The Compliance and Ethics Blog

SCCE/HCCA

Ethikos Editor’s Weekly Picks: Happy Birthday Sarbanes-Oxley: Let’s Talk Global Ethics and Regulation

by Leave a Comment

Examining ethics and compliance issues in business since 1987

Happy Birthday Sarbanes-Oxley: Let’s talk global ethics and regulation

By Dina Medland for Forbes
Are you confident your employees will report unethical behavior?  Less than a third of C-suite and other executives- or 32.5% — polled by Deloitte are willing to say that they are, giving fresh impetus to an ongoing debate Read more

Who is your business hero

By Elliot Begoun for Huffington Post
We all have them, heroes. Those people whom we try to emulate, our teachers, trail blazers, and mentors.

I lost one of those this week. Norman McClelland, the former Chairman of Shamrock Foods Company, passed away this week at the age of 90.

To me, Norman was presidential, regal, a man of deep integrity. He was my hero. Read more

Compliance professionals: What should they monitor in anticorruption?

By Henry J. Schumacher for Business Mirror
I recently wrote about the arrival of a new tribe: the compliance professionals, and indicated the areas where their services are needed in organizations. Today, let me focus on specific tasks which are in line with the control processes the Integrity Initiative has developed over time. What are those tasks that he or she has to monitor? Read more

Two-thirds of corporations ignore corruption in their supply chains

By Jonathan Webb for Forbes
A recent report by the Economist Intelligence Unit has revealed a significant shortfall in the ethical performance of major corporations in supply chain management. Fewer than a third looked to address corruption and bribery issues with their suppliers. This was despite respondents high regard as to their company’s sustainability policies. Read more

How Uber can emerge from its scandals as a more ethical company

By Andrew J. Hawkins for The Verge
To put it lightly, Uber has had a rough couple months. After the departure of its CEO Travis Kalanick and many of his top deputies following several months of nonstop scandals and controversies, the company finds itself in the unique position to hit the reset button. Naturally, a lot of experts and pundits have been weighing in with a variety recommendations for how Uber can rebuild its tattered image.

But a new coalition of labor unions, accessibility advocates, and consumer rights groups has emerged with its own list of suggestions. This group is urging Uber to look beyond the insular world of its employees, board members, and investors to a much broader one that includes hundreds of thousands of drivers and millions of customers. Read more

 

 Join SCCE and become part of the compliance profession

Subscribe to ethikos

The most interesting business ethics, culture and leadership articles delivered right to your email every week! Browse selected articles for inspiration, tips and great ideas on how to implement and maintain a healthy business culture. Stay on top of new insights, how-tos, and interviews from around the world—all from the comfort of your desk. Subscribe now.

ethikos is a publication of the Society of Corporate Compliance and Ethics

SCCEnet SCCE's Compliance & Ethics Blog SCCE on LinkedIn Twitter Facebook Google+ YouTube Twitter

Avoiding a Turf War with Human Resources

by 1 Comment

By Kristy Grant-Hart
KristyGH@SparkCompliance.com

How do you work with Human Resources? Do you have a good relationship?  If so, why and how?  These are the questions I’ve been asking my compliance friends in a survey I’ve created to get the answers straight from the experts – YOU!  I’ll be taking your answers (anonymously of course) and putting them into my presentation at the SCCE Conference in Las Vegas.

What have I found so far that can help us avoid the dreaded turf war with Human Resources?  Four answers have emerged. [Read more…]

Statistical Sampling

by 1 Comment

By Christopher Haney, CPA, CFE, CHC
Forensus Group, LLC
Overview

Statistical sampling and extrapolation is an increasingly common practice in compliance auditing and litigation matters. Consequently, compliance officers and counsel should be aware of the techniques, strengths, and limitations of using sampling for the purposes of estimating valid and meaningful conclusions. This post provides an introduction to the steps involved in conducting defensible and meaningful statistical sampling analysis, along with a discussion of important terminology and considerations for interpreting sampling conclusions.

Introduction to Sampling

Sampling analysis is most commonly used when one seeks to infer useful information about a relatively large population without examining every unit in the population by examining only a subset of that population (i.e. a sample).  As part of sampling analysis, estimation or extrapolation is a procedure by which measured characteristics of a sample yield estimates, inferentially, about unknown characteristics of the population from which the sample was drawn.

