Risk Management is Now Everyone's Job
Risk Management is Now Everyone's Job
It is a pleasure to again participate in the International Anti-Corruption Convention. Two years ago, the 1600 delegates from 135 countries attending the Durban meeting gave evidence that a global consensus of governmental, non-governmental, academic, and business leaders is now willing to address corruption in a serious way.
The belief that business institutions can do much to cut off corruption's supply side is one of the Durban Convention's most important legacies. This session and others to follow in the next three days seeks to describe and to document company efforts to make anti-corruption principles operational. Our charge is to give full force and effect to The Convention mandate to provide participants with a practical and action-oriented meeting that focuses on case studies, concrete strategies, and impact assessment.
In a sense, business people have much to contribute to this discussion. They are not strangers to case studies, concrete strategies, and impact assessment - they use these devices routinely to devise and execute their plans. In spite of their familiarity, for most companies, the additional challenge posed in application of these forms and methods in addressing management problems in a global economy are new.
So the question "Risk management: are ethics programs the answer?" cannot be answered "obviously they are." In addressing this question, we need to examine its underlying assumption that ethics programs can even be devised and implemented in transnational companies. And if they can, do they offer an effective means of managing risk?
For the past two years I have been studying how companies utilize ethics programs to manage corruption's risk to reputation and the bottom line. I have examined systems from all parts of the world - most recently, as part of a Conference Board - World Bank project, I have had detailed discussions with corporate and company managers in the East Asia Pacific region.
The Three Components of an Effective Program
Both East Asia Pacific programs and those anti-corruption methods and strategies from all industries and regions of the world that were documented in an earlier report have three components: (1) values statements; (2) delivery mechanisms; and (3) warning systems.
The challenge is for companies to formulate and disseminate core principles and procedures that are consistent with those principles while also calibrating each of the three components to the distinctive requirements of local business cultures. In particular industries such as extraction or where local substantial ownership may be typical or required as in the case of China, the need for formulation of values and adaptation of processes in accord with local custom is more than an intellectual exercise. It is part of the give and take of the governance process.
The good news is that effective programs not only have these three components but that whatever variables are present (governance structure, industry, culture), in their most fundamental respects, these individual components look pretty much alike:
Values: Ethics programs that effectively respond to risk management needs are part of an inclusive process that draws upon the company's collective intelligence and experience. Employees from all regions, businesses and job categories participate in surveys, focus group meetings and discussions to formulate and design the values statements, delivery mechanisms, and warning systems. For example, as part of its most recent code drafting process, Merck surveyed 10,000 employees (22 percent of its workforce). The process is dynamic and each individual component is periodically reviewed for relevance and assessed for effectiveness.
The second critical element of the values formulation component is that the company's leadership is actively involved. Within the last 15 years, Conference Board surveys have documented a steady increase in all regions of the involvement of board members and senior executives in the formulation and delivery of ethics programs. For example, in our 1987 survey we found that 21 percent of the company boards had a role in ethics programs and the figure for our 1999 survey was 78 percent. Almost one-third of the companies responding to the most recent survey characterized their board's involvement as "heavy".
Delivery mechanisms: Consistent with the view that every employee's conduct exposes the company to some risk, most programs now require that all employees have at least some familiarity with the company's codes and practices and discussion of their practical application.
Senior executives and employees involved in critical functions such as sales or procurement will typically participate in more extensive training efforts.
Case studies, often drawing upon company experience are invariably part of ethics program discussions. Sometimes at the insistence of the company, and in an increasing number of cases at their own request, there is a growing involvement of suppliers and, to a lesser but significant extent, joint venture partners, in these exchanges. Companies have a strong preference for using their own senior executives as trainers. Where consultants are involved, it is often to "train the trainers."
