Transforming Compliance Emerging Paradigms for Boards, Management, Compliance Officers, and Government Michael D. Greenberg C O R P O R A T I O N ELECTRONIC COPIES OF RAND RESEARCH ARE PROVIDED FOR PERSONAL USE; POSTING TO A NONRAND WEBSITE IS PROHIBITED. THIS PUBLICATION IS AVAILABLE FOR LINKING OR FREE DOWNLOAD AT www.rand.org For more information on this publication, visit www.rand.org/t/cf322 Library of Congress Cataloging-in-Publication Data is available for this publication. ISBN 978-0-8330-8767-6 Published by the RAND Corporation, Santa Monica, Calif. © Copyright 2014 RAND Corporation R® is a registered trademark. Cover image: AdamRadosavljevic, iStock Limited Print and Electronic Distribution Rights This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited. Permission is given to duplicate this document for personal use only, as long as it is unaltered and complete. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial use. For information on reprint and linking permissions, please visit www.rand.org/pubs/permissions.html. The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors. Support RAND Make a tax-deductible charitable contribution at www.rand.org/giving/contribute www.rand.org Preface Recent decades have witnessed a tension between competing trends in corporate compliance activity. On the one hand, many companies have strengthened their compliance programs, and the officers who lead them, partly in response to standards established by the Federal Sentencing Guidelines. On the other hand, occurrences of workplace misconduct and fraud continue to present a serious problem for many private sector organizations. This fundamental tension is occurring against a backdrop of dramatic change in the landscape of corporate compliance and, by extension, that of organizational governance. The sources of this landscape change are varied, but among them are (1) the proliferation of new third-party contractual compliance obligations; (2) the professionalization of compliance practice as a discipline; (3) the increasing influence of government resolution agreements in driving corporate compliance efforts; and (4) the uncertain contours of privilege as applied to compliance programs and the compliance function. Taken together, these elements of landscape change suggest the possibility of an emerging paradigm shift in compliance. A series of questions follows. What would a new paradigm in compliance actually entail? What will boards, C-suites, and policymakers need to do to strengthen corporate compliance and integrity efforts going forward? What are the emerging risks that compliance programs are beginning to face, and how can the programs be improved to better address those risks? In turn, how will the role of the chief compliance officer shift and evolve, and what are the corresponding implications for the structure and resourcing of the compliance function? On May 28, 2014, the RAND Corporation convened a symposium in Washington, D.C., to address these and related questions. Invited participants included senior thought leaders from the ranks of public company directors and executives, ethics and compliance officers, and stakeholders from government, academic, and nonprofit sectors. The symposium was the most recent in a series of annual RAND roundtable meetings focusing on topics in corporate compliance, governance, and ethics. The current proceedings report summarizes key issues and topics from the May 28 symposium discussions. The document is not intended to be a transcript. Rather, it is organized by major theme and serves to highlight areas of agreement and disagreement among participants. With the exception of four invited papers that were written in advance and presented at the symposium, we do not attribute remarks to individual participants. This report was funded with pooled resources from the RAND Center for Corporate Ethics and Governance, with additional support provided by New York Stock Exchange Governance Services, an Intercontinental Exchange company. These proceedings should be of interest to policymakers, regulators, corporate directors and executives, compliance and ethics practitioners, shareholders, nongovernmental organizations, and other stakeholders with interests in corporate governance, ethics, and compliance practices issues, both in the United States and abroad. iii RAND Center for Corporate Ethics and Governance The RAND Center for Corporate Ethics and Governance is committed to improving public understanding of corporate ethics, law, and governance and to identifying specific ways in which businesses can operate ethically, legally, and profitably. The center’s work is supported by contributions from private-sector organizations and individuals with interests in research on these topics. The center is part of the RAND Institute for Civil Justice, which is dedicated to improving the civil justice system by supplying policymakers and the public with rigorous, nonpartisan research. Its studies identify trends in litigation and inform policy choices concerning liability, compensation, regulation, risk management, and insurance. Questions or comments about this report should be sent to the center director, Michael Greenberg ( Contents Preface ............................................................................................................................................ iii Summary ....................................................................................................................................... vii Acknowledgments .......................................................................................................................... xi Abbreviations ............................................................................................................................... xiii 1. Introduction ................................................................................................................................. 1 2. Invited Remarks from Symposium Participants ......................................................................... 5 Summary: The Privatization of Compliance ............................................................................................ 6 Summary: Compliance and Ethics as a Profession—In the Public Interest ............................................. 8 Summary: Redefining the Relationship of the General Counsel and Chief Compliance Officer .......... 10 Summary: Learning the Hard Way: C&E Lessons from Recent U.S. Resolution Agreements ............. 