JM - Society of Corporate Compliance and Ethics

Volume twoNumber oneFebuary 2005Published QuarterlyMeetJolene MillerSenior DirectorEthics and CorporateComplianceRadioShack CorporationINSIDECEO Letter2345681620Advisory BoardBusiness Complianceand EthicsCorporateMembershipWhistleblower ClaimsHotlinesEthics & ComplianceProgramsMeet Jolene Miller

EnablingROY SNELLWe are a society ofenablers. We tell peoplewho have bad habitsthat they have a disease. As parents, we say: "Boys willbe boys" or "girls will be girls!" Sometimes we pay thousandsof dollars to have outsiders come in and tell uswhat we want to hear. We hire people who tell us thatthe regulations are unfair, too complicated, and that theregulators don't know what they are doing. Pointing outthe shortcomings of others gives us comfort. Enablinghelps ensure that we don't change, which, of course, isOK in most cases, but potentially disastrous in others.differently. I look at it as anembarrassing and tough conversationthat could result in ideas. Ilook at it as an opportunity tochange and look good in front ofall the people expecting me to perform.I look at it as an opportunityfor improvement. When theimprovement is implemented, I shamelessly take fullcredit for it. Despite the fact that it was not my idea, Itake credit for it because I endured the criticism. I overcamethe temptation to tell them, "I am in charge here.You are not. Get lost!" That is worthy of some credit.Compliance doesn't tell people what they want to hear.We tell people what they need to hear. We opt for shortterm pain over long term pain. We step up. We makean effort to eliminate conflicts of interest. We hire peopleto tell us what we need to hear, not what we want tohear. This is a much tougher road.The problem is that enabling is not helpful. Enablingdoes not encourage action. Enabling does not encouragestepping up to painful and unpopular decisions. Weshould embrace our bad habits/problems and deal withthem. We should not hire people to tell us we are OKwhen we are not. It's delaying the inevitable. Is it possiblethat the compliance/ethics profession would not behere today if it were not for enabling? If people wouldfind and fix their problems, would we need a departmentthat ensures that they do?I struggle with this, like anyone else, but I am winningthe battle slowly. After 50 years of criticizing criticizers, Iam beginning to embrace some of it. When peoplepoint out mistakes or missed opportunity, I try to view itCompliance and ethics programs are becoming commonplacein business because there was a feeling that somethingwas missing. What was missing? What was missingwas someone whose sole purpose was to stop theenabling and address the issues. Someone who wouldaddress the issues regardless of the potential negativeimpact on their career. What was missing was someonein the organization who was free of conflicts of interest;someone who had no responsibility other than to get itright; someone who would respond to a complaint withoutbias. That is the heart and soul of the complianceprofession. ■SCCE’SSCCE exists to champion ethicalpractice and compliance standardsMISSION in the corporate community andto provide the necessary resources for compliance professionalsand others who share these principles.February 20052SCCE • 5780 LINCOLN DRIVE, SUITE 120 • MINNEAPOLIS, MN 55436Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

ONTHECALENDARAdvisory BoardPublisher:Society of Corporate Complianceand Ethics, 888/277-49774th Annual CorporateResponsibility SymposiumA National Cross-Industry Symposium designed toaddress today’s issues of responsible corporategovenance.September 12-14, 2005Chicago Downtown Marriott, Chicago, ILEditor-in-Chief:Rory Jaffe, MD, MBAChief Compliance Officer,University of California Davis HealthSystem, Sacramento, CAExecutive Editor:Roy Snell, CEO, SCCE,roy.snell@corporatecompliance.orgRory JaffeMay 16, New York, NYMay 17, Cincinnati, OHMay 23, Minneapolis, MNMay 24, Chicago, ILNovember 10, Los Angeles, CANovember 11, Seattle, WADecember 1, Atlanta, GADecember 2, Houston, TXSCCE Corporate AnnualConferences ComplianceWorkshopsCompliance WorkshopsRESOURCES eCorporateCompliance News Corporate ComplianceResourcesStory Editor:Renee Molstad, SCCE, 888/277-4977renee.molstad@corporatecompliance.orgAssistant Editors:Kevin Fairlie, Esq.Diekemper, Hammond, Shinners,Turcotte & Larrew, P.C., St. Louis, MOTom McSteen, JDPresident, Compliance Strategies, LLC.St. Paul, MNStephen A. Morreale, D.P.A., CHCPrincipal, Compliance and RiskDynamics, Southborough, MAJose A. Tabuena, JD, CFE, CHCManager, Investigative and IntegrityAdvisory Services, KPMG LLP, Dallas,TXAdvertising:Renee Molstad, SCCE, 888/277-4977,renee.molstad@corporatecompliance.orgLayout:Gary DeVaan, SCCE, 888/277-4977gary.devaan@corporatecompliance.orgKevin FairlieTom McSteenStephen A. Morreale Audio Conferences Compliance ProgramEvaluation Advertising Career Opportunities Membership Directory Compliance Training & Compliance & Ethics - BooksSCCE JournalSociety of Corporate Compliance and EthicsCompliance & Ethics (CE) (ISSN 1523-8466) is publishedby the Society of Corporate Compliance and Ethics(SCCE), 5780 Lincoln Drive, Suite 120, Minneapolis, MNJose A. Tabuena55436. Subscription rate is $195 a year for non-members.Periodicals postage-paid at Minneapolis, MN 55436. Postmaster: Send address changesto Compliance & Ethics, 5780 Lincoln Drive, Suite 120, Minneapolis, MN 55436.Copyright 2004 the Society of Corporate Compliance and Ethics. All rights reserved.Printed in the USA. Except where specifically encouraged, no part of this publicationmay be reproduced, in any form or by any means without prior written consent ofthe SCCE. For subscription information and advertising rates, call SCCE at 888/277-4977. Send press releases to SCCE C&E Press Releases Dept., 5780 Lincoln Drive, Suite120, Minneapolis, MN 55436. Opinions expressed are not those of this publication orthe SCCE. Mention of products and services does not constitute endorsement. Neitherthe SCCE nor CE is engaged in rendering legal or otherprofessional services. If such assistance is needed, readers should consult professionalcounsel or other professional advisors for specific legal or ethical questions.(888) 277-4977 • www.corporatecompliance.orgFebruary 20053

