You and a friend are having a picnic by the side of a river. Suddenly you hear a shout from the direction of the water — a child is drowning. Without thinking, you both dive in, grab the child, and swim to shore. Before you can recover, you hear another child cry for help. You and your friend jump back in the river to rescue her as well. Then another struggling child drifts into sight... and another... and another. The two of you can barely keep up. Suddenly, you see your friend wading out of the water, seeming to leave you alone. “Where are you going?” you demand. Your friend answers, “I’m going upstream to tackle the guy who’s throwing all these kids in the water.”
This is the first paragraph in a recently published book by Dan Heath entitled Upstream. The story is a public health parable the author adapted from the original, which is commonly attributed to Irving Zola.
In Upstream, Heath extols the benefits of solving problems before they happen. This is not a new idea. In 1736, Benjamin Franklin famously advised fire-threatened Philadelphians that “an ounce of prevention is worth a pound of cure.” Similarly, in his popular book, The Seven Habits of Highly Effective People, the late Stephen Covey observed that the most effective business professionals focus the majority of their attention on matters that are “important but not urgent” (like sound compliance and ethics management systems) thus reducing the frequency of encountering issues that are “urgent and important.”
Few would quarrel with the wisdom of Heath’s, Franklin’s, or Covey’s observations. But there’s something about human nature that makes it difficult for us to put these principles into practice. In the world of corporate governance and compliance, the continued prevalence of systemic corporate corruption is a particularly excruciating example of this tendency. We compliance and legal professionals are well aware, as often as not, that compliance and ethics calamities large and small are born of management’s failure to invest in “upstream measures” like effective compliance management systems.
Many years ago, I had a conversation with a colleague during a bus ride to the airport that illustrates how such failures can manifest themselves — even in organizations generally committed to ethical business practices.
A warehouse of risk
It was the end of a very long week during which I joined my Asia-Pacific colleagues in China for a regional business conference where I provided several compliance training sessions. After taking my seat on the bus to head to the airport to begin my long journey home, I struck up a conversation with a colleague sitting next to me. She was a regulatory professional charged with managing our product registrations in several countries in the Asia-Pacific region.
After some small talk she paused for a moment with a worried expression on her face and then said that she needed to tell me something about significant compliance issues in the region that gave her concern. Specifically, she observed that, like the Food and Drug Administration in the United States, all the Asia-Pacific countries where we operated required medical device and pharmaceutical companies like ours to maintain documentation related to our various product registrations. Moreover, upon request, we were required to provide regulators such documentation and were potentially subject to unannounced inspections.
Her concern was that our records were in a terrible shape. They had been collected over the years and stored in a disorganized fashion in a large warehouse. In addition, she explained that most were woefully out of date.
This greatly complicated the work she and her colleagues needed to do to maintain the company’s registrations in dozens of countries. The team was struggling to keep up with their daily workload. Moreover, she observed that if regulators demanded production of our records for a specific product, we would be hard pressed to provide a satisfying response.
In the event we were unable to produce appropriate product registration documentation, enforcement actions could be taken against the company that could include fines, a ban on product sales, and potential costly product recalls. My colleague observed that significant investments needed to be made to review and update the entire records collection to remedy this situation and that protocols needed to be developed and implemented to ensure continued compliance with regulatory requirements.
Act before catastrophe
This is just one example of hundreds of latent risks that often fall below the radar of corporate executives and directors. Typically, these kinds of compliance management system weaknesses only come to the attention of C-suite personnel and directors after catastrophe strikes and it’s all-hands-on-deck “pulling children from the water.” Although the company I was with at the time managed to muddle through and has yet to be caught, another I’m familiar with was not so lucky.
John, a regulatory professional who I had worked with in the past, told me that the company he was serving did not listening to his pleas to let him maintain current staffing levels in his department. Instead, they executed a severe reduction in his global team. He told me that many times he warned the company’s senior management that the personnel cuts would significantly jeopardize the company’s plans to launch dozens of new products in multiple countries around the globe. He explained that maintaining the company’s internal regulatory strength was essential to file and secure the necessary product registrations.
Months later, as John predicted, the worst happened. The company manufactured millions of dollars of product but was delayed many months getting to market because of their failure to “look upstream” and make the appropriate investments in their regulatory team. Millions more had to be spent on outside firms to fill the gap on an emergency basis, ultimately costing the company many times more than it would have to achieve the same commercial objectives with the staff they laid off.
It is up to us in the legal and compliance functions to help our leaders keep their attention upstream and to stop commercial catastrophes big and small. To do so, we need to pick our heads up from our work and look around our company’s compliance landscape. We need to keep in touch with our colleagues in other corporate functions and help them get the word to corporate decision-makers in time to invest in sound internal controls now to avoid troubled waters later.