In a simple example, one might select a sample of students from a school, measure characteristics of those students such as grade point average, and then use this data – inferentially – to estimate (i.e. extrapolate) grade point averages among all students at the school, in general.  Sampling methodologies are described at-length in textbooks, journals and various industry guidelines, and are capable of producing useful results when properly applied. [Read more…]

Compliance Policy Simplification Coordinator? The Nature of Policies

by 2 Comments

By Roy Snell
roy.snell@corporatecompliance.org

Policies are often conceived of for good reason, but those who write the policy tend to make the policy more complicated and potentially onerous than is needed to achieve the spirit of the policy. People occasionally suggest a policy that inconveniences many people be written to address an issue that rarely ever happens. Occasionally, the people who ask for the policy are the people inconvenienced by the policy. The point is, the law of diminishing returns can apply to policies too.

Employees often say things can’t get done quickly because of all the bureaucracy. A strong leader can reduce this problem, but not without criticism associated with refusing to write a complicated policy every time someone demands one. Bureaucracy is a choice; however, for some reason, it must be a tough choice because we all end up with so much bureaucracy.

Having no policies is possible, however, it is a ridiculous idea and most everyone seems to agree with that perspective. Having some policies is possible and necessary, and most everyone seems to agree with that perspective too. What we seem to have trouble agreeing on is when to stop writing or unnecessarily complicating a particular policy.  Some people think more is better. Some people think the more complicated their creation is, the better their creation is.  People often write policies to cover every eventuality regardless of the odds that a particular eventually will occur. As a result, some policies become more problematic than the problems they are intended to prevent or fix. I have watched people question where all the bureaucracy comes from while they are creating more bureaucracy.

Somehow we don’t see the negative downstream impact of an onerously written policy as we write it. We all get a little indignant occasionally about an issue and passionately pursue a good policy relating to the important issue.  I am all for developing policies.  I am just suggesting that we should be more careful about writing policies that have negative unintended side effects on people and companies. We should revisit the wording of policies every once in a while to see if the policy is still needed or if the policy has had unnecessary negative impact that can be easily fixed.  Although I doubt it will ever happen, I would consider creating a position of Compliance Policy Simplification Coordinator. They would wander the organization looking for good intentions gone bad and work with the department to unwind the unnecessary bureaucratic unintended consequences of a policy.

[clickToTweet tweet=”Compliance Policy Simplification Coordinator? The Nature of Policies” quote=”Compliance Policy Simplification Coordinator? The Nature of Policies” theme=”style3″]

Raising the Bar on Fraud Protection & Money Laundering

by Leave a Comment

By Mark Dorosz
VP of Compliance Learning, Interactive Services

The quality and effectiveness of an anti-money laundering compliance program depends on commitment, continuous training and executive oversight. The best time for employees to identify suspicious activities is before transactions are completed, so these industry best practices will ensure transparency and high quality protection.

Impeccable Leadership

More and more companies are hiring chief compliance officers (CCOs) to help oversee their financial operations. The SEC states that CCOs play a critical role in maintaining financial integrity. They generally have three primary duties. First, policy management through defining, training and communicating corporate procedures. Second, compliance monitoring through measuring organizational adherence to standards. Third, investigation management through thoroughly examining and responding to violations. They usually collaborate with risk, legal and financial departments to resolve issues and maintain programs. [Read more…]

The Components of Strong Cybersecurity Plans Part Five: Penetration Testing

by Leave a Comment

By Mark Lanterman, Chief Technology Officer, Computer Forensic Services
Carolyn Engstrom, Director of Corporate Compliance

In the fifth and final installment of this cybersecurity series, I will discuss the role of penetration testing in developing a strong security program. As described in my previous four articles, a growing awareness of cybersecurity regulations, trends, and threats has led many organizations to request a penetration test of their technical infrastructure—without really knowing what that means, what its purpose is, and what degree of assurance it really offers.

When I ask if they have already conducted a security assessment, know their controls, have implemented regular vulnerability scanning, and have security auditing procedures in place, they usually respond with “That’s what we’re asking for. We want a penetration test”. In this way, penetration testing and all the other components of cybersecurity plans have become synonymous terms. This conflation is especially prevalent in small to medium-sized firms. However, each component is separate and distinct within a mature security program all serving different purposes, leveraging different methodologies, providing different levels of assurance and benefits, requiring different skills from the assessor, providing different deliverables, and are performed at different stages of a security program’s development. In order to reap the most benefit from a penetration test, the organization should be able to answer the following five questions based on the previous maturity assessment, security risk assessment, and security audits.