February 20054by Bill PracharEditor’s Note: Bill Prachar has over thirty meetings of ethics and complianceyears experience in Compliance, Ethics organizations including the HCCA,and Corporate Governance. Bill is an the Conference Board, the DII, theattorney practicing with the Compliance EOA and most recently the SCCE.Systems Legal Group (CSLG). Because There is a common theme, orBill has an extensive business, as well as maybe better stated, a commonlegal background, he specializes in the frustration that inevitably turns up atpractical issues associated with developingand implementing effective ethics described as the Rodneythese gatherings - I think it is bestand compliance programs. Email: Dangerfield "I don't get no respect"bprachar@cslg.comsyndrome. Maybe that's a bit of astretch, but the frustration is mostThis is the first of what I often expressed, "How do we earnhope to be a series of a seat at the table."columns addressing issuesfaced by compliance and ethics professionalsas they go about their high-profile corporate scandals,With all the recent excitement overdaily work trying to build and maintainstrong compliance cultures in do-it-right cultures rightfully seethose of us struggling with buildingtheir organizations. The columns what we are trying to accomplish aswill be based on observations and very important. It's a good thingexperiences gathered during my 30 we do. The problem is, it isn't perfectlyclear that everyone in ouryears in organizational complianceand my involvement in business organizations sees what we do inethics since the early 1990's. They quite the same way. It's not thatwill express my opinions, which of others don't believe in ethical andcourse means, as my spouse and compliant business conduct, it's justdaughter remind me from time-totime,there is a good chance I'm out their business tasks, and havethat they've got a lot to do to carrywrong, or at least partially off base. little patience for added bureaucracy,particularly when it comes fromI hope the column will generatediscussion and I encourage readers the corporate office. Like lawyersto email me their thoughts, pro or and HR folks, we're tolerated, butcon, on the topics I tackle. We will not much more. (Of course add atry to run responses (with permissionof course) that offer alternate Agreement to the mix, and the levelsmall CIA, or DOJ Administrativeviews or solutions to those I of tolerance, at least temporarily,express. That said, here goes … goes way up!)Over the last 10+ years I haveattended and spoken at numerousI believe there are two solutions tothis problem. The first is to adjustexpectations to a realistic level.The second is to recognize that, likeevery other sub-part of your organization,the ethics and compliancefunction supports business objectives,and, accordingly, to makesure that the function acts like abusiness unit.With respect to setting expectations,it is important to remember that ifyour organization fails in its businessobjectives, there are no jobsfor anyone, including E&C personnel.As a consequence, the job ofE&C will never have the same statusin the organization as those functionsdesigning and executing thebusiness plan. The heroes in businessare those who make money.That's OK and it's not going tochange soon. We E&Cers just wantto make sure the money is madeethically and in full compliancewith the law. Ours is a job done inthe background, and we need toaccept that reality.Most important for earning a seat atthe table is recognizing the need tobehave like every other part of thebusiness organization. The moreE&C people are seen as "businessSociety of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgBILL PRACHAR

Commission, including the financialreporting rules. A successfulclaimant under Sarbanes-Oxley isentitled to "make whole" relief thatmight include reinstatement, backpay, special damages including litigationcosts, expert witness feesand reasonable attorney's fees.Employers that defend against retaliationand whistleblower claims faceunique challenges. Retaliationclaims are often more susceptible tofact disputes, making summaryjudgment dismissal more difficult toachieve. Courts generally will notdismiss cases unless there is nomaterial issue of fact that is in disputeand there is an entitlement tojudgment based on the law.Summary judgment is even moredifficult when the alleged protectedactivity and adverse action are closein time. Some courts have foundthat such temporal proximity alonecan provide an inference of unlawfulretaliation. Further, whistleblowerclaims often reveal sensitive conductthat can expose companies toliabilities well beyond the employmentclaim itself.Employment Practices Liabilityinsurers have already recognizedthat the exposure from retaliationand whistleblower suits ranks insignificance among class actions,benefits discrimination and employeeprivacy as significant issuesindicative of current trends in claimsexperience.4 While some wageclaims, such as those pursuant tothe Fair Labor Standards Act (FLSA),generally are not covered underEPLI, savvy plaintiffs' lawyers areincluding other claims to helpensure that coverage is more likelyto be triggered.Moreover, as employees havebecome increasingly aware of theirrights under the various employmentlaws, there is an overallincrease in the frequency and severityof suits alleging employmentrelatedviolations.5How can insurers and employershelp manage the risks of exposurefor retaliation and whistleblowerclaims? The following steps shouldbe taken to help ensure that companiesare given the opportunity torectify violations of the law oncethey are made aware that they exist:■ Ensure that the company has anestablished policy for makinginternal complaints with a clearanti-retaliation provision. Somecompanies have established "800"numbers for Sarbanes-Oxley,harassment and other complaints;■ Immediately investigate claims ofmisconduct or alleged violationsof the law;■ Document the investigation andcorporate responses to employeeclaims;■ Train managers and supervisors tohonor the company policy not toretaliate against employees whomake complaints; and■ Monitor responses to employeecomplaints to ensure that corporatepolicies are being honored.In short, the increase in retaliationand whistleblower claims presentsboth an opportunity and a riskgoing forward. Insurers can certainlypoint to increased claims experienceas a basis for employers tostrongly consider EPLI protection.Employers should continue managingrisks with vigilance so employeeclaims can be resolved internallyrather than finding resolution incostly litigation. ■1. EEOC, Enforcement Statistics and Litigation,Charge Statistics FY 1992 through FY 2003, atwww.eeoc.gov.2. "Employment Practices Liability: Jury AwardTrends and Statistics," 2004 Edition. See also "EPLDiscrimination Awards Dip Slightly," NationalUnderwriter Property & Casualty-Risk & BenefitsManagement, 2004 WL 66341492.3. In the 1980's Congress passed more than 12statutes protecting private sector employees whodisclose violations of health and safety or environmentalregulations to governmental authorities.Likewise, 14 states have whistleblower statutes coveringprivate sector workers.4. Gen Re, Employment Practice Liability Insurance,Current Trends and Issues, at www.genre.com.5. "Retaliation Claims A Growing Concern; Can BeEasier To Prove Than Bias," Judy Greenwald,Business Insurance, January 5, 2004 (Vol. 38; No.1); 2004 WL 62676364.Learn the latest in CorporateCompliance. Subscribe to ourelectronic newsletter eCCN.It's FREE! Just visitwww.corporatecompliance.orgCorporate ComplianceResources Compliance Basics Program Evaluation Library Professional Code Surveys Job Description External Links Career Opportunities Speaking Opportunities Exhibit & SponsorOpportunitiesFind this and more at:www.corporatecompliance.orgSociety of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 20057

