinese refer to the famous
philosopher Confucius who surmises in
Analects, “The father conceals the wrongs of
his son, and the son conceals the wrongs of
his father. This is justice.” Foreign businesses
entering the market with no significant political
connections have a considerably more
difficult task of integrating than those who do
have connections.
Corruption isn’t limited to government
dealings, however. It’s common for Chinese
business deals to include various perks and
benefits for the buyer, including lavish vacations
and expensive electronics, in addition to
any negotiated price to help secure important
contracts. While the Organization for
Economic Cooperation and Development
(OECD), whose members include the United
States, Japan and the European Union, has
helped curb corruption in international business
dealings in recent years, China has been
and remains notably absent from the group.
Ultimately, experts believe that China is
proactively working to fix its ethical problems.
Shanghai is a positive example of a city
leading the way in this regard. One theory
for the improvements points to the increasing
standard of living for many Chinese who no
longer rely on shady benefits or under-thetable
bribes for their livelihood. As Chinese
businesses increase their presence throughout
the world, they will consequently bring their
ethics with them, good or bad. Politicians
and business leaders in China are aware that
ethical policies are demanded by consumers
in a free-market economy nowadays. If the
country and its businesses want to compete
with other economically successful nations,
the improvements will have to continue.
Etiquette tips you should know before
you go
Greetings
In China, it is a sign of respect to greet a person
using his or her family name only, such
Continued on page 46
June 2008
44
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Overview of China
MAJOR INDUSTRIES: TOP EXPORT PARTNERS 2006: TOP IMPORT PARTNERS 2005:
n Mining and ore production
n Machine building
n Textile and Apparel
n Petroleum
n Cement
n Chemicals and fertilizers
n Food processing
n Transportation equipment
n Telecommunications equipment
Other
44.7%
USA 21%
Hong Kong 16%
Japan 9.5%
S. Korea 4.6%
Germany 4.2%
Other
50.9%
Japan 14.6%
S. Korea 11.3%
Taiwan 10.9%
USA 7.5%
Germany 4.8%
2006 COUNTRY STATISTICS
POPULATION: 1,321.8 million people
MEDIAN AGE: 32.7 years (men) 33.7 years (women)
LIFE EXPECTANCY: 71.13 years (men) 74.87 years (women)
LANGUAGES: Standard Chinese or Mandarin (Putonghua, based on
Bejing dialect), Yue (Cantonese), Wu (Shanghainese),
Minbel (Fuzhou), Minnan (Hokkien-Taiwanese)
CAPITAL:
Bejing (15 million people)
LITERACY RATE: 90.9%
GDP per capita (PPP) $7,700
GDP (Purchasing Power Parity) $10.7T
GDP (Official Exchange Rate) $2.518T
GDP (Real Growth Rate) 10.7%
INFLATION: 1.5%
Get started today on your career
making powerful organizations safer and more ethical
Enron. WorldCom. Arthur Andersen. Tyco. If you’re wondering how a system fraught with criminal
and ethical misbehavior could possibly be right for you, authors Joseph E. Murphy and Joshua H. Leet
have the answer: Join what smartmoney.com calls one of America’s top ten fastest growing fields.
Their book, Building a Career in Compliance and Ethics, is the first ever to give step-by-step
instructions on how to establish a career making powerful organizations safer and more ethical.
You’ll discover:
• The wide range of compliance and ethics jobs
• The skills and temperament needed for this field
• Practical ways to prepare for and get ahead in your career
• Steps for conducting an effective job search
• Advice from seasoned compliance and ethics professionals in the field
• Tips for “selling” your compliance and ethics program to upper management
Building a Career in Compliance and Ethics is your guide to doing well by doing good!
SCCE
6500 Barrie Road, Suite 250
Minneapolis, MN 55435
Phone +1 952 933 4977, 888 277 4977
FAX +1 952 988 0146
info@corporatecompliance.org
www.corporatecompliance.org
Only $29.95. Visit www.corporatecompliance.org to order.
June 2008
45

Global Compliance: China ...continued from page 44
as Mr. Fong or Ms. Li. Unlike in a western
environment, the Chinese family name comes
first and is usually one syllable. In some cases,
multiple names follow the family name which
can be difficult for some Westerners. In some
cases, Chinese people also insert an English
name. It is always a good idea to ask a native
speaker which name is the family name if you
are confused. To be on the safe side, simply
assume the first name is the surname.
Business meetings
In China, it is assumed that the first person
who enters the room is the head of the group.
Try and keep to this approach so as not to
confuse everyone. For business purposes,
formality is a sign of respect; do not try to
become too friendly too soon. Never tell
jokes to start a meeting. Meetings in China
tend to start slow, don’t rush the meeting
and talk business right away. Pace yourself.
