Compliance &Ethics - Society of Corporate Compliance and Ethics

Featureinclude the protocols you need in order toexplore the ripple effect within the companywhen it has made this decision. Once thepotentially affected departments, businessunits, operational functions, and outside stakeholdersare identified, the work of makingappropriate changes to policies, procedures,and actual behaviors begins.What behaviors will demonstrate compliancewith this decision? Each impactedemployee position should be considered,as well as actions of the officers, producers,vendors, and even possibly board members.What factors in that behavior are measurableand how are they quantifiable? Short-term,mid-term, and long-term behavior measurementsshould be incorporated into theanswers. Depending on the magnitude of therisk potential, what disciplinary actions oughtto be incorporated into the protocols? Whatdeterrent actions is the company legally andethically prepared to take across all stakeholderlevels?Designing thepolicies and procedureswill take time.The support neededto successfully navigatethis risk mayrequire significantchanges to someemployees’ dailyactions. Training andimplementation—ifyou truly imbed thenew procedures intothe workaday lives ofyour employees—could also take some time.Once that process is well on its way, compliancewith and effectiveness of the newactivities will need to be determined. Howwill the company help ensure that thosechanges to behaviors stay in place? Employeeengagement and accountability should beSome changes maycall for an even moreintensive structure,a combined approachof both ongoing andregular monitoring,and regular follow-upassessments.included in that oversight. How will the activitiesthemselves or the effectiveness of thoseactivities be checked after they are instituted?Confirming the changes in behaviorThe two basic ways to structure “checkback”functions on procedures, actions, andaccountability are ongoing monitoring oran after-the-fact audit (meaning operationalassessments, rather than financial). Somechanges may call for an even more intensivestructure, a combined approach of both ongoingand regular monitoring, and regularfollow-up assessments. The use of these toolsmay begin on a heightened schedule, but thefrequency can be lowered as consistent completionof procedures and the reliability of theiroutcomes builds more confidence internally.A note of caution, however. As familiaritywith the procedures grows, the effectivenessof monitoring and/or auditing may weaken.Two factors could be at work here. One is thatthe monitoring maybecome less rigorousbecause of the level ofconfidence reached.Second, as procedurescontinue to grow andchange, the assessmentsmay not stayin step with thosechanges and maybecome less effective.Which of the twoconfirmation methodsyou select candepend on those threeinitial factors mentioned above: the severity,management capability, and likelihood of therisk. It can also be influenced by the regulatoryand hierarchal structure of the company,the number of employees and resources available,and the methodologies already in use forsimilar risks. For instance, if regular, quarterlyCompliance & Ethics Professional May/June 2013+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org 35