February 20058Editor’s Note: José is a Manager inKPMG’s Forensic practice based inDallas with extensive experience in thehealth care and pharmaceutical industries.Mr. Tabuena has expertise in corporategovernance assessments and inevaluating, designing, and implementingethics and compliance programs. Hehas also performed compliance auditsand fraud and misconduct investigations.Mr. Tabuena served as aCompliance Officer and is experiencedin managed care, health insurance, andpharmaceutical regulatory complianceand operations. As an attorney he hashandled complex regulatory and litigationmatters.IOne of the minimum requirementsof an effective complianceprogram under theFederal Organizational SentencingGuidelines ("Guidelines") is theestablishment of an internal reportingmechanism that encourages thereporting of suspected wrongdoing.Ethics and compliance 'hotlines'have become mainstream since theintroduction of the Guidelines in1991, and organizations have implementedsuch internal reportingmechanisms because they haveproven to be one of the best methodsfor identifying potential violationsof law before they becomeBy Jose Tabuenasignificant and public legal problems.The final Securities and ExchangeCommission ("SEC") rule implementingSarbanes-Oxley includes a"whistleblower" communicationrequirement. As concepts found inthe Sentencing Guidelines criteriaare increasingly reappearing inother frameworks, organizationsneed to view the whistleblowercomplaint process in the context ofan overall compliance programframework. For example, the recentlisting of standard requirements forthe NYSE and NASDAQ require, inpart, that listed companies adoptand disclose a code of businessconduct, which include standardsand procedures that will facilitateeffective operation of the code,such as the reporting of complianceviolations and non-retaliation protections.Responsibility for handling employeeand external complaints are notnew to audit committees. Most companiesalready have procedures inplace that direct the handling ofcomplaints. Implementing themechanism for the Sarbanes-Oxleyrequirement provides an opportunityto comprehensively enhancereporting mechanisms and communicationoptions for employees.Experience and research in the fieldof organizational compliance haveled to the identification of commoncontrol considerations that shouldbe evaluated as a company designsand implements its hotline andcomplaint procedures. Studies haveshown that employees are reluctantto report misconduct unless there isa high level of confidence that managementwill act and that there willbe no retaliation for good faithreports. The following is anoverview of the requirement withhighlights of the factors to consider.The RequirementThe applicable portion of Sarbanes-Oxley § 301, provides as follows:Complaints.-Each audit committeeshall establish procedures for-(A) the receipt, retention, and treatmentof complaints received bythe issuer regarding accounting,internal accounting controls, orauditing matters; and(B) the confidential anonymoussubmission by employees of theSociety of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgJOSE TABUENA

issuer of concerns regardingquestionable accounting or auditingmatters.Basic features of this law includes:■ Procedures are needed foremployee complaints and forcomplaints from outside of theorganization■ The SEC final rule provides adeadline for compliance - listedcompanies must have thesewhistleblower procedures inplace by the earlier of (a) theirfirst annual shareholder's meetingafter January 15, 2004 or (b)October 31, 2004.■ The SEC chose not to specify anyrequired procedures for a complaintprocedure, citing a desireto maintain maximum flexibility.Each audit committee is expectedto establish an approach suitableto its circumstances.Disclosure and Record Keepingunder Sarbanes-Oxley■ Section 404 requires disclosureregarding the effectiveness of theinternal control structure in thecompany's annual report and theexternal auditor's report. Theaudit committee complaint proceduresunder § 301 should be consideredan integral component ofthe internal control structure suchthat summary information regardingthe procedures is referenced.■ There is no requirement thatcomplaint records must beretained. Section 404 implies thatthey must be kept for at least thenext fiscal year.■ Section 802 creates new criminalpenalties for any knowingdestruction or concealing of documentsto obstruct or influence agovernment investigation.Because an internal investigationfrom a whistleblower communicationmay be conducted in contemplationof a governmentinvestigation, an organizationshould suspend all ordinary documentdestruction practicesinvolving investigation of aSarbanes-Oxley complaint.Whistleblower Protections underSarbanes-OxleySarbanes-Oxley contains strong prohibitionson retaliating against anyoneproviding a good faith reporton questionable accounting orauditing practices:■ Section 806 gives employees theright to sue their employer forretaliation. Employees are firstrequired to file a charge with theU.S. Department of Labor. OSHAthen has 180 days to investigateand resolve the complaint.■ Employees involved in a Section806 protected activity cannot bedischarged, demoted, suspended,threatened, harassed or discriminatedagainst as a result of thatinvolvement. Civil remedies forviolations of Section 806 includeall relief necessary to make theemployee whole, such as backpay with interest and attorney'sfees.■ Section 1107 provides for criminalpenalties, including up to 10years in prison for retaliation.Designing the Mechanism: ControlConsiderationsAssessment of Existing ComplaintProceduresExisting structures should bereviewed to determine if they containkey features that can be adaptedto ensure compliance withSarbanes-Oxley. How are accountingand audit concerns currentlyraised and handled? Can employeesreport anonymously? How areissues reported to the Board?One consideration is whether a separateprocess for Sarbanes-Oxley §301 should be implemented. Amechanism specific to potentialaccounting and auditing complaintsmay prove efficient and also betterensure that such complaints areappropriately addressed. However,there are also risks to having multiplecomplaint systems. Employeesmay become confused as to whereto report and will need to be trainedto understand which process to usedepending on the concern beingraised. Staff handling the variousmechanisms will similarly need training,and safeguards will be requiredfor Sarbanes-Oxley matters that arereported through the wrong mechanism- a company is on notice andstill needs to ensure the complaint isrouted to the audit committee andproperly investigated.Selecting a Reporting MechanismThe SEC did not specify, and the lawContinued on page 10Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 20059

Compliance and Ethics Hotlines... continued from page 9simply requires, an anonymousreporting mechanism. 24-hour telephonehotlines have emerged as themechanism of choice, as they areable to provide anonymity and havea track record for handling businessethics and compliance issues. It canalso be interactive, allowing a skilledinterviewer to elicit the necessarydetails to enable appropriate action,and further allows for appropriatefollow-up with a caller. Other mechanisms,such as e-mail and webbasedsubmissions do not possessthe same degree of interactivity.The complaint procedures shouldincorporate a number of differentchannels for employees to utilize,with some providing more interactivityor assurance of anonymity.For many smaller companies, telephonehotlines and web-based submissionservices might be unnecessarilyformal or expensive. Suchcompanies may choose to enlistconfidential paper submission boxesplaced in common areas.Regardless of the complaint procedurebeing used, organizationsshould also encourage employeesto consider standard protocols, suchas reporting to an immediate supervisoror higher, to human resources,or to another company functionsuch as internal audit or compliance.A hotline mechanism shouldbe utilized when anonymity andconfidentiality are considerations, orwhen more traditional avenues havebeen exhausted without the issuebeing resolved.Outsourcing the Reporting Mechanismversus Providing the Service Within theOrganizationThere are advantages and disadvantagesto each approach:■ Advantages to outsourcing themechanism to an independentthird party include -■ Independence adds credibilityand objectivity. It lessens concernsthat the person answeringa call has any other agendathan eliciting the facts. Whensensitive high-stakes issues areinvolved (such as accountingfraud), employees may not betrusting of internal channels.■ Complaints can be receivedwith around the clock coverage.There are fewer worriesthan what an organizationwould face with answeringmachines or missed calls. Thiscan be critical for employeeswho are tentative about callingin the first place. It also facilitatesdifferent time shifts andgeographic diversity, andallows for individuals to callfrom home and during nonworkhours.■ They provide an additionalbuffer. This is especially importantif a caller wants to remainanonymous. Callers do nothave to worry about theirvoice being recognized. Issuescan be sanitized, to a degree,to reduce the risk of the callerbeing identified.■ Advantages to an internal processinclude -■ Internal resources can be moreresponsive. The resourceanswering a call often hasenough knowledge and isempowered to provideanswers or to initiate an investigation.There is less need forcalls to be referred back andforth before a response is providedto the caller.■ They can be more efficient andcost effective. The cost of anexternal service is over andbeyond the cost of an internalinquiry and the necessary issuemanagement. The externalvendor adds an extra layer inthe process and cannot answerquestions requiring interpretationor conduct investigations.■ There is familiarity with thecompany culture. Internalresources better know theissues confronting the organizationand are attuned to patternsand trends of past calls,as well as the goals and objectivesof the ethics and compliancefunction. They can clarifyquestions and probe on detailsbased on company knowledgeand experience.Each of the listed advantages canbe viewed as a disadvantage to itsalternative approach.Responsibility for Receiving andEvaluating ComplaintsAgain the SEC intentionally left thisdetermination to the audit committee.Depending on its circumstances,the company can have oneor more of the following partiesresponsible for receiving complaints,and then for evaluatingwhich ones are sent to the auditcommittee:February 200510Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