Dress formally in China. Men should wear
a suit and tie at all times, despite what can
be harsh temperatures. Women should dress
conservatively and stick to plain colors. Negotiating
in China can be quite interesting.
Always remember that negotiations are rarely
sequential. It is perfectly possible to “go over
old ground time after time. No deal is closed,
until it is “signed and chopped.”
any questions about the card i.e. (You are
based here in Beijing, I see.) This is always a
sign of respect and interest in the person you
are meeting. At the table, it is acceptable to
lay the card in front of you on the table.
Gift giving
Gift giving is becoming less common,
particularly as Western companies enforce
their gift-giving policies. In addition, many
Chinese government officials will not accept
gifts after recent crackdowns on corruption.
If you have to give a gift, it should be small,
customary, thoughtful, and always wrapped.
Dinner and social events
Always be prepared for a very long dinner or
lunch engagement. Food is an important part
of doing business in China. Be prepared to
give a brief and friendly speech in response to
the hosts speech at a banquet. When invited
for a meal, never just “dig in” as in many
Western environments. Always wait either
to be served first by your host, or for you
to serve your host the food from the shared
dishes. It is considered poor etiquette to look
after yourself despite others.
Make sure you sample every dish. Sometimes
this is hard, but it will greatly impress your host.
bribery and corruption standing in the way of
a successful operation. While there has been
some progress in the last few years, in part
thanks to new government efforts to fight
corruption resulting in some serious sentences
for corrupt government officials, the
situation is still far from ideal. Corruption is
said to be closely related to the “guanxi,” or a
network of business relations or connections
that creates a basis for social interaction and
the development of trust and cooperation.
Deal with it
To minimize bribery, begin with an understanding
of how the Chinese power system,
guanxi, works and how you can actually use it
to help you. Take time to develop a corporate
guanxi; its quite possible to create and sustain
relationships with high-level government
officials without resorting to bribery. Create
a policy that, while reflecting the company
global values and principles, takes into
account and specifically speaks to local traditions.
Put gifts and entertainment into context
and perspective. Find allies among local
management and capitalize on the desire of
Chinese technocrats and managerial class to
adopt US and European business standards,
best practices and “rule of law.” Be polite and
firm, but not patronizing.
Business cards
Business cards, or name cards as they are
known in Asia, are extremely important.
Always have plenty of them with you, in your
pockets, your jacket, and your briefcase. Treat
your own business cards with respect, place
them in a small leather wallet and protect
them. When exchanging business cards, never
toss or “deal” your business card across the
table. Always hold the card out with both
hands with the writing facing the receiver.
When you receive a card, don’t slap it into
your wallet or in your pocket. Look at the
card, treat it with respect, check it over, ask
Always leave something on your plate at the
end of the meal or your host might think that
you are still hungry.
If a Chinese person gives you a compliment,
it is polite to deny it graciously. Modesty
is highly valued in China. Keep the above
guidelines in mind, but above all, be yourself.
Five compliance and ethics issues to
consider
1. Corruption, bribery, and kickbacks
It is often said that doing business in China
is an ethics and compliance mine field, with
2. Trade secrets and confidential
information
Chinas booming economy has encouraged
many foreign high-tech companies to open
R&D, design, or manufacturing centers
in the mainland. As a result, more local
employees have access to trade secrets, which
creates a significant risk of loss and intellectual
property infringement. Chinese laws
do offer some protection of trade secrets, but
they also require the aggrieved party to show
evidence of actual damage before pursuing
legal remedies.
Continued on page 48
June 2008
46
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Congratulations to CCEP designees!
The Society of Corporate Compliance and Ethics (SCCE) offers
you the opportunity to take the Certified Compliance and Ethics
Professional (CCEP) certification exam.
Achieving certification
has required a diligent
effort by these individuals.
CCEP certification
denotes a professional with
sufficient knowledge of
relevant regulations and
expertise in compliance
processes to assist corporate
industries in understanding
and addressing legal
obligations. CCEPs promote
organizational integrity
through the development
and operation of effective
compliance programs.