13 3. What Is the Emerging Paradigm for Compliance Programs of the Future, and What Are the Implications? ..................................................................................................................... 15 The Source of the Compliance Obligation Itself Is Shifting .................................................................. 16 Organizational Culture Will Become Even More Important as a C&E Focal Point .............................. 18 Boards and Senior Executives Depend on an Independent Compliance Function in Order to Carry Out Their Own Respective Responsibilities .................................................................................... 19 Effective Compliance Reflects a Balance Between Transparency and Confidentiality ......................... 20 Transformational Trends in Compliance Are Likely to Affect and Blend with Each Other .................. 21 The Empowered CECO Will Be a Foundational Ingredient in the Transformation of Compliance ...... 22 4. How Can Boards, Management, Compliance Officers, and Government Respond in Support of More-Effective Compliance? ................................................................................ 23 Boards Can Take Steps to Strengthen C&E Capability and Monitoring Efforts ................................... 24 Management Can Focus on Both Structure and Culture in the Organization ........................................ 25 Government Can Help by Setting Consistent Standards and Leading by Example ............................... 25 Compliance Officers Can Strengthen the Field Through Improved Efforts on Role Definition, Professional Development, Education, and Communication ........................................................... 26 Appendix A. Symposium Agenda ................................................................................................ 29 Appendix B. Symposium Participants .......................................................................................... 31 Appendix C. Invited Papers from Symposium Participants ......................................................... 33 The Privatization of Compliance ............................................................................................................ 33 Compliance & Ethics as a Profession—In the Public Interest ............................................................... 46 Redefining the Relationship of the General Counsel and Chief Compliance Officer ............................ 56 Learning the Hard Way: Ethics and Compliance Program Lessons Gleaned from Recent U.S. Resolution Agreements .................................................................................................................... 69 References ..................................................................................................................................... 79 v vi Summary Over the past six years, the RAND Corporation has organized a series of roundtable symposia on topics within corporate compliance, ethics, and governance. The symposia have brought together accomplished thought leaders across a range of professional backgrounds and perspectives to grapple with the challenges facing chief ethics and compliance officers (CECOs), boards, and senior management. Symposium topics have ranged from whistleblower protection, to the role of boards in compliance and ethics (C&E) oversight, to the unique challenges posed by C-suite– level compliance and misconduct. In all of these symposia, the aim has been to explore cutting- edge issues in compliance policy and practice, to identify exogenous factors affecting the compliance and governance landscape, and to elicit both diverse opinion and consensus across several stakeholder groups with interests in the landscape. In May 2014, RAND undertook a forward-looking exercise during its annual symposium. The topic of this year’s discussion involved the transformation of compliance, and the likelihood and potential implications of a qualitative shift in the compliance field over the coming decade. The symposium particularly focused on several change vectors currently operating on the compliance field, including (1) the proliferation of new third-party contractual compliance obligations; (2) the professionalization of compliance practice as a discipline; (3) the (contested) contours of privilege as applied to compliance programs and the compliance function; and (4) the increasing influence of government resolution agreements in driving corporate compliance efforts. Each of these vectors is associated with the potential for a transformational impact on the compliance field going forward. Collectively, they also serve as a point of departure for thinking about how the compliance obligation might shift in the future, how compliance practice and professionals might evolve in response, and how both descriptive and normative visions for the relationship between corporate board governance and the C&E function as a result. It is within this context that RAND convened a roundtable meeting on May 28, 2014, entitled “Transforming Compliance: Emerging Paradigms for Boards, Management, Compliance Officers, and Government.” The objective was to stimulate a forward-looking conversation about compliance as a field, factors that are likely to contribute to its transformational change, and practical implications for key stakeholder groups. The symposium brought together a group of two dozen senior thought leaders from the ranks of public company directors and executives, CECOs, and stakeholders from government, academic, and nonprofit sectors. Prior to the symposium, several of the invited participants were asked to prepare and present formal remarks on selected transformational pressures now affecting the compliance field. The speakers presented their remarks during the first session of the symposium. Their white papers, distributed in advance of the event, offered a detailed perspective on each of the transformational vectors. The second and third sessions engaged the symposium participants in interactive vii discussions, launching from the foundational remarks initially offered by the authors of the white papers. Several broad themes were touched on across the symposium discussions. The first was simply the recognition that compliance is a field in flux, and one that is undergoing change in several different ways at once. These include the sources of the compliance burden, the professional identity of compliance