■ The audit committee or the chairmanof the audit committee -complaints will not be filteredand the audit committee willreceive every communication■ Internal Audit■ Chief Compliance or EthicsOfficer■ In-House General Counsel■ External Legal Counsel■ If a third party service provider isused to initially receive the calls,one of the above parties or functionscan still screen and triagethe calls or complaints beforethey are routed to the audit committee.The function charged with receivingthe complaints will need to developprotocols, including a screening andtriage process. A qualified andtrained individual will evaluate thenature of the call or complaint, andthen ensure it is routed to theappropriate resource. If the matterinvolves improper accounting orfinancial control issues, then heightenedprocedures should be undertaken.Routing Complaints to the AuditCommitteeAs with any issue involving highlyplaced individuals in an organization,it would be futile to routewhistleblower complaints to management,if a member of managementwere allegedly implicated.Serious consideration should begiven to all complaints sent to, orhaving reviewed by, the person orfunction that typically receivesreports on ethical, legal, complianceviolations and other misconduct.Ideally, this individual or functionwill have sufficient independencefrom management to ensure thatthe complaint is appropriately routed.An additional protection is tohave all identified Sarbanes-Oxleycomplaints copied to a designatedmember of the audit committee. Ata minimum, the audit committeeshould be promptly notified of significantcommunications and periodicallyreceive summary informationon all Sarbanes-Oxley codedcomplaints.Classifying Sarbanes-OxleyWhistleblower ComplaintsOne of the challenges is to providesufficient guidelines to properlyclassify complaints that are thefocus of Sarbanes-Oxley. A balancemust be sought to reduce the likelihoodof deluging an audit committeewith irrelevant or immaterialmatters, or missing a complaint thatis not obviously or directly relatedto financial reporting, resulting inthe matter not being reported to theaudit committee and/or not fullyinvestigated. If an external vendor isutilized, a 2-stage process is probablyneeded. The external providercan be provided guidelines and definitionsfor classifying Sarbanes-Oxley matters, but it should not beexpected for them to have sufficientexpertise to assure accurate classification.Internal resources should beutilized for additional evaluation toensure complaints are not missed ormiscoded.Some factors to consider for codingSarbanes-Oxley complaints are:■ All financial reporting and internalauditing matters (e.g.,improper journal entries, improperbooking of expenses, off-balancesheet transactions, insidertrading, improper loans to executives,any financial data manipulation,etc.)■ All fraud allegations - with materialityconsiderations■ Certain misconduct allegations -materiality considerations■ Any misconduct involving highlevelofficers, executives or managers■ Complaints involving the ForeignCorrupt Practices Act, Anti-Kickback Act■ Depending on the industry, certainregulatory matters maybecome financial reporting or disclosuresissues. These caninclude marketing practices (e.g.,pressures to meet sales targets),government contracts and pricingconcerns, etc.Essentially, to incorporate the auditcommittee procedure, a companywill need to work with its vendor toset criteria for coding complaintsthat involve potential financialreporting issues. The organization'sown screening and triage processalso needs to be alert to Sarbanes-Oxley issues that come through thehotline. Procedures will be neededto manage the flow of informationto the audit committee. See the flowchart below for an example of howa financial reporting concern can beprocessed through a hotline system.Once an issue is deemed a financialContinued on page 12Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200511

Compliance and Ethics Hotlines... continued from page 11one under Sarbanes-Oxley, thenprotocols will be needed for routingto the audit committee andresponding to the issue. Such issuescan be further coded by prioritylevel (e.g., high, medium, low),based on established guidelines andcriteria, which would dictate theaction to be taken. Criteria caninclude the role and influence ofthe individual allegedly involved,and the potential materiality of thematter to financial reporting. Forexample, issues deemed high riskinvolving a senior executive wouldrequire immediate attention withnotification provided to an auditcommittee member within 24-hours,and possibly require involvementby outside counsel.Anonymity and ConfidentialityIt should be noted that anonymityand confidentiality are related butdistinct issues. Both pertain to concernsthat a whistleblower may faceretaliation for reporting suspectedmisconduct. An employee utilizing areporting mechanism may choose tobe anonymous and those involvedin the investigation should not beaware of the person's identity. Evenif a caller chooses to identify himselfor herself, there is still anexpectation that confidentiality withrespect to the individual and theinvestigation will be kept. Thismeans, that the investigation andthe key facts (including identity, ifknown) will be kept in strict confidenceand made aware to onlythose who need to know, due totheir involvement in the investigation.An organization cannot, in goodfaith, guarantee total confidentiality.Generally a caveat is provided to aperson contemplating a disclosureof wrongdoing, that the identity of areporting individual may becomepublic due to circumstances beyondthe control of the organization. Forinstance, there may be litigation andother legal demands that mayrequire an organization to providecritical facts of the matter, includingthe identity of the person (ifknown) reporting the issue. Further,despite controls and protections inplace, mishaps can still occur andthere is the potential speculationand gossip that can occur during aninvestigation, especially followinginterviews of individuals.Communicating the ProceduresLike any new initiative, a hotlinewill fail if it is not launched effectively.A comprehensive communicationsand implementation planwill be needed and an importantconsideration is to promote awarenessthrough formal training as partof a company's ethics and complianceprogram.It is implicit that companies broadlydisseminate the procedures, or atleast the portions of the proceduresthat describe how to submit complaints.The logical places for suchdissemination would be the company'scorporate website and employeeIntranet. For companies withoutwebsites or Intranets, or with alarge percentage of employees withlimited access to computers, it maybe necessary to post the proceduresin company common areas.Companies should incorporate theprocedures into their employeemanuals, and consider distributingFebruary 200512Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