Jennifer A. Allison
Robert G. Anderson
Eduardo N.T. Andrade
Virginia Rae Bly
Cathi Bowman
Lizza Sue Catalano
Carrie Susan Cloud
Karen J. Coleman
Denise M. Dechiaro
Jill Ustane Edmondson
Barry Joe Elmore
Leah M. Fitzgerald
Terry D. Goatley
Mark D. Goodman
Lisa V. Gressel
Charles W. Hagen
Keith Randall Hawley
Erik Allen Hennings
Cynthia Louise
Johnston
James Paul Jones
Robert J. Kantor
Darrell Glenn
Kennemer
Arlene D. Knighten
Nickie F. Kubasak
Rachel Deonna Kurtz
Latour Rey Lafferty
Kari Alene Lidbeck
Marco Loures
Carolyn R. Marks
Karen Kisiolek Matz
Carol M. Mcginnis
Betsey Mcgrail
Michelle L. Miller
Jo F. Molock
Mary Sue Moore
Linda Joy Moore
Robert Thomas
Morgan
Mark Neu
Maryellen O’Neill
Kate R. Otto
Mary Helen Peters
Anthony Reeves
Wanda Renee Robins
Paula F. Saddler
Jane Hummel
Simmons
John D. Springer
Stanley D. Stemkoski
Angelle S Stuart
Mauri Michelle
Thornton
Dorothy Vedvick
Marilyn J. Williams
Cheryl Ann Wilson
Caveni Y. Wong
Mark F. Wood
Kathleen P. Woods
Rachel L. Yaron
Joseph M. Yonek
John Robert Zander
Questions? Please contact:
Liz Hergert at +1 952 933 4977, 888 277 4977 or CCEP@corporatecompliance.org.
Society of Corporate Compliance & Ethics
6500 Barrie Road, Suite 250, Minneapolis, MN 55435
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
47

Global Compliance: China ...continued from page 46
Deal with it
The passive and reactive approach to protecting
trade secrets by the Chinese law, the lack
of preventative remedies, and inefficient enforcement
create some serious complications.
Take strong proactive steps including: 1) Create
a strong and unambiguous confidentiality
policy; 2) Require all employees to sign confidentiality
and non-compete agreements; 3)
Introduce the disclosure procedure to identify
conflicts of interest and concurrent employment;
and 4) Conduct periodic audits.
3. Conflicts of interest
Chinese culture offers a somewhat different
perspective on conflicts of interest. Favoritism
is fairly common. Favoring family and cronies
has roots in Chinese Confucian tradition,
although some counter arguments exist as
well. The system of guanxi may also be a
contributing factor.
Deal with it
Evaluate how big the problem is and what
the costs and consequences are. If you tackle
it, tread carefully; imposing US policies in
this area will likely be met with resistance and
will not achieve much. Introduce transparent
hiring and purchasing processes and criteria.
Reward employees for recommending a successful
job candidate or a vendor, but remove
that employee from the decision-making process.
Introduce other ways of favoring family
and friends, such as offering discounts and
events. Try to make guanxi your ally rather
than your enemy.
4. Workplace discrimination
Although there is a ban on discrimination
for government posts, Chinese companies
routinely refuse to employ people because of
their sexual orientation, medical condition,
or gender. Discrimination lawsuits against
Western companies in China are relatively
rare, but not unheard of. Nokia China is
facing legal action for allegedly turning away
a successful applicant in Guangdong because
he is a carrier of Hepatitis B (HBV). In a
recent case involving giant Chinese appliance
maker Galanz, a man hanged himself just
days after he was denied employment because
of HBV. Not only can discrimination result
in costly lawsuits and settlements, the damage
to a companies reputation can be significant.
Deal with it
Zero tolerance, active policy enforcement,
and training are the best and probably the
most cost-effective solutions. Apply the same
standards you would apply at home. Make
sure your local HR and hiring managers
understand the importance of an antidiscrimination
policy, the benefits of diversity, and
the consequences for discriminatory conduct.
This is a good example of when a Western
company can and should apply a higher
standard than local business practice.
5. Product liability
In the wake of product recalls and safety
scares in the United States and Europe, ranging
from dog food to seafood and from tires
to toys, product liability risk is suddenly at
the top of the agenda for many companies
that have their products made in China. The
root causes of the problem are multiple, the
most obvious being long and often complex
supply chains in China, but also include
an extremely fragmented manufacturing
industry, weak manufacturing and quality
standards, often inefficient or non-existent
quality controls both by the Chinese and by
the foreign importers who sometimes put too
much trust in their suppliers, and differing
business cultures.
Deal with it
Depending on the severity and the nature of
risk and the scope and extent of the involvement
with Chinese manufacturing, a company
may take some of the following steps:
1) Make an effort to understand your supply
chain in China;
2) Know your risks by conducting a proper
periodic risk assessment on a proactive
basis;
3) Insist that your prime vendors inform you
when they change subcontractors or make
other product substitutions and pass this
requirement along the line;
4) Introduce quality control standards that
your vendors will need to adhere to as the
condition of doing business with you and
make sure these requirements are passed
along the supply chain;
5) Educate your vendors and help them do
things right; most Chinese companies are
reputable and care about their reputation
and product quality as much as you do;
6) Trust but verify: Implement audit and inspection
programs for the vendor facilities
and introduce your own quality control
for all imports with a proper evaluation
for design and manufacturing defects; and
7) Create a comprehensive quality control
program. It may not prevent all risks, but
it may serve as an affirmative defense. n
Reprinted with permission from Ethisphere
Magazine September 19, 2007.
June 2008
48
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

Get great exposure for
your employment ads!
200 words
90 days
only $400!