practitioners, and the posture of government enforcement efforts. All of these vectors are important to understanding how the field is likely to evolve in the future. Second, because CECOs and compliance programs operate in tandem with boards and senior executives, any transformation of compliance will also have an effect on boards and senior executives. To the extent that compliance programs (and CECOs) grow more effective within their companies, the burden of compliance risk for boards and C-suites will presumably be reduced. Contrariwise, to the extent that compliance becomes less effective, the burden of compliance risk for boards and C-suites will presumably be amplified. Third, our discussion of compliance transformation takes place in a broader corporate governance context, in which many large public companies and boards have identified reputation risk as a priority concern. Corporate reputation risk is at least partly tied to the compliance function, and to the risk of failure in compliance processes leading to crisis events. Thus, any discussion about the transformation of compliance invites reflection about business reputation risk and the future ability of the compliance function to help mitigate that risk. Invited Remarks from Panelists The symposium began with opening remarks offered by Michael Greenberg and Donna Boehme. These introductory remarks were followed by remarks from the authors of four invited white papers. The speakers were Scott Killingsworth, a partner with the law firm Bryan Cave LLP; Joseph Murphy, the director of public policy at the Society of Corporate Compliance and Ethics; Michael Volkov, CEO and owner of Volkov Law Group LLC; Peter Jaffe, CECO at the AES Corporation; and Michael Diamant, a partner at the law firm Gibson Dunn LLC. Their remarks were based on white papers titled “The Privatization of Compliance” (Killingsworth); “Compliance and Ethics as a Profession—In the Public Interest” (Murphy); “Redefining the Relationship of the General Counsel and Chief Compliance Officer” (Volkov); and “Learning the Hard Way: Ethics and Compliance Program Lessons Gleaned from Recent U.S. Resolution Agreements” (Jaffe and Diamant). The four papers were distributed to symposium participants in advance of the meeting to set the context and facilitate a dynamic discussion. viii What Is the Emerging Paradigm for Compliance Programs of the Future, and What Are the Implications? The second session of the symposium addressed each of the major vectors of change that were spotlighted in the symposium white papers: i.e., (1) the proliferation of new private-to-private (P2P) compliance obligations, (2) the professionalization of compliance practice as a discipline, (3) the contours of evidentiary privilege as applied to compliance programs and to the compliance function, and (4) the increasing influence of government resolution agreements in driving corporate compliance efforts. In each case, two questions were raised: How is this particular issue likely to affect compliance practice in the future? And how will compliance programs and the compliance function shift as a result? Secondary questions were raised concerning the impact of these transformational vectors on several other key stakeholder groups in the business community, apart from CECOs: most notably boards, senior executives and the C-suite, and government policymakers. Finally, the discussion touched on the notion of paradigm change itself, and what a new compliance paradigm might entail, or ought to entail, given the specific vectors of change that were spotlighted in the white papers. Several of the comments in this session broadly spoke to the evolution of compliance as a field, and to the relevance of compliance to senior management more generally. One participant noted: “There is a big shift going on for the compliance function, in profile, seniority, independence, and seat at the table.” Another participant suggested that “business risk and compliance risk are the same thing in today’s marketplace.” Still another observed: Reputation risk is a chief concern for many, many board members today. Directors know that they need to be worried about reputation, but they’re often vague about what they specifically need to do. This involves a basic tieback to the compliance function, and to what the compliance officers are doing to address operational and strategic risk at the highest levels of their organizations. In this vein, it was suggested that when corporate crisis events occur, they often involve law violations or ethical deficiencies that a robust and empowered compliance program might well have been able to prevent. On a related theme, another participant explained: “It [the compliance function] is for the public good.” The discussion noted that an empowered CECO helps to safeguard both the reputation of the company and the public interest through the mitigation of compliance and corporate culture risks. The symposium session included several other notable points of discussion among the participants: • The source of the compliance obligation itself is shifting. • Organizational culture will become even more important as a C&E focal point. • Boards and senior executives may benefit from an independent compliance function in carrying out their own respective responsibilities. • Effective compliance reflects a balance between transparency and confidentiality. • Transformational trends in compliance are likely to affect and blend with each other. ix • The empowered CECO is a foundational ingredient for the transformation of compliance. How Can Boards, Management, Compliance Officers, and Government Respond in Support of More-Effective Compliance? The final session of the symposium directly addressed several stakeholder groups that are likely to be affected by compliance transformation in the future: e.g., boards, C-suite executives, government policymakers, and compliance officers themselves. Symposium participants were asked what kinds of actions each of these stakeholder groups might take, either to move the compliance field in a positive direction or to respond to foreseeably changing conditions in compliance in a positive way? Some of the discussion focused on tangible things that CECOs, managers, and others could do differently on the ground in order to contribute to compliance transformation or to a better standard of compliance practice in the near future. Other points in the discussion focused on more normative considerations regarding the ideal