the procedures in paper format toall existing employees and to newemployees as part of the orientationprocess.Case Management RequirementsThe law does not specify how anorganization should handle or retainincident reports. However Section404 contains requirements regardingannual report disclosures and externalaudits, which will be difficult toachieve without recording andtracking information for each complaint.Ideally a database should bedeveloped that would enablereporting, summarizing and analyzingthe collected data. The AICPArecently developed a Toolkit as aresource for audit committees,which includes a Sample TrackingReport for the Sarbanes-Oxleyreporting process. Most hotline vendorsprovide a database tool thatenables collection of call data.InvestigationsThere should be established proceduresfor conducting internal investigationsfor all types of matters.Individuals within the organizationwith the appropriate skills and credentials(internal audit, security,compliance, human resources) canbe designated as resources. Allthose designated to conduct investigationsshould also receive trainingspecific to the internal reportingmechanism procedures and protocols.The process for conducting aninvestigation will depend on thenature and severity of the issuesraised. For significant complaints,such as those brought promptly tothe audit committee, assessment willbe needed as to whether outsidecounsel and/or other independentresources will be needed.Regardless of the type of investigation,the company should havewell-defined procedures and protocolsin place. Investigations shouldbe conducted in a consistent mannerby all designated internalresources. Basic considerationsinclude:■ Investigators being qualified,trained, and having sufficientresources.■ Gaining control of all pertinentdocuments.■ Properly conducting interviews.■ Protecting legal privileges anddiscovery protections, as needed.■ Ensuring suspension of documentdestruction practices.Safeguarding against RetaliationAs noted, a number of studies indicatethat employees are reluctant todisclose wrongdoing unless there isconfidence that management willact on reports and that there will beno retaliation for such reports.Thus, the complaint proceduresshould be designed to minimize theidentification of a person who filedan anonymous complaint, as well asprotecting confidentiality when theidentity is known. Company-widepolicies on confidentiality and nonretaliationshould be developed andContinued on page 14Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200513

Compliance and Ethics Hotlines... continued from page 13widely promoted as part of communicationand training concerning thecomplaint procedures. Further, periodicmonitoring of the process caninclude evaluating the status ofwhistleblowers after a period oftime to determine if they are experiencingharassment or other punitivemeasures.Reporting Mechanisms for Agents,Suppliers, Vendors, Customers, andInvestorsAnother consideration is promotinguse of the mechanism outside ofthe workforce to meet the requirementsof Sarbanes-Oxley. If thereare other avenues where aSarbanes-Oxley matter can potentiallybe reported (e.g., customercomplaint line), procedures shouldbe developed to ensure that such acomplaint gets forwarded to theappropriate resource, and is includedin information provided to theaudit committee.If a mechanism is promoted for useoutside of the company, proceduresand protocols will need to beassessed. The potential increase inreporting volume will need to beconsidered. Whether or not issuesneed to be routed and handled differentlydepending on who reportsa matter, also should be evaluated.Final ThoughtsThe establishment of formal proceduresfor receiving and handlingcomplaints is intended to facilitatedisclosures and thereby alerting theaudit committee of potential problemsbefore they have serious consequences.Implementing a hotlinemechanism can achieve this objective,but only if it is designed in amanner that encourages its properand effective use.Recently, on November 2004, therevised Federal SentencingGuidelines for Organizations wentinto effect. Although the impact ofrecent U.S. Supreme Court cases,United States v. Booker and UnitedStates v. Fanfan, on the sentencingguidelines is yet unknown, theamendments emphasize having asystem whereby the organization'semployees and agents can "seekguidance" regarding concerns orpotential violations - in addition toa system to just report violationsafter the fact.It is worth noting that the amendmentsto the sentencing guidelinesadd significantly greater stringencyto present day compliance criteriaand therefore, organizations shouldcontinue to monitor developmentsin organizational compliance andcorporate governance, and makepreparations to adjust their complianceprogram (and hotline) as warranted.■Call for Authors!Please email your articles or topic ideas to Compliance &Ethics story editor, Renee Molstad, at renee.molstad@corporatecompliance.org.Be sure to include your telephonenumber or you may call Renee at (888) 277-4977 to discussyour article ideas.Deadlines:■ June 13, 2005 (August issue)■ September 16, 2005 (November issue)■ December 16, 2005 (February 2006 issue)Compliance & EthicsAdvertising ratesFull page B/W insertion rates:1-2 $640.003 - 5 insertions $605.006 - 11 insertions $490.0012 or more $405.00Half page B/W insertion rates:1-2 $450.003 - 5 insertions $420.006 - 11 insertions $355.0012 or more $305.00Quarter page B/W insertionrates:1-2 $265 003 - 5 insertions $250 006 - 11 insertions $225 0012 or more $215.00Full page 2 color insertion rates:1-2 $1075.003 - 5 insertions $1040.006 - 11 insertions $925.0012 or more $840.00Half page 2 color insertion rates:1-2 $885.003 - 5 insertions $855.006 - 11 insertions $790.0012 or more $740.00Quarter page 2 color insertion rates:1-2 $700.003 - 5 insertions $685.006 - 11 insertions $660.0012 or more $650.00February 200514Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

The Complete Compliance and Ethics ManualAn accurate, comprehensive, and authoritative reference source!Save time by improving the efficiency of your compliance program.You get the manual plus the full version CD.Pricing: Member rate $315.00, Non-Member rate $349.00The Complete Compliance and Ethics Manual including 838 double sided pages filled withup-to-date, valuable information on current compliance issues. Large, attractive 3-ring binder withinformative color front, spine, and back cover.Three ways to order:Mail to: SCCEVisit: www.corporatecompliance.org 5780 Lincoln Drive, Suite 120Fax: 952-988-0146 Minneapolis, MN 55436For more info call 1-888-277-4977Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200515