The Complete
Compliance
and Ethics Manual
An accurate, comprehensive, and
authoritative reference source!
Save time by improving the efficiency
of your compliance program.
The manual comes with the full-version CD.
Member rate $315.00
Non-Member rate $349.00
The Complete Compliance and Ethics Manual
includes more than 400 double-sided pages filled
with up-to-date, valuable information on current
compliance issues. Large, attractive three-ring
binder with color front, spine, and back cover.
Th r e e w a y s t o o r d e r:
Mail to: SCCE
Visit: www.corporatecompliance.org 6500 Barrie Road
Suite 250
Fax: +1 952 988 0146 Minneapolis, MN 55435
For more details call
+1 952 933 4977, or 888 277 4977
Continued on page 49
Compliance and ethics professionals
belong to a highly specialized field. SCCE can
match qualified individuals with your staffing
needs. Take advantage of SCCE’s Web site to
advertise your unique career opportunities.
It’s easy and cost effective. List up to 200 words for
90 days for only $400. Get worldwide exposure for
your classified ad to a targeted audience!
To post a job:
Visit www.corporatecompliance.org
and click on Advertising: Career
Opportunities in the left-hand menu
www.corporatecompliance.org
+1 952 933 4977 or 888 277 4977
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
49

Statute Gone Wild?
By Guy Aulabaugh
Editor’s note: Guy Aulabaugh is the Custodian of
Records and Compliance Officer for Mantra Films,
Inc. in Santa Monica, California. He may be
contacted by e-mail at guyaulabaugh@yahoo.com.
Following a brief description of the legal issues
this company has faced, Guy explains how their
Compliance department was designed to prevent
future problems. This article addresses compliance
with child pornography laws. Other charges
against Mantra and Joe Francis are beyond the
scope of this article.
Mantra Films, Inc. (Mantra) makes
the ever-controversial reality-based
shows under the brand name “Girls
Gone Wild.” Mantra is owned and run by
the inimitable Joe Francis, whose high-profile
successes and tribulations are known by many
who watch the various cable television news
programs and talk shows. This article attempts
to describe, in brief, Mantra’s creation of its
Compliance department and implementation
of policies and procedures created to maintain
compliance pursuant to Title 18, Section 2257
of the United States Code (18 U.S.C. § 2257)
and all of the underlying regulations incumbent
thereto. Title 18, Section 2257 governs the
record keeping requirements for the production
of any book, magazine, periodical, film,
videotape, or other matter that contains sexually
explicit material that is intended to be mailed
or shipped interstate or in foreign commerce.
The statute also requires that a disclosure notice
appears on the packaging of this material.
On Dec. 13, 2006, Mantra pled guilty to the
charges of failing to keep sufficient records as
required by 18 U.S.C. § 2257, as well as various
labeling violations regarding some DVD
sleeves that were improperly printed. The
record keeping violations stem from content
that was shot in 2002 involving two women
who had misrepresented their ages to the
cameraman, and filled out false written release
forms in order to get on a Girls Gone Wild
show. They were 17 years old, rather than 18
years old as they represented. As a side note,
Joe Francis had never met these two individuals,
nor was he even in the country when
these women were filmed. Camerapersons are
independent contractors and remain personally
liable for all of the content which they
shoot. However, Title 18, Section 2257 attaches
a form of strict liability on behalf of the
custodian of records for any company that fails
to maintain the required records. Under the
statute, the custodian of records is liable, per
se, for any record keeping violations regarding
Title 18 content. The statute further allows the
US Department of Justice to conduct periodic
warrantless inspections of such records for any
company who produces Title 18 content.
Congress passed the Child Protection and Obscenity
Enforcement Act of 1988 to further support
its laws against child pornography. Among
other things, it requires producers of certain
kinds of content to maintain records regarding
the individuals depicted. Congress subsequently
modified the recordkeeping provisions at least
twice, with the Child Protection Restoration
and Penalties Enhancement Act of 1990, and
the Prosecutorial Remedies and Tools Against
the Exploitation of Children Today Act of 2003
(PROTECT Act). All the various amendments
have made the reach of the recordkeeping requirements
of 18 U.S.C. § 2257 fairly extensive.
The requirements apply only to producers, but
that term is defined broadly. Producers include
all those who create a visual representation
of actual sexually explicit conduct, through
videotaping, photographing, or computer
manipulation. These kinds of producers are
defined as “primary producers” under the
Guy Aulabaugh
regulations issued by the Attorney General.
Those who use such images for “assembling,
manufacturing, publishing, duplicating, reproducing,
or reissuing” any material containing
that image for a commercial purpose, from
a photograph to a magazine or film, are also
producers. Finally, those who upload such
images to a Website or otherwise manage the
content of a Website are considered producers.