Warning systems: Of the three ethics systems components, it is in the introduction of warning systems that companies confront the most stubborn cultural resistance. Research and company experience affirm that there are successful warning systems in most regions and industries and that vague cultural generalizations about the unwillingness of people in certain cultures to use these systems lest they be regarded as "informers" is vastly overstated. For example, a Shanghai country manager whom I interviewed recently said: "we have a reasonable utilization of whistleblowing in China. The volume of complaints may not be as high as in the US but we do get them. And roughly 40 percent of the informants identify themselves."
It may be that resistance to whistleblowing systems is rooted more in the company's culture than that of the country in which it is doing business. Where there is an environment of trust and it is understood that the reporting system is seen as a place to get advice rather than to report improprieties, there is likely to be greater usage and the channel will function for its intended purpose as an early warning system and method for preventing rather than detecting abuse. Companies with effective systems report that it takes time and that most hotlines or helplines evolve from an initial stage when employees call in with every kind of complaint, to a phase where legitimate irregularities are discovered to the final stage where callers seek advice and in obtaining it, are effectively counseled to avoid bad decisions.
Are Ethics Programs Effective Risk Management Tools?
There are good programs. It is possible to devise them, they exist, and they are culturally adaptable. How effectively do they manage risk?
Whether it is a US or non-US company, most managers agree that if you are doing business in the US, a good compliance system will minimize the adverse consequences of an employee's ethical lapses. The 1991 Corporate Sentencing Guidelines provide for substantial mitigation of corporate fines if the company can demonstrate that it has an effective compliance system.
Australian business practice is even more emphatic about the need for compliance. In Australia, AS 3806 (Australian Standard) codifies the necessary structural, operational and maintenance elements for an effective anti-corruption compliance program. These components are quite similar to the characteristics of the ethics programs that I have just described: (1) high level commitment; (2) statements, policies and operating procedures; (3) management responsibility, supervision and resources; and (4) record keeping and reporting.
The rationale of the Sentencing Guidelines and AS 3806 is clear. The most effective way to achieve high levels of compliance is offer companies incentives to develop their own systems and to penalize them heavily for failing to do so. Heavy penalties mean just that. Hoffman-LaRoche was fined $500 million for vitamin price-fixing. That was a criminal penalty. Daiwa Bank was assessed a $340 million civil fine. Had the court determined that these companies had effective compliance systems, these fines would have been substantially lower. And the reasoning is that if the company had such a system, the behavior that caused them to incur the fines might not have occurred.
There are arguments against these propositions. First, are compliance and ethics systems the same thing? A growing number of companies, particularly in the US, are saying that their ethics programs are values and not compliance based. If the purpose of these efforts is not compliance, then perhaps ethics programs exist apart from necessary compliance systems. I have read the codes of companies that characterize their systems as values based. In some cases, the program language fits the description but in many cases, it does not. This outcome is not surprising. The ethics system's purpose is to obtain high levels of employee and company legal compliance and there are not very many non-coercive ways to do that. Not surprisingly, some companies think that softening the tone is the best way to deliver that kind of a message.
The disparity between tone and actual content is revealing. Companies recognize that compliance systems are most effective in environments of trust where employees feel free to used warning systems to ask questions and, if need be, report possible improprieties. A community committed to a common set of purposes and values is one in which there is likely to be the highest levels of trust. Hence the desire to be a values based organization and, in a company worthy of the name the utilization of a periodic and inclusive process for articulating corporate ethical commitment.
Companies do say that it works. And one might well ask, what is the alternative in global business environment that increasingly emphasizes voluntary compliance methods? The trend in imposing more responsibility on companies for compliance and, should it be necessary, investigation, is a logical development. Company self-monitoring is potentially more cost effective and efficient. The utility of this approach is especially compelling in the many countries that have limited law enforcement resources.
So I will end this talk and begin our discussion with the proposition that in risk management (particularly within the context of global business practice) ethics programs are part of the solution. Moreover, they represent a development in the last century's trend toward the devolution of power to smaller, more responsive units. Some responsibility for investigation and enforcement has devolved to the company and the duty of compliance now rests more heavily than it has in the past on the individual. Risk management is now everyone's job.