Monthly Archives: September 2017

Moving Back In-House to Move Compliance to the Next Generation

Moving Back In-House to Move Compliance to the Next Generation

The following interview is with Nicole Rose, Head of Risk and Compliance, Uniting Resources NSW and ACT. As you may recall, Nicole and I co-produced the anti-bribery training animation, “Why We Say Yes,” of which the trailer can be found here

RB: So, Nicole, I heard you have changed roles, so why the change?

NR: Richard, as you know I have spent the past few years using my creativity to inspire, motivate and persuade people to increase their appetite for compliance and adopt better behaviors. However, I felt my work was missing a big piece of the puzzle. I realized the real work needed was not just in persuasion and inspiration, but also in having the right structure to ensure that Compliance could genuinely be part of an entire organization. From the work I did out in the field, I saw the benefit of really listening, caring, showing compassion and understanding the part of the organization I was dealing with and not just applying a ‘one size fits all’ approach from head office. In short, what I felt was missing was the right structure that allowed a compliance culture to properly develop from the grass roots up rather than from head office down.

RB: Can you explain a little more about what you mean about the right structure?

NR: Of course! A traditional compliance structure is hierarchical ‘tone from the top’. Compliance is usually delegated to the compliance function by the executive teams who then try to retain careful oversight of compliance. The compliance function will then, under the mandate of the executive team, make mandatory systems, processes and policies to the wider organization. However, as you know only too well Richard, the realities of the people on the ground do not always meet the vision of the leadership team. People working on the ground often have a different agenda or priorities to the compliance agenda. Compliance therefore ends up competing against other ‘more important’ day-to-day issues. In this environment we will always be playing ‘catch up, keep up and check up’ when it comes to Compliance.

RB: So how do we avoid this ‘catch up, keep up and check up’ environment?

NR: Let’s set the scene. Imagine that there is no hierarchical one size fits approach to compliance! Imagine an entirely different scenario:

  • Imagine if an umbrella framework was in place that had all the tools, resources, requirements, policies, training, communications, handbooks and tool kits relating to compliance which different parts of the organization can add to.
  • Imagine that instead of an organization dividing its compliance needs into business functions but communities of people.
  • Then let’s imagine that each community had the education and support to properly understand their risks and gaps and the consequences of not having compliance systems in place both at their level and also throughout the organization.
  • Then imagine that different parts of the organization shared resources, ideas, solutions, challenges and skills to help support the compliance mission.
  • Then imagine less oversight and tone from the top but more leadership throughout an organization through self-managing teams in communities who share a vision of compliance and help other parts of the organization to achieve that. In my view, communities can work to manage their own risks not by having more risk and auditors and regulatory experts but by utilizing the creatives, coaches, communicators, film makers, presenters and project managers who can actually bring compliance to life. After all, we all carry out our own risk assessments on a daily, hourly and often by minute basis (think of getting to work on time). We all have in place our own controls for managing our risks (think about the planning to get to work). And we all have our own communication and persuasion skills (think of trying to get your children to eat their breakfast). These skills can, with a little education, easily be adapted into compliance at work.

Let me break it down for you like an equation:

  • 1 central compliance vision +
  • 1 centralized depository of resources, tools and skills +
  • unlimited sharing of skills and support in a network approach =
  • a genuine culture of compliance at a deep level through self-managing teams.

RB: Nicole this all sounds very utopian. Do you really consider this could work in practice?

NR: Richard, as far as I can see we absolutely need to ensure that the grass roots of any organization owns its role in compliance. The head office approach to compliance does not work.

A network compliance approach is the framework upon which the grass roots in an organization can to work together with the leadership team and shared services on a unified compliance vision. As with any network, if you break a link, then the entire network can fall apart. Thereby, the community or part of the organization that breaks the link does not just answer to head office or even the regulator but to the entire network. I envision that the network itself is not built on rules or procedures but, instead, on trust, education, a joint vision and a genuine desire to care about their colleagues and the organization they work in.

RB: But how do you bring people together in this network?

NR: So the real work comes from properly setting up the structure so that people have a joined up vision. The vision I give to the people I work with is that: ‘together we can change the world through creating flourishing, safe and respectful communities’. If you have a powerful enough vision, people will listen. The art is to create a vision that moves people. FYI: regulatory investigations, legal and external requirements are often not a particularly good motivator. Motivators such as changing the world, being the best at what you do in the best way you can because of who the organization is rather than what it’s obligations are is usually far more motivating for people.

RB: But how about those people who simply don’t care and who are just focused on themselves?

NR: Richard the question should not be ‘how about’ but more ‘what should we do’ with these people. If these people exist in an organization then two things will happen within the right network structure. Firstly, their behavior will be different to the behavior of their colleagues and hopefully weeded out using peer pressure. Secondly, these are people that do not make an organization strong or grow in any area, particularly compliance. If their approach does not change to the organization then they clearly do not fit into the organization.