These last two types of producers are considered
“secondary producers” under the applicable
regulations. On the other hand, those
who process images and have no commercial
interest in such images, those who merely distribute
the images, those who provide Internet
or telecommunications services, or who store,
retrieve, host, format, or translate the communication
without selecting or altering its
content are not producers. They are, however,
required to verify that the required records
have been kept by the creator and that disclosure
statements are attached to the images.
Pursuant to a Deferred Prosecution Agreement,
Mantra’s compliance is confirmed
through a federal monitoring program,
wherein we submit quarterly reports including
all the necessary compliance documentation
and information for all of our products. The
documentation is audited by a federal monitor,
whose reports are conveyed to the Obscenity
Continued on page 54
June 2008
50
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

SCCE Corporate Members
AIG
Contact: Christine Mullen
Chief Compliance Officer
Christine.mullen@aig.com
www.aig.com
Alfaro-Abogados
Contact: Liliana Alfaro
Partner
lilianaarauz@alfarolaw.com
www.alfarolaw.com
Allstate Insurance Company
Contact: Lyn A. Scrine-Filipovic
Director of Integration
Iscrine@allstate.com
www.allstate.com
Amgen Inc
Contact: Kathleen Schump
Executive Assistant
kschump@amgen.com
www.amgen.com
Compliance Spectrum
Contact: Chrisan Herrod
VP Marketing & Business Dev (IND)
chrisan.herrod@compliancespectrum.com
Dell
Contact: Jeannie McCarter
Jeannie_mccarter@dell.com
Epcor
Contact: Cindy McCracken
Executive Assistant
cmccracken@epcor.ca
Ernest & Young
Chris Ideker
Global Solutions Leader
chris.ideker@ey.com
Foley & Lardner LLP
Contact: Cheryl Wagonhurst
Partner
cwagonhurst@foley.com
www.foley.com
Genentech
Summar Davidow
Sr. Admin Associate
davidow.summar@gene.com
Georgia System Operations
Contact: Andrea Barclay, CCEP
Corporate Compliance Admin
andrea.barclay@gasoc.com
www.gasoc.com
Global Compliance
Karen Kistenmacher
Director Marketing Communications
karen.kistenmacherf@globalcompliance.com
Holland & Knight LLP
Contact: Christopher A. Myers,
Partner
chris.myers@hklaw.com
www.hklaw.com
IFCO Systems NA Inc.
Contact: Steve Worster
VP Compliance
steve.worster@ifcosystems.com
www.ifcosystems.com/america/na/en/
index.php
Integrity Interactive Corporation
Contact: Michael R. Levin, Esq
Dir Compliance & Ethics Services
melvin@i2c.com
www.integrity-interactive.com
Jones Day
Contact: Robert C. Cook
Partner
ccook@jonesday.com
www.jonesday.com
LRN
Contact: Adam Turtletaub
aturtletaub@lrn.com
www.lrn.com
Medtronic
Contact: Amy Patterson
amy.j.patterson@medtronic.com
www.medtronic.com
Metro Water District of Southern CA
Contact: Edith Yamasaki
Sr. Administrative Analyst
eyamasaki@mwdh2o.com
www.mwdh2o.com
Microsoft Corporation
Contact: Odell Guyton
Senior Corporate Attorney
& Director of Compliance
odellg@microsoft.org
www.microsoft.com
Nortel
Contact: Robert J. Bartzokas
Chief Compliance Officer
rbartzok@nortel.com
Parson Consulting
Contact: James Clendenen
Dir West Region
Parson Consulting
jclendenen@parsonconsulting.com
www.parsonconsulting.com
PNM Resources
Contact: Sarah Smith
Director Ethics & Compliance
sarah.smith@pnmresources.com
PotashCorp
Contact: Ann M. Baltys
Legal Assistant
ambaltys@potashcorp.com
www.potashcorp.com
PricewaterhouseCoopers LLP
Contact: Christopher Michaelson
Director
christopher.michaelson@us.pwc.com
www.pwc.com
Qwest Communications
Contact: Dave Heller
Chief Ethics & Compliance Officer
dave.heller@qwest.com
www.qwest.com
RedHawk Communications, Inc.
Antoinette Taylor
Director of Marketing
ataylor@redhawkethics.com
Shook, Hardy & Bacon LLP
Contact: Carol A. Poindexter
Partner
cpoindexter@shb.com
www.shb.comcom
The Network
Contact: Angella Davis
Marketing Manager
angelladavis@tnwinc.com
www.tnwinc.com
Tozzini, Freire, Teixeira, E Silva
Shin Jae Kim Hong
Partner
shin@tozzinifreire.com.br
TSYS, Inc.