  • Do we know what is connected to our systems and networks at all times?
  • Do we know what software is running, or trying to run, on our systems and networks?
  • Are we continuously managing our systems using “known good” configurations?
  • Are we continuously looking for, and managing, “known bad” software?
  • Do we limit and track the people who have the administrative privileges to change, bypass, or over-ride our security settings?

A penetration test is an attempt to defeat boundary defenses and gain access to an organization’s internal network by exploiting vulnerabilities. This test is used to determine whether an unmitigated risk exists. In this sense, it tests whether an outside attacker could bypass perimeter controls, gain access to the internal network, and establish command and control capabilities. Many techniques can be employed during a penetration test including vulnerability scanning and social engineering attacks.

Social engineering attacks are targeted at exploiting the human vulnerabilities in an organization. Spear phishing emails, unauthorized issuing of credentials, and taking advantage of physical vulnerabilities can all be examples of ways in which an assessor will use social engineering during a penetration test.

If a security assessor is unable to stage a successful penetration test, this confirms that, taken as a whole, internal controls are operating effectively to externally protect the organization from threats. With these results, management may mistakenly assume that the organization is secure. However, unlike broader security audits, a penetration test provides limited assurance to a specific point in time. Depending on the timeline, results could vary substantially. A penetration test conducted one day could fail to reveal serious vulnerabilities that appear the next day. Risk levels are always changing, which is part of why a complete understanding achieved through maturity assessments, security assessments, security auditing, and regular vulnerability scanning is so critical. Penetration testing provides only a glimpse of an organization’s overall security posture.

Ultimately, a penetration test is only a fraction of developing a strong cybersecurity plan. However, the fact remains that it is very important and these tests are frequently required for compliance with regulations. A penetration test’s objective is essentially to circumvent security controls, providing a different perspective than other security audit measures. Therefore, penetration testing may uncover issues that a traditional security audit or assessment may not.

In conclusion, complete security plans incorporate a number of factors, all of which are important in establishing a strong cybersecurity posture. Each stage and technique of the process ought to be regularly conducted in order to provide baselines and comparisons for improvement. But it should be noted that in spite of an organization’s best efforts, no security policy is perfect. Given the constantly changing nature of technology and its inherent risks, security policies have to evolve to meet the demands of our digital landscape.

[clickToTweet tweet=”The Components of Strong Cybersecurity Plans Part Five: Penetration Testing ” quote=”The Components of Strong Cybersecurity Plans Part Five: Penetration Testing ” theme=”style3″]

Information Security (InfoSec) for the Compliance Professional [SlideShare]

by Leave a Comment

By Doug Stupca
Social Media Coordinator at SCCE/HCCA
Original Presentation by Jim Donaldson

Here is “Information Security for the Compliance Professional” from the 2016 Compliance & Ethics Institute on our SlideShare page. This presentation highlights:

  • Security from the ground-up – Understanding the necessary elements of every InfoSec program regardless of organization size and complexity.
  • You can’t have privacy without an effective InfoSec program – how to hardwire your privacy and InfoSec efforts for ultimate data protection.
  • It’s all in the documentation – how to document your InfoSec program in a way that demonstrates compliance.

Enjoy!

The 2017 Compliance & Ethics Institute will be held October 15 – 18 in Las Vegas, NV.  Details here.

Everything is awesome…or not

by 2 Comments

1ca85fbBy Kortney Nordrum CCEP, CHC
kortney.nordrum@corporatecompliance.org

I was recently re-acquainted with the Lego Movie’s catchy little ditty, “Everything is Awesome.” A fair number of internet philosophers have pointed out the hefty satirical undertones of the song. As it stands, the song itself is presented as propaganda for the fascist Lord Business, used to keep his Lego world running the same as it always has.

As I tried desperately to get the song out of my head, I thought about how the song, and its message, would apply to the compliance world. Without a second listen, one would think the song was an upbeat testament to teamwork and stability. However, if you take context into consideration, you’ll soon realize that everything is, in fact, not awesome.