RB: So Nicole, where do you see the role of Compliance in the work you are doing?

NR: Richard there is no doubt that compliance functions and compliance professionals remain critical to any organization. We will still play an integral role in managing compliance risk. We are needed to set up and maintain the framework, educate, train, provide oversight and continuing policies, tools, resources and regulatory and legal guidance. In short, we will remain necessary, trusted advisers and guides to help support the network.

RB: Nicole where can people find out more about your work and your vision

NR: Richard I am inviting comments, discussions and debate about this approach. I will be continuing the conversation on LinkedIn and would be delighted if people would LinkedIn with me and give me their thoughts and ask me questions.

My LinkedIn profile is here, or contact me at [email protected]

Interesting article? Would you like to know more?

Contact Me


Ethics and Compliance Training, What Gets Results?

Ethics and Compliance Training, What Gets Results?

The following interview is with Dr. Patricia Harned, Chief Executive Officer of the Ethics & Compliance Initiative (ECI).

RB: Pat, it’s a pleasure to have you join us today, and thank you for sharing your report “Ethics and Compliance Training, What Gets Results.” So, first, given the proliferation of compliance surveys and studies, why did the Ethics and Compliance Initiative commission this paper? Did you see a gap out there in terms of understanding and information?

PH:  There is a lot of research on training, especially when it comes to the question of an online vs. in-person approach. But most of that research hasn’t been focused on the E&C field specifically. Ethics and compliance training has to meet at a lot of varied goals from teaching specifics about policy to, and this can be much more difficult, equipping employees with skills to recognize ethics issues in their work and to think through and deal with them effectively. 

This study is unique because it allowed us to look at company ethics training from both the employees’ and E&C practitioners’ perspectives.  We were able to explore what’s being done in E&C training and its intended outcomes alongside how it’s being perceived by and impacting those taking it.

RB: A few things stood out that I’d like to ask you about from the ‘trainee’ perspective.  The report addresses how “live in-person training is linked to far better results – even when the same activities are used.” I totally agree, and have recently been on a few ‘world tours’ where training gets rolled out across the globe, even one where the CEO kicked-off the sessions. But in today’s globally disbursed work-force, that’s a huge challenge. So, what are some best practices that you have seen in terms of the mix? In other words, are there hybrid approaches, integrating on-line, video,  and in person training, with various frequencies, that take such realities into account?

PH: I agree – there are some unique challenges for large multi-national organizations when it comes to training.  Among them, resources — be they time, money, or attention — are always finite (sometimes altogether scarce), and most practitioners want to use them thoughtfully.

A number of effective hybrid approaches do exist.  They have a positive impact not only because they addresses the practical considerations (e.g., a dispersed workforce, budget limitations, logistical challenges, etc.) but they also benefit the individual learner.  The key is to thoughtfully marry learning objectives with the format.  To teach and verify that employees have been exposed to specific policies that are related to their risk exposure, online, just-in-time training can be an excellent tool.   For example, online training can be used effectively to reinforce travel policies before employees go on the road, or to remind employees about the gift policy around the holidays.

At the same time, large organizations should consider using the most interactive strategies, and, ideally, in-person or live remote connections (via webcast, video chat, etc.) for working through thornier gray areas issues directly with managers. The time “together” (in person or using technology) allows for richer dialogue, more robust conversation, and better perspective-taking.

RB: I was very pleased to see the issue about leadership engagement addressed. Doesn’t this speak to the point about compliance messages sounding a lot ‘louder,’ and taken more seriously, when they are articulated with, or through, business leadership? I guess that’s tone at the top through dialog and action.  After all, compliance challenges are business challenges, and who best to communicate those issues? But how is that best done given the resource and time pressures on senior business leaders?

PH: One of the most important findings of the study was the significant impact that leaders have when they express their personal beliefs that the training is worthwhile.  It’s important that they send communications prior to the training to provide context and reinforce its importance.  And, after the fact, leaders should repeat the language of the E&C training to reinforce that it wasn’t a one-time event, but part of the lived experience of being an employee.

 Of course, it would be ideal to be able to actually have a senior leader present to deliver the training or to experience a training together, so that employees can hear their thoughts and understand their beliefs in the moment.  But we know that’s not feasible for many companies.

There are many different strategies companies can use to make sure that senior leaders are “in the room” even when they physically can’t be.  One of the most frequently used methods is to record an audio or video message by the CEO or senior executive, and to use it as an introduction to a training session or online module.

RB: Let’s talk about interactive strategies, and there’s some great thought leadership about this issue, including Mary Gentile’s “Giving Voice to Values.” From my perspective, this is critical. I think there’s a real need to better prepare people for the real-world ethical and compliance risks that they might face in their work, before they are in the middle of it. Furthermore, so many of these scenarios are predictable, but it’s not a ‘one size fits all’ problem or solution. So, given these challenges, have you seen any best practices or interactive strategies that compliance leaders might consider?