Contact: Daniel J. Priban
Director Risk & Compliance
dpriban@tsys.com
www.tsys.com
United Parcel Service
Contact: Ruth Ward
Comp & Ethics Supervisor
rmward@ups.com
www.ups.com
Wal-Mart Stores
Contact: Gary Hill
Dir International Ethics
gary.hill@wal-mart.com
www.walmart.com
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
51

New SCCE Members
The Society of Corporate Compliance Florida
and Ethics welcomes the following new n Susan A. Blair, University of FL
members and organizations. All member n Maria A. Casablanca, Nortel
contact information is available on the n Dena M. Coelho, Fidelity National Info
SCCE Web-site in the Members-Only Services
section: www.corporatecompliance.org. n Karen A. Hancock, First Coast Service
Options
Arizona
n Cylina M. Sides, First Coast Service
n Karen Ansell, Apollo Group Inc
Options Inc
California
Georgia
n Sadia Ali
n Christian R. Cooper
n Michael Barthe, Hythiam, Inc.
n Thomas J. Kelleher, Jr., Smith, Currie &
n Doug Beeuwsaert, Lyndon Group LLC Hancock LLP
n Gustavo De La Torre, Santa Clara Valley
Water District
Hawaii
n Suzanne Dotzler, Amgen Inc
n H David Burge, Kamehameha Schools
n Wendy Blair Fields, Amgen Inc
n Laurie Hanvey, Methodist Hospital Idaho
n Lynda Hilliard, Univ of California
n Stacy Pearson, CPA, Boise State University
n Anthony Jackson, Methodist Hospital n Julian R. Rush, Policy Technologies
n Music M. McCall, City Of San Diego/ International Inc
Office of Ethics & Integrity
n Mark Neu, CCEP, Tenet
Illinois
n Jim Passey, Huntington Hospital
n Margaret F. Brown, Coram Inc
n Jo Anne SawyerKnoll, City of San Diego/ n Christine J. Efantis, Molex Inc
Office of Ethics & Integrity
n Elena A. Lovoy, Law Offices of Elena A
n Deborah Tolomeo, King & Spalding Lovoy
n Vinca Weatherly, Amgen Inc
n Julie Palles, FirstGroup America
n Janice E. Williams, Pechanga Development n Scott M. Permentier, DePaul University
Corp
n Mary Jo Rizzo, Depaul University
n Victoria Ruder, Community Counseling
Colorado
Centers of Chicago
n Doris Blyth, University of Colorado
n Greg Pachner, Noble Energy, Inc. Indiana
n Sharon L. Thompson, MA MFCT, MWH n William Mark Brooks, Eli Lilly and
Global Inc
Company
n Christine S. White, Molson Coors Brewing Co n Kira A. Cooper, MED Institute Inc
n Steven Guymon, Eli Lilly & Company
Conneticut
n Lawrence Plutko, Yale New Haven Health Kentucky
n Rachel D. Green, Toyota
Washington, DC
n John E. Steiner, Univ of KY
n Dan I. Stoll, US Agency for Intl Development
n Shawn Wright, Blank Rome LLP
Massachusetts
n Tyler Hart, Iron Mountain
n Kara L. Hill
n Kevin J. Kelley, JD, MPA, CHC, The
Kelley Law Office
n Bethany M. Machacek, CCEP, Integrity
Interactive Corporation
Maine
n Mary Edith St Jean, St Joseph Hospital
Michigan
n Mindy Willis, DTE Energy
Missouri
n Jan Jackson, MCHCP
North Carolina
n Alice A. Burkholder, City of Greensboro
n Edward P. Paitsel, Nortel Networks
n Chandrika Raghavan, Talecris Biotherapeutics
n Tina Tyson, Duke Univ School of Medicine
n Christian E. Whicker, Duke Energy
Nebraska
n Lisa M. Matya, ACI Worldwide
New Jersey
n Douglas Horr, CIA CBA EDM, Stevens
Institute of Technology
New York
n Diane Delaney-Sheehan, New York University
n William J. Dimmig, People Inc
n Barbara DiTata, Esq, NYC School Const
Authority
n Terry Dylewski, Binghamton University -
State University of New York
n Valerie Haliburton, Colgate-Palmolive
Company
n S. Rebecca Holland, New York University
n Marcia Isaacson, State University of New York
n Robert Jinnett, AIG
n Monique Phillips, NYU Medical Center
n Elena Rossano, Taro Pharmaceuticals USA Inc
June 2008
52
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

n Donna Scuto, State Univ of NY At Buffalo
n Gwen N. Shannon, Federal Reserve Bank
of New York
n Steve Stabile, The New School
n C Veronica Williams, Metropolitan
Transportation Authority
Ohio
n Jill Springer, The Ohio State University
Oregon
n Patty A. Bragg, Providence Health &
Services
n Earl A. Curtis, Portland General Electric
n Thom W. Disco, Providence Health &
Services
n Julie Ebner, Providence Health & Services
n Monique Lamirault, Schnitzer Steel
n Sally Rhys, Coaching for Perspective
Pennsylvania
n Julie Agris, Vantage Holding Company,
LLC
n Bessie G. Jordan, GlaxoSmithKline
n Colleen P. Lyons, The Lyons Trust
n Maria M. Perez, McNeil Consumer
Healthcare
Puerto Rico
n Antonio Aponte-Sanchez, FHC HS of
Puerto Rico
Tennessee
n William A. Moles, II, CIA, University of
Tennessee
Texas
n Douglas Arrington, UT Southwestern
n Michael Blanda, Texas State University