VICTORIA WESSELERBy Victoria WesselerEditor’s Note: Victoria Wesseler is a past struggling with?president of IMDMC and ManagingMember of Ethics & Compliance And finally it came to me. I wasStrategies, LLC. She assists corporations struggling with the reality thatin the development, implementation andmanagement of business ethics and ■ after 13 years since the Federalcompliance programs. She also develops Sentencing Guidelines went intocommercial business ethics and compliancetraining videos. For information,effectvisit www.ethicscompliance.com.■ after 13 years of watching a relativelyobscure position of Chief(This presentation was delivered at the2004 Annual Meeting & Conference of Compliance Officer rise to one ofthe Indiana Medical Devicethe top ten careers in the countryManufacturers' Council (IMDMC) onOctober 26, 2004. Ms. Wesseler is a Past ■ after 13 years of seeing a floodPresident of the IMDMC. The informationcontained in this presentation is for and compliance training products,into the marketplace of ethicsgeneral information only and does not codes of conduct, hotlines andrepresent legal or regulatory advice.) advisory services, andWhen I was asked to give ■ after 13 years of seeing corporatea presentation atcriminals serve significant prisontoday's meeting, I readilyagreed. Why wouldn't I? Talking negotiate settlement agreementsterms and watching organizationsto my favorite association about my with price tags that would makefavorite business topic would be a your head spinwalk in the park. So, of course Isaid yes.I can still pick up any newspaper orlisten to any news broadcast andAfter five days of sitting in front of see that a lot of companies andmy computer waiting magically for their employees still just don't get it.the right words to appear on thescreen, I had to admit that I had the You would think with all that information,America's corporations andworst writer's block of my career. Iwas at an absolute loss for words. I those who run them would bekept asking myself, what are you shouting "I believe" and that corporatewrongdoing would havebecome a thing of the past. A sortof corporate urban legend aboutsomething that happened long longago, in a corporation far, far away.How is it, I asked myself, with allthese resources and incentives forcorporations to behave in an ethicaland legal manner, that inappropriatebehavior can still exist?As a former Chief ComplianceOfficer myself, and now an advisorto companies, I wondered if maybeall the fanfare surrounding ethicsand compliance programs is reallyfor nothing. Maybe the good peoplewill always behave appropriatelyand those who want to do harmwill. And, if you buy that theory,then maybe the proliferation intoday's corporations of businessethics and compliance training,codes of conduct and eloquentlycrafted values statements reallymakes no difference at all. I amreminded of the famous quote inJulius Caesar where Cassius states:"Men at some point in time are incharge of their own destinies.February 200516Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

It is not the fault…of our stars… it is ourown fault."It is in that quote that I find theanswer to my question. While it isabundantly clear that the developmentof business ethics and complianceprograms initially focuses onrisk assessments, policy developmentand educational activities, what maynot be so clear to most is that it'sreally "all about the behavior".In our rush to develop policies,install hotlines and offer trainingclasses, we have ignored the onevariable we can't control: thehuman being. It is not the fault ofthe program; it is the fact that ashuman beings employees choosetheir own destiny. They choosetheir own behavior. It may not bewhat we want it to be.Don't fool yourselves, we cannotCONTROL human behavior. Thereis a dangerous delusion that manyEthics and Compliance Officerslabor under. They believe if theycraft the right values statement withthe right Code of Conduct, and providethe right training, that all willbe well in the corporate world.I was trained as a behavioral scientist.My Master's degree in isOrganizational Behavior and theone thing I learned after severalyears of graduate work, and manymore in the corporate world, is thathuman behavior cannot be controlled.I cannot make you dosomething. What I can do is set upan environment that will encourageyou to choose conduct that is ethicaland in compliance with the lawbecause it is the most rewardingchoice for you. The choice is up toyou and you alone.Let's think about that for a minute.Why do people choose one behaviorover another? Despite the thousandsof books written on the topicof human behavior, there is onlyone answer: because that behavioris the one that gets them what theywant. That's it. Period. End of sentence.The problem is that becausewe are, as Shakespeare points out,in charge of our own destinies, weare in charge of our behavioralchoices. This is why it is notuncommon for individuals to goastray in corporations which havepicture perfect business ethics andcompliance programs.The weakness in these programs isnot in the elements but in the execution.It lies in thinking that oncethe program is designed and implemented,that our job is done, withthe program being an end in itself,rather than thinking of the programas a series of tools working togetherto shape human behavior. I can'ttell you the number of times I'veheard a client say in response to aviolation, "what we need are betterpolicies" when what they reallyneeded was a better system to reinforcean already excellent existingpolicy.Let me give you an example. Howmany of you drove here today andtook the Interstate? How many ofyou strictly obeyed the speed limitof 55 miles per hour? For those ofyou who did not obey it, what wasthe issue? Wasn't the 55 mile perhour policy clearly posted? Probablywas-big white sign with black letters-hardto miss. So what was missing?What would it have taken tohave your behavior match the policy?On the Interstate you were incharge of your own destiny. Youwere in charge of your own behaviorand; despite the clearly stated,simple to understand and fairly easyto obey policy, you made yourchoice. That choice was to not obeythe policy because for whateverreason you had at the time, it justwasn't something you were going todo.Are our corporations and those whowork in them really any different?Our policies are posted. Our valuesare clearly stated. We know whatthey are and yet we stray fromthem and behave in ways contraryto their direction.As most of us are aware, unless thehighly unlikely event of Congressrejecting them occurs, there will beseveral significant changes to theFederal Sentencing Guidelines onNovember 1, 2004. Perhaps themost significant of these arerequirements that■ companies must "promote anorganizational culture thatencourages ethical conduct and acommitment to compliance withthe law" and■ the "compliance and ethics programshall be promoted andContinued on page 22Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200517

Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200519

featurearticleMeet Jolene MillerSenior Director, Ethics and Corporate Compliance, for RadioShack CorporationEditor's note: The following interviewwas conducted by Rory Jaffe, MD, MBA,Chief Compliance Officer for UC DavisHealth System and C&E Editor-in Chief,in December 2004, with Jolene Miller,Senior Director, Ethics and CorporateCompliance, RadioShack Corporation.Jolene Miller is currently Senior Director,Ethics and Corporate Compliance, forRadioShack Corporation, which hadover $4.6 billion in sales in 2003, and isresponsible for the development, implementation,and monitoring of an integrated,corporate-wide ethics and complianceprogram, designed to ensurecompliance with the company's Code ofEthics, Financial Code of Ethics, allother company policies, and all applicableFederal, State, and local statutes,laws, and regulationsJolene joined RadioShack in 1999 as aLegal Intern, while attending TexasWesleyan University School of Law inFort Worth, Texas. Upon receiving herJuris Doctorate in 2000, Jolene joinedRadioShack fulltime as a CorporateAttorney. Her areas of practice includedNew Partner/Vendor RelationshipDevelopment, Supply ChainManagement, and Regulatory Matters -including the FCC, FTC and FDA;Consumer Product Safety Matters andAdvertising and Marketing Matters.In July 2003, Jolene presented ProductRecall Effectiveness: Our Experience atthe U.S. Consumer Product SafetyCommission's "Recall EffectivenessMeeting #2 - New Tools for RecallEffectiveness." The goal of the meetingwas to solicit information about whatnew tools are being used today by manufacturers,retailers, and others, to provideinformation to consumers aboutrecalls.Jolene received her B.A. in PoliticalScience from Washington StateUniversity in 1996.RJ: Ms. Miller, for those not familiarwith RadioShack, could youbriefly describe your company?JM: Fort Worth, Texas-basedRadioShack Corporation (NYSE: RSH)is a consumer electronics specialtyretailer of wireless communications,electronic parts, batteries and accessoriesas well as other digital technologyproducts and services. With nearly7,000 stores nationwide, it is estimatedthat 94 percent of allAmericans live or work within fiveminutes of a RadioShack store ordealer. The company's knowledgeablesales associates and brand position -"You've got questions. We've gotanswers.®" - support RadioShack'smission to demystify technology inevery neighborhood in America.RJ: Whom do you report to inyour organization?JM: David S. Goldberg, our VicePresident - Law and AssistantCorporate SecretaryRJ: What are the advantages anddisadvantages of locating compliancein the general counsel's office?JM: The biggest advantage is theunderstanding of the need for, andimportance of, compliance programsboth in theory and in practice.There is also a high level ofsupport from departments withinthe General Counsel's governancethat our department deals with on aFebruary 200520Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