PH: I’m a big fan of Mary Gentile’s work, too.  What she found, as you know, is that the more an employee has opportunities to “practice” voicing and resolving ethics issues, the more likely it is that he or she will take appropriate action when a real-life situation occurs.  To add to that, my background is in character development, and one of the core concepts of that body of work is that people are most influenced by the individuals in their lives who are their role models and authorities. 

All of this plays out in the findings of the study we conducted.  As you saw in the report, the data definitely supports using interactive and real-life strategies, so that they are not only relevant to employees’ work, but they provide an opportunity for an individual employee to learn from others.  These methods are even more powerful when employees can work through the training with their supervisor or another member of management. It makes a lot of sense, when an ethics issue surfaces, circumstances can have a tremendous impact on the options for resolution, confounding issues and pressures, and it’s not easy to determine which road is the best one to take. There is often a lot of nuance and the most informed person to help an employee discern the best choice is an immediate supervisor.  To go back to Mary’s work, training helps employees to “practice” voicing their ideas with their manager, so that when a real-life situation arises, they are prepared.

The closer you can simulate the real-life experience, the better employees will be equipped to handle it.  Case studies are a great tool in that regard. They work best when they’re relevant. The time you invest in developing case studies that speak to real, lived experiences of employees and the challenges they face will come back to you ten-fold. You can enhance relevance and applicability by pulling topics from actual cases and by asking employees for ideas. If you have a menu of cases to choose from, you can have employees work through the ones that are most useful to their level, their work, even their employment experience if they’re new to the workforce.

Roleplaying allows for perspective-taking and gives employees simulated practice in addressing ethics issues. There can be a secondary benefit if you ask employees to take on a role outside their scope of work. For example, asking employees to walk in the shoes of a reporter or someone who feels vulnerable can help them become more thoughtful and empathic. Or you can encourage managers to feel what’s like to be their reports or vice versa.

In our research, we found the most useful strategy was working through dilemmas, which overlaps quite a bit with the other two. There’s a lot of value there because you can address challenges in a nuanced way and, especially, because you can provide a language and a model for seeing the ethical dimension of work and meeting the challenge in a positive way. 

Finally, never forget the critical importance of making the session as fun and interesting as possible. That can be done by adding gaming elements or even just making sure that the cases you have are written in an engaging way. Make it a positive experience and people will be more invested and learn better.  Get the conversation started!

RB: Finally, it seems like there is still tension between training that’s rules focused, as having a legalistic approach to compliance, versus a value based approach, which revolves more around ethical awareness as impacting behavior in a broader sense. As the report well states, in this sense, it’s about “ethics and compliance training as important to business success.” Tenbrunsel and Bazerman in “Blindspots” address how when training is rules, policies and procedures focused, that it can “contort” the decision-making process.  Pat, it’s a tension I continue to struggle with, so I’ll ask you: Does a compliance program that’s designed to be defensible to the regulators, necessarily mean that’s it’s understood and embraced in the field as a partner to business success? If  not, how can both ‘rules and ‘values’ get addressed in a way that makes sense to the tasks at hand to those in the field?

PH: It’s critical to give employees factual knowledge about company policies and regulations.  In that sense, a focus on compliance is not only useful, it is essential.  However, training about specific rules and regulations sends a message to employees about what they “should not” do.  That doesn’t automatically translate into guidance about what employees “should” do, or how the company wants them to act when they have to make a difficult decision.  That’s where a focus on ethics – and even more specifically, the core values of the organization – becomes an important supplement to compliance training.

In talking through this research with practitioners, that came through loud and clear; the value of a “both-and” approach.   Online training can work really well for training on compliance-based topics, and it has the benefit of being very “trackable.” More interactive strategies, especially those that involve conversations with managers and coworkers, go a long way in prepare employees for real-world complexity. And, this is critical, they start a conversation about ethics—which really should be ongoing.

One last big takeaway: an effective ethics and compliance training program does involve time, effort, leadership commitment, thought and thoughtfulness. Employees can spot the difference between quality E&C training and one that only checks-the box. That in and of itself sends a powerful message about how much your company care (or doesn’t care) about doing the right thing.

Pat, thank you again. It was a pleasure to welcome you to my blog, and for those who want to see the survey and findings, where’s the best place to get that information?

 Many thanks, Richard, for the opportunity. Please visit:

 Dr. Patricia Harned is chief executive officer of the Ethics & Compliance Initiative (ECI)  ECI’s mission is to empower organizations to build and sustain high-quality ethics and compliance programs.  Dr. Harned oversees all of ECI’s strategy and operations and also directs outreach efforts to policymakers and federal enforcement agencies in Washington, DC.  Additionally, Dr. Harned speaks and writes frequently as an expert on ethics in the workplace, corporate governance, and global integrity, and advises senior leaders on effective ways to build an ethical culture and promote integrity in organizational activities.