Two of my current roles continually teach me about corporate compliance. One role obviously performs this function, namely as in-house counsel with responsibilities for internal investigations and compliance advice. The other role, father of three kids aged five and younger, seemingly has nothing to do with corporate compliance. But, the longer I occupy the latter role, the more I realize how much I am learning about corporate compliance from my children. Daily, their adventures manifest examples of how to apply compliance principles.
A problem my wife and I recently encountered with our two-year-old daughter illustrates this problem. Every night, we would dress our daughter snugly in her pajamas, tuck her into her crib, turn on soothing lullaby music, and gently close the door — a scene direct from Norman Rockwell. And, every morning, we walked into the nursery to find her wide-eyed and wearing nothing but her birthday suit! Without having had a single magic lesson, she would amazingly escape from her pajamas each night like a Houdini in training. Navigating this recurring scenario elucidated several compliance principles with direct application to my “day job.”
1. Compliance can be messy
Without providing too much detail, I can assure you that having a flustered father dealing with a two-year-old sans diaper can lead to a big mess. While a big mess is not ideal, having one does motivate you to look for long-term solutions rather than only performing a short-term cleanup.
Corporate compliance problems are similar. They can be chaotic — so much so that no one really wants to touch the issue. But, just like with my daughter’s predicament, I have found that an issue at work is simply not going to disappear. Plus, the longer the problem lingers, the more unpleasant it becomes.
You can either engage in repeated cleanups, or roll up your sleeves and work to find a long-term solution to prevent the mess from occurring in the future. Instead of shying away from the disarray, use the unpleasantness of the situation to motivate your team to find a long-term solution. Most importantly, making sure the key stakeholders fully understand the risks of the corporate toxicity will lead them to find a cure, instead of merely treating the symptoms.
2. Controls are necessary
The first step we took to solve our nightly dilemma was to review what controls we had implemented to prevent the problem. Not surprisingly, we quickly realized that we did not have any controls to prevent our dexterous daughter from undressing. We had merely ensconced her in warm pajama bottoms and top with no special precautions employed to guard against their removal. So, that very day my wife purchased and dressed our daughter for bed in a lovely pink onesie, replete with a fastener over the zipper. Using a control specifically tailored to our problem gave us great confidence when we tucked her in that night.
In the same way, triage of corporate compliance problems often reveals the absence of meaningful controls. The lack of controls can be understandable. The problem may have never appeared previously for completely serendipitous reasons. For example, my wife and I never encountered our problem with our older two children — they wore similar pajamas, slept in the same crib, in the same house, tucked in by the same parents, and remained completely clothed all night.
In the corporate context, the compliance mess may have been avoided by the actions of an employee who has since moved on to other responsibilities or left the organization. Once, however, the lack of controls is identified, swift action must be taken to design, craft, and implement procedural or structural remedies. Regulators may excuse not having the prescience to anticipate the problem, but they will not understand inaction or unreasonable delay in addressing a lack of meaningful controls.
3. Even the best controls can be circumvented
When my wife and I walked into the nursery the morning after dressing our daughter in the onesie with zipper fastener, we were shocked to find the garment (and diaper) on the floor. The control had failed! The mess had returned! After consoling each other and cleaning up yet another diaper-less disaster, we returned to the drawing board undeterred.
This lesson is likely one of the most difficult to internalize corporately. Initial controls, regardless of how much energy went into their design, may fail or work imperfectly at best. Perseverance is usually required to develop a long-lasting, efficient solution. The organization may feel a perceived “compliance drag” and lose the ardor for the cause. Sometimes, the recurring issue may continue to provide the required motivation to press on. However, when the control attenuates but does not solve, the compliance problem, the organization may settle for a solution, exposing them to further risk.
These situations require a compliance professional who can effect meaningful change through various methods, such as relationship and trust building skills. Presenting these difficult problems as opportunities to improve company compliance will engage your staff and encourage them not to settle for mediocre results.
Control design and implementation usually require an iterative process with each version of the control being based on the key benefits of prior versions. Of course, the process may reach a point of diminishing returns and certain controls (e.g., a straight-jacket for my daughter) may produce more harm than good and must be rejected despite their utility. The key is for the organization to commit to the process knowing that the best solution typically surfaces after rounds of implementation, metric review, and refinement.
4. Rogue actors may necessitate extreme measures
Confronted yet again with a mess and now a control failure, my wife and I came to the difficult recognition that we were dealing with a rogue actor. Our daughter was determined to act outside the norms and procedures of our household. Faced with a rogue actor, we reached for other tools in our compliance toolbox. I began an intense series of coaching and counseling. Each night, I would stress to our daughter the expectation that she would keep her clothes on and explained the benefits of this behavior to her and the family.
We pointed to her older siblings who slept fully clothed as role models whom she could emulate. We employed controls to mitigate the effects of the rogue actions by putting a plastic liner under the mattress cover. Finally, my wife and I engaged in detailed planning to potty train her to eliminate the most unpleasant aspects of the compliance failure even if the rogue action continued.
The lesson here is that every organization at any given time may find a rogue actor in its midst. Rather than immediate removal from the organization, consideration should be given to rehabilitation of the individual for the betterment of the organization and employee morale. Moreover, the rogue actor may be a whistleblower, such that termination or reassignment is a very risky option. Rogue actors require compliance professionals to use all of their intelligence, guile, and zeal to try to turn a negative contributor into a success story. While expulsion from the organization may ultimately be required, this action should only be taken after careful consideration of rehabilitation, institutional justice, and regulatory review of the termination decision.
Conclusion
Much of what we do as compliance professionals centers on managing risks within relationships. We identify the mess, which was easy in our daughter’s situation. We assess the cause of the mess. We mitigate the mess. We monitor our efforts.
Our relationships at home often teach us lessons with direct application to work. Leveraging these experiences will make us more effective and valuable to our organizations. As for my daughter, she now sleeps fully clothed. I like to think that all our efforts made a difference, but part of me wonders whether my rogue actor just decided to move on to find the next compliance gap in our household operations. Stay tuned.