egular basis (Loss Prevention, RiskManagement, Legal) which enablesus all to do our jobs more efficientlyand effectively.A disadvantage is the loss of attorneyclient privilege when dealingwith allegations and reports as theCorporate Compliance Departmentis not in the Legal Department,even though I report to the VicePresident - Law.RJ: One of your prior roles wasas corporate counsel, concentratingon regulatory affairs. How is thatdifferent from your current role asthe Senior Director of Ethics andCorporate Compliance?JM: As a corporate attorney handlingregulatory affairs matters, Ipreviously spent much of my timereacting to issues as they arose,both internally and externally. Now,as the Senior Director of Ethics andCorporate Compliance, I spend asmuch, if not more time, taking stepsproactively to prevent non-complianceissues from arising.RJ: What are the greatest compliancerisks for a retailer?JM: Protecting the privacy of customerinformation and productlabeling and safety issues wouldhave to rank near the top of anylist. From a broader perspective,another is conducting effective ethicaltraining across the organization.Without this training component,the overall compliance environmentbecomes riskier as a matter ofcourse. Additionally, regulatoryissues, (pricing, safety, and labelingto name a few), are always ongoingrisks for a retailer.RJ: And what are the greatestcompliance program challenges fora retailer?JM: Awareness - 7,000 stores, corporate,distribution - each piece ofthe organization worries about differentissues and requires differentcommunications methods.RJ: Do you report directly to theboard of the directors? How often?JM: Yes, I provide a report to theAudit and Compliance Committee atevery Board Meeting, which occursonce a quarter. I also meet with theAudit and Compliance CommitteeChair, prior to the Committee meeting,to review any issues that needto be reviewed and/or addressed.RJ: How has Sarbanes-Oxleychanged your relationship with theboard?JM: Sarbanes-Oxley has put regulatoryrequirements in place withregard to actions required to betaken by the Board of Directors. Asa result, boards in today's corporateclimate are much more active inoversight of the compliance function.I believe that this, in turn, has providedgreater support for corporatecompliance programs, which maynot have been as strong in the past.RJ: What is the board's mostimportant role in your complianceprogram?JM: Oversight and interest in thecompliance function of the company.As each independent boardmember comes from outside of thecompany, each member bringsideas and suggestions on how theprogram could be strengthened.This outside view has enabled us tobetter our program, based on elementsthat have worked at othercompanies. Additionally, our boarddoes a great job of asking questionsto better understand the programand issues that we address on aregular and not-so-regular basis.RJ: Have the recent changes in theUS Sentencing Guidelines causedany changes in your program?JM: Yes. Last year we began toformalize and standardize existingcorporate compliance functions intowhat is now our current Ethics andCompliance Program. We alsolaunched our hotline to complywith Sarbanes Oxley requirementsand are getting ready to launch ourweb-based Code of Ethics trainingthat will be mandatory for allSociety of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgRORY JAFFEContinued on page 22February 200521

Meet Jolene Miller... continued from page 25A Long Way…Maybe... continued from page 17employees, both corporate andretail. The amendments furtheremphasized the need for ethicstraining for all employees andbrought the need for such trainingto the forefront of senior managementand our Board of Directors,which gave our department a highlevel of support for our systemic initiatives.RJ: How do you change organizationalculture to encourage everyoneto act ethically and lawfully?JM: Change in organizational culturestarts at the top of every organization.While every team member isresponsible for acting ethically andlawfully, senior management and theBoard of Directors must hold individualsaccountable for their actions,whether by reward or reprimand.RJ: Some people believe that anethics program is only "windowdressing"-areal compliance programemphasizes enforcement and discipline,not "doing good." What isyour opinion?JM: An ethics program isn't justabout "doing good". It is about providingthe foundation for doing theright thing and giving team membersa means to ask questions whenthey are unsure of the appropriatecourse of action. A strong complianceprogram, including enforcement,discipline, and reward, is acritical component of an overallethics program. ■enforced consistently throughoutthe organization through appropriateincentives to perform inaccordance with the complianceand ethics program…"These requirements are groundbreakingin that they focus on thenecessity of an organization toexamine its culture and ask thequestion "Do we have a culturewhere doing the right thing is themost rewarding choice to ouremployees?" That's a tough questionto ask, and even a harder one toanswer.Now, there is going to be a lot oftalk in compliance circles about"culture", and I imagine that a lot ofconferences and programs will nowfeature that as a topic. In fact, thespeaker following me is going todiscuss that very issue. Again, Iwould remind you of one thing-it'sall about the behavior. This time it'sabout management's behavior.Ever hear the saying,"Management's actions are so loudthat the employees can't hear whatthey're saying?" The developmentof a compliance culture requireslooking at not only the elements ofyour compliance program, but athorough, and sometimes painful,examination of what is really beingreinforced in your organization, andthen setting about to craft a behavioralsupport system that trulyembraces ethical conduct and regulatorycompliance.Business ethics and complianceprograms are no longer the noveltythat they were 13 years ago. They'rehere to stay. If we look at 1991 asthe beginning of the formalizing ofthis process, then we are looking atan organizational activity that isentering its teen years. A transitiontime from immaturity to maturity.With the new changes in theGuidelines supporting us, those ofus who are in this profession havean opportunity to grow and manageour programs in some very meaningfulways.In writing this presentation, I wasreminded of the story about theproud parents of a five year oldchild who they believed was thenext Chopin. As luck would have it,a famous pianist was coming totheir town and, after much persuasionby the parents, agreed to hearthe boy play. The day of theappointment arrived and the proudparents brought the child to theconcert hall. The master politely listenedto the boy play and turned tothe parents and quietly said, "Yourchild plays the notes very well, butin order to be great, he will have tolearn to play the music."That is where we are today withmost corporate compliance programs.Most of us play the notesvery well. The challenge in thecoming years will be for us to moveonto the next level, to create thatculture of compliance within ourorganizations. When we do, we willhave learned to play the music, andonly then will we have truly come along way. ■February 200522Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200523

