By Susan Frank Divers, Advisor, Ethena
A few weeks ago, the Wall Street Journal noted that a recent study in the Journal of Business Ethics found a correlation between the use of “trust” words in companies’ securities filings and the likelihood of lower corporate social responsibility (CSR) scores, higher audit fees and getting a comment letter from the Securities and Exchange Commission. The researchers found that companies using words such as ethics, fairness, honesty, integrity or trust in their 10k filings tend to have more of these negative outcomes.
Dismaying as this may be, it’s one more illustration of the gap that can arise between what’s on paper and what happens in practice in the area of ethical culture and compliance. Walking the talk requires care and attention to company culture, as well as compliance requirements or CSR commitments, as has been recognized for some time. Otherwise, an organization can wind up with an ethics and compliance or CSR program that sounds good on paper but is ineffective in practice. For human resources and ethics and compliance professionals, this type of negative correlation can signal that the organization’s ethical culture needs strengthening.
Moreover, in the face of ongoing corporate scandals, regulators and commentators have repeatedly stressed the need to address company culture, not just rules or processes, as an important part of good governance. Nearly 10 years ago, former Chairwoman Mary Jo White of the SEC, writing in 2015 in the Harvard Business Review, summarized the primacy of corporate culture as the key lesson she drew from her experience as a regulator, noting “[m]uch of prevention really comes down to culture.” Four years later, commenting on the Wells Fargo, Odebrecht, Rolls Royce and other scandals, another Harvard Business Review article noted “[t]he root cause of the problem isn’t ineffective regulations and compliance systems, however. It’s weak leadership and flawed corporate culture.”
The current Department of Justice guidance, updated in March 2023, on Evaluation of Corporate Compliance Programs (ECCP) instructs prosecutors “to probe specifically whether a compliance program is a “paper program” or one “implemented, resourced, reviewed, and revised, as appropriate, in an effective manner.” The guidance goes on to state that “[b]eyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company.”
The recognition that rules are not self-executing underlies this emphasis on culture as a key element of corporate governance. Relying solely on policies to drive compliance ignores the fact that a company’s culture determines whether they will be followed or not.
No matter what the organization’s code of conduct or policies say, if achieving aggressive targets or unethical practices such as bribery or price-fixing are tolerated and are “the way business is done here” as the saying goes, rules alone are unlikely to change that. The scandal-plagued companies mentioned above all had codes of conduct, policies, training and other key compliance measure as did the major organizations exposed in the #MeToo movement as tolerating predatory practices. What they lacked was a culture of integrity that started at the top and permeated the organization at all levels.
Measuring ethical culture is the first step towards strengthening it. The ECCP poses questions in this area for companies seeking regulatory leniency and those committed to an effective ethics and compliance program to consider:
“How often and how does the company measure its culture of compliance? How does the company’s hiring and incentive structure reinforce its commitment to ethical culture? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture?”
Thus, broadly measuring organizational culture is important and integrating the results into the organization’s human resources and ethics and compliance strategies is essential. Measuring levels of trust, respect, fairness, and the ability to speak up without retaliation can provide valuable insights essential for making the organization’s values and commitments a workplace reality, going beyond a “paper” program.
Human resources and compliance teams can use the data to spot trends, both good and bad, that provide insight into what parts of the culture are healthy, those that are less so and what ethics and compliance messages need to be reinforced. And regular use of ethical culture surveys can meet regulators’ expectations as set out in the ECCP.
Rather than launch another broad, yearly employee questionnaire which can generate survey fatigue, using short, ongoing culture surveys embedded in ethics training can provide a real-time picture of issues and potential hotspots. Embedding such surveys at the end of a code of conduct course for example, avoids the time and expense of a yearly survey and provides fresher data from employees at all levels of the organization.
It also allows easy benchmarking against companies in the same industry, region or size. The data can provide an ongoing picture of the organization’s ethical health and point the way to making sure that values such as trust, respect, fairness and speaking up are more than just words.