At work, we are often encouraged to be positive and to smile. When our supervisors ask us how we’re doing, we often don’t have to think before responding, “Good. You?” We are preconditioned to present news in the shiniest light and to make it seem like everything is okay—especially to management.

We do all of this for the sake of the team. We don’t want to be the “Debby Downer” or to be the bearer of bad news. We don’t want to complain and be seen as “whiny” or “high-maintenance.” So, instead we hold our heads up and proudly proclaim that “everything is awesome.”

[bctt tweet=”‘Everything is awesome’ culture is exactly what we don’t want @nordrumlaw” via=”no”]

“Everything is awesome” culture is exactly what we don’t want. It’s the opposite of what we’re striving for. No one stands up or speaks out. Problems get ignored or swept under the rug. Everyone is concerned with how things appear, rather than how they actually are.

While it might be nice not to have to deal with employee issues or complaints, the end result is that you become woefully ignorant to what’s happening in your organization, and that’s when bad things happen.  When everyone sugar coats the truth—or flat out lies about it—it helps no one.

So, the next time someone tells you everything is awesome, let them know that it’s okay if it’s not.

 

Unfair & Unbalanced with Tom Fox & Roy Snell – Episode 3

by Leave a Comment

Podcast: Play in new window | Download (Duration: 36:29 — 33.5MB)

Subscribe: Apple Podcasts | Android | Email | Google Play | Stitcher | TuneIn | RSS

Paris attacks, worldwide corruption, Leslie Caldwell, DOJ, FCPA Enforcement; Rogue Employees

Taped live in SCCE’s Minneapolis office, Tom and Roy discuss:

  • Breaking into the compliance profession;
  • More importantly, finding a job in the compliance profession;
  • How social media is your compliance-job-search friend;
  • Tom’s 2 favorite pieces of career advice (only one is sports-related);
  • Why being helpful ends up being more than being helpful;
  • How to become Tom & Roy’s (compliance) second-cousin;
  • Why you should be writing all the time, about everything (even if it’s your first day);
  • Tom talks synthesis (the philosophy kind, not the science kind); and
  • Roy’s first day of kindergarten.

If you have suggestion for topics for Tom & Roy, or questions you’d like to ask them, please email kortney.nordrum@corporatecompliance.org

Government Enforcement vs. Compliance Programs in the Global Economy

by Leave a Comment

Government Enforcement vs. Compliance Programs in the Global Economy

2014-snell-roy-speaking-headshot-200By Roy Snell
roy.snell@corporatecompliance.org

We talk a lot about the government’s oversight of business.  It gets a lot of negative press.  But imagine, if you will, an environment in which the government does not enforce the rule of law.  Or imagine countries in which the government owns most businesses.  Countries that own most businesses have similar problems to those countries with little to no enforcement. What is the difference between businesses self-regulating and governments self-regulating? I would say the difference in independence is near zero.  The conflict of interest would be a very strong deterrent to self-regulation.

Countries with little to no enforcement of the rule of law are not big players in the global economy.  It hurts their economy because players in the global economy would rather do business where the rule of law is enforced by an independent entity free from conflict. There are benefits to being a well-regulated country.  Civilized society depends on it.  Economic success depends on it.  So which is the most advanced country in the world with regard to regulatory enforcement for business?  It is an interesting question that could be argued many ways.

What could be better than the government running around trying to catch bad players?  What is the most effective way to prevent, find and fix ethical and regulatory missteps on a real time basis?  I would argue that it is the country with the most compliance officers and compliance programs.  They would have a material edge.  Compliance programs catch problems much more often and much earlier than government enforcement.

Players in the global economy are attracted to business opportunities in trusted countries.  Government enforcement and regulations are inefficient and haphazard.  Countries that own most businesses are not much better off than countries where business is self-regulated.

Enforcement folks just can’t be everywhere all the time.  It’s a post-mortem approach.  Enforcement is not very effective at prevention.  Therefore it stands to reason that countries that head off regulatory problems on a real time basis with in-house compliance programs are going to be the most trusted.  Countries with the most businesses with compliance programs will be the most successful in the global economy.

[bctt tweet=”Government Enforcement vs. Compliance Programs in the Global Economy @RoySnellSCCE” via=”no”]