C ORPORATE C OMPLIANCE & ETHICS:G UIDANCE FOR E NGAGING Y OUR B OARD"This video provides anoverview of the Boardsrole in compliance."Odell GuytonSenior CorporateAttorney, Director ofComplianceMicrosoft Corporationwww.corporatecompliance.org“Its pretty clear that thebest compliance programin the world ismeaningless even if it’sfunded with a good wellmeaning complianceofficer if the leadershipof the company is notbehind it and isn’t supportive…”Bringing the vision ofleadership togetherwith a compliant andethical cultureHonorableMichael E. Horowitz,Commissioner, UnitedStates SentencingCommissionOrder Today!Non-Members $395 SCCE/HCCA Members $345Name:Title:Company:Total Payment $ ______________ Purchase Order # _____________ Check/Money Order VISA MasterCardAddress:NumberExp. DateCity:State:Phone:Fax:Email:Format: DVD VHSMail to: SCCE5780 Lincoln Drive, Suite 120Minneapolis, MN 55436Phone: (888) 277-4977Zip:Name of Card HolderSignature of Card HolderCode: CE1104Please make check payable to:Society of Corporate Compliance and Ethics (SCCE)FAX: (952) 988-0146Online: www.corporatecompliance.orgEmail: info@corporatecompliance.org

4TH ANNUAL NATIONALSYMPOSIUM ONCORPORATE RESPONSIBILITY:COMPLIANCE & ETHICS PROGRAMSA National Cross-Industry SymposiumDesigned to Address Today’s Issues ofResponsible Corporate Governance.SAVE$100When You RegisterBefore May 1• Effective Compliance Programs• Sarbanes Oxley• Innovations in Ethics Strategies• USSC Guidelines• Current Settlements• Legal Pitfalls & Obstacles• Gaining Buy-InSeptember 12-14, 2005Chicago Downtown Marriott, Chicago, ILSociety of Corporate Compliance and EthicsThe Corporate Compliance Professionals’ Associationwww.corporatecompliance.org25

Become a member today!NEED TO DISCUSS DIFFICULTCOMPLIANCE ISSUES?SCCE can help! As an SCCE memberyou’ll have access to top-levelinsights and working solutions.Meetings, conferences and theSCCE Membership Directory allafford you valuable opportunities todiscuss difficult issues like...Standards of ConductSarbanes-OxleyCompliance Program DesignCompliance ResourcesProtection from Fraud and AbuseBenchmarking ToolsBest Practices ForumJob DescriptionsIntegrating Software SolutionsSelf AssessmentsTraining ProgramsCompliance AuditsThe SCCE is the only non-profit organizationsoley dedicated to improving corporatecompliance.Who Joins SCCE? Executives, managers, officers, and directors of corporations,institutions, government agencies, individual and group providers and entrepreneurs,in all segments of the corporate industry!Corporate compliance includes numerous issues such as ethics, education & training,Sarbanes-Oxley, SEC, Auditing & Monitoring procedures, Investigations, enforcementand due diligence to prevent and detect violations of law.You may already have a strong compliance program in place, but changing timesdemand more. Would you like to join developing a culture that says, “Let’s do it right!”helping your staff do more than the minimum and expanding your professional resourcenetwork. Here’s your opportunity! Let SCCE membership help to move you and yourorganization closer to a total compliance spirit.A pro-compliance mindset is a must for all of us involvedwith corporate compliance.WELCOME TO OUR SOCIETY!The SCCE website offers an onlinemembership directory and specialinterest forum to faciliatate networking!

Make Compliance Part of YourCorporate Culture!MEMBERSHIPSERVICES INCLUDEEDUCATIONALPROGRAMSPROFESSIONALNETWORK-LOCAL CHAPTERS-COMPLIANCE FOCUS GROUPSNEWSLETTERSAND MEMBERUPDATESMembership ApplicationPLEASE ACCEPT MY APPLICATIONFOR SCCE MEMBERSHIP!YY es! Individual Membership ($250) Multiple Employee Membership ($200/ea.)(4 or more employees from same company) Corporate Membership ($1,500) Government, Academic & Student ($150)INTERACTIVE WEBSITEWWW.CORPORATECOMPLIANCE.ORGANNUAL NATIONALCONFERENCECOMPLIANCEWORKSHOPSPlease type or print:FIRST NAMEDEGREE(S) / LICENSE(S)TITLE(S)COMPANY / INSTITUTIONDEPARTMENTTOTAL:LAST NAMECOOPERATIVEPROGRAMS...WITH OTHER NATIONALORGANIZATIONSMEMBER DIS-COUNTS...AND MORE!SCCE MISSIONSCCE exists to championethical practice and compliancestandards in thecorporate community andto provide the necessaryresources for complianceprofessionals and otherswho share these principles.MAILING ADDRESSCITY STATE ZIPTELEPHONE ( )FAX ( )EMAIL ADDRESSPAYMENT INFORMATION: Check enclosed Charge my credit card: MasterCard VISAACCOUNT NO.NAME ON CARDSIGNATURE EXP. DATE /Federal Tax ID: 23-2882664Prices subject to change without notice.MAJOR FUNCTIONS• To promote quality complianceprograms and tointroduce and maintainthem•To provide a forum forinteraction and informationexchange•To enable our membersto contribute to thedevelopment of industrystandards and excellencein compliance programs•To create vital and timelyeducational opportunitiesfor the rapidlychanging corporate complianceindustryPlease make your check payable to SCCE.For credit card orders only, fax your order form to: (952) 988-0146.Send your order form to:Society of Corporate Compliance and Ethics5780 Lincoln DriveSuite 120Minneapolis, MN 55436For information call (888) 277-4977 or email info@corporatecompliance.orgSociety of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200527

Corporate Compliance2005 WorkshopsRegister by April 1, 2005 and save $100May 16 • New York, NYMay 17 • Cincinnati, OHMay 23 • Minneapolis, MNMay 24 • Chicago, ILFailure to Comply• Boards role in assuring the integrity of the organization• Examples from recent corporate scandals of board oversight failuresDan RoachVice President,Compliance & AuditCatholic Healthcare WestCase Study: A Local Perspective• Local compliance and ethics professional• Challenges and changes for today’s professionalFoundations for Compliance with USSC Guidelines and Sarbanes-Oxley• Members of the Sentencing Commission and its staff will explain the genesisand rationale of these developmentsSetting up an Effective Compliance & Ethics Program• A to Z overview to establish an effective compliance programManagement and Accountability: A Practical Discussion• Effectively implement a compliance program• Tips for effective communication and implementationPotential Legal Pitfalls and Obstacles• Legal and Practical Issues• Techniques to obtain compliance buy-inJoe MurphyPartner, ComplianceSystems Legal GroupVice ChairmanIntegrity Interactive CorporationRegister Today and ReceiveThe Complete Compliance and Ethics ManualFREE a $315 Value!Society of Corporate Compliance and EthicsContinuing Education Credits: CLE, CPE/NASBA, ACHE, HCCB