n Cathy Jones, Shell Oil
n Timothy B. Morris, Nortel
n Elaine Pearson, Univ of Houston Downtown
n K Royal, Sandra Day O’Connor College
of Law
n Alan R. Woods, Baker Hughes Incorporated
Virginia
n Rhonda Bishop, Virginia Commonwealth
University
n Robert C. Brown, CFE, Capital One
Financial Corp
n Jennifer L. Burruss, VA Commonwealth
University
n Jaycee L. Dempsey, VA Commonwealth
University
n Peggy L. Fischer, PhD CFE, OIG
National Science Foundation
n Christiana Franchet, L-3 Communications
n Brian E. Hess, CFE, OIG National
Science Foundation
n Cathy S. Kilcoyne, VSE Corporation
Washington
n Martin T. Biegelman, CFE, Microsoft
Corp
n Ed A. Bourassa, T-Mobile
n Rich Cohan, FACHE CCP, Providence
Health & Services
n Sean C. Delich, T-Mobile
n Meg Grimaldi, Providence Health &
Services
n Brock RJ Phillips, CPA CFE, Microsoft
Corp
n Marc Stepper, Puget Sound Energy
Wisconsin
n Lisa Martinez, Manpower, Inc
Ontario, Canada
n Kevin B. Coon, Baker & McKenzie
Sweden
n Annika Ohlsson, Amgen AB
Call for Statistical Surveys
SCCE is looking for informational studies/surveys that
offer statistics designed to gauge the state of corporate
compliance, integrity, governance, and ethics. This
information would be made available on the SCCE Web
site’s Resources page. If you are aware of any studies/
surveys that would benefit your colleagues in making
better and more informed decisions, please e-mail Marlene
Robinson at marlene.robinson @corporatecompliance.org.
Thank you for your help!
SCCE’S
MISSION
SCCE exists to champion
ethical practice and
compliance standards
in all organizations and
to provide the necessary
resources for compliance
professionals and
others who share these
principles.
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
53

Statute Gone Wild? ...continued from page 50
Prosecution Task Force, which in turn submits
its findings to the federal judge under whose
jurisdiction our performance is judged.
The monitoring program includes a work
plan involving the implementation of improved
compliance policies and procedures.
This includes the establishment of a robust
training program for all Mantra employees,
independent contractors, and third-party
agents. Mantra has implemented an internal
audit mechanism in order to track labeling
requirements and age verification. Its
technology has been upgraded and expanded,
allowing it to obtain better images of the age
verification documentation. Further, Mantra
employs the services of independent private
investigators to verify performers’ identities.
The whole process is quite extensive and
most likely sets the standard in the adult
entertainment industry. Mantra is proud that
the Department of Justice has been rather
supportive in this process and applauds our
efforts as being a model in compliance initiatives
for the adult entertainment industry.
The way that Mantra complies with the
statute is actually quite simple, because the
requirements of the statute are fairly simple.
For each and every performer who appears
in Title18 content, we have to obtain a clear
image of a state or federally issued picture
identification card, verifying that, in fact, the
performer is of majority age.
I try to look at the compliance process in a
holistic light; discovering, creating, implementing,
and finally developing, being one organic
process. This process is a single-minded
function – there is no room for mistakes. We
must maintain absolute perfection and be —
COMPLIANT...such a nice sounding word.
As the custodian of records, I bear the responsibility
and, [hard swallow] criminal liability
of making sure that we have the necessary
documentation for all Title 18, Section 2257
content. This requires Mantra’s Compliance
Department to identify all Title 18 content,
obtain and record all required images and
documentation, and finally, build the database
containing all of the information, documentation,
and images accessible, according to the
regulations underlying 18 U.S.C. § 2257.
Otherwise, Mantra’s Compliance department
performs the same functions as any other
Compliance department. It trains all of Mantra’s
employees, independent contractors, and
third-party agents in its compliance policies
and procedures. It tracks any and all content
produced by Mantra, all of which must be
logged into the database, retaining all necessary
compliance documentation and rights
information for each individual performer.
Before any content is distributed, it must first
be cross-referenced with the database and
verified as being compliant.
Ironically, Mantra is more of a reality-based
content provider than an adult-entertainment
industry provider. I estimate that less than 5%
of our content qualifies as content regulated
under 18 U.S.C. § 2257. However, I would
speculate that the more explicit content, which
qualifies as Title 18-governed content, does help
drive the market for our products. Despite our
shows being relatively tame as compared with
much adult content, Mantra and its founder
Joe Francis remain popular targets for many talk
show hosts and special interest groups. Let’s face
it; our product is controversial. However, critics
often make false assumptions about the content
produced by Mantra.
Although everyone can agree with the purpose
behind the statute, as one who daily strives to
maintain perfect compliance under 18 U.S.C.
§ 2257, it can be a struggle to determine what
the statute requires. For example, the regulations
fail to adequately define what acceptable
government-issued picture identification is.
Because Mantra’s policies are to maintain
strict compliance with all laws and regulations,
it often is prevented from producing
content that would otherwise be legal. In
other words, even if a potential performer is
clearly over the age of 18, if she does not have
a state driver’s license, we do not produce the
content. This includes content that may or
may not be regulated by 18 U.S.C. § 2257.
The consequences are too high to even take a
remote chance that the Department of Justice
would construe the content as being noncompliant
with 18 U.S.C. § 2257. Through this
vetting process, I submit that much constitutionally
protected speech is chilled.
Recently, the Sixth Circuit Court of Appeals
has overruled 18 U.S.C. § 2257 as being
unconstitutional in its entirely. However, the
Department of Justice has obtained an en
banc hearing, providing further review of the
court’s decision. Therefore, without stating
anything more specific about the constitutionality
of the statute, rest assured that the
debate continues, with no clear solution on
the horizon. Obviously, companies such as
Mantra have no interest in filming underage
performers, and the government does reasonably
need an enforcement mechanism in
place to prosecute and convict the producers
and purveyors of child pornography. However,
as it currently stands, individuals could
be criminally convicted of a serious crime
for producing content that, in reality, does
not portray any underage performers (even
if it could be proven as such) resulting from
the failure to maintain the particular records
required by 18 U.S.C. § 2257. Hopefully, the
legislature and courts will be able to resolve
these issues, so that the legislative purpose
– the protection of children – is furthered
as much as possible, without unnecessarily
chilling an unreasonable amount of constitutionally
protected speech. n
June 2008
54
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org

ENTERPRISE RISK MANAGEMENT
Your plan is only strategic
if you know what your risks are.
SOFTWARE FROM PAISLEY ENABLES A SUSTAINABLE, DISCIPLINED APPROACH
TO ENTERPRISE RISK MANAGEMENT. By linking strategic risks with other governance,
risk and compliance business processes, Paisley provides structure, visibility and
transparency to your enterprise risk program.
PAISLEY ENTERPRISE GRC AND GRC ON DEMAND — Software for operational
risk management, integrated audit, financial controls management, IT governance,
and compliance. Call 888-288-0283 or visit www.paisley.com
Society of Corporate Compliance and Ethics • +1 952 933 4977 or 888 277 4977 • www.corporatecompliance.org
June 2008
55

...is Your Company’s Once-A-Year
Code of Conduct Training Enough to
Make
the
Grade?
FACT: “To have an effective compliance
and ethics program…an
organization shall…promote an organizational
culture that encourages
ethical conduct and a
commitment to compliance with
the law.” – U.S. Sentencing Guidelines,
§8B2.1 (a), (a1), (a2)
Think of your own experience.
Have you ever really learned
something from a course presented
only once-a-year? In most
cases, it just isn’t possible. To be
effective, your ethics program
needs to deliver ongoing communication
and training throughout
the year.
Best Practices
Ethics Programs
for the Worlds’ Corporations
REDHAWK
Why are RedHawk’s Programs
EFFECTIVE?
More than simply once-a-year online
modules, our programs reinforce
ethical issues throughout the entire
year through an ongoing communication
and training strategy.
• Customized, interactive Online
Code of Conduct course
• The Ethics Communication
Coach: a library of over 1,000
supporting ethics communication
and training tools
• Online Ethics Training Library -
covering over 50 topics
• Discussion-based training
solutions
• Instructor-led training tools
• Multi-year training plans
Let us build an effective ethics program
for your company. Our custom-designed
solutions, combined
with 15+ years of unmatched experience
and affordable prices,
have helped leading corporations
create ethical culture and meet
U.S. Federal Sentencing Guidelines
requirements.
Find out how you can make the
grade today – visit us at
www.RedHawkEthics.com to take
a quick tour, schedule a full product
demonstration, and receive
your FREE white paper entitled
WHAT’S IN IT FOR ME? Creating
Ethical Culture through Behavior
Change Strategies, presented to
the American Management
Association.
RedHawk Communications, Inc. | 615 Hope Road | Eatontown, New Jersey 07724 | T: 732-440-1600 | www.RedHawkEthics.com
Experience. Knowledge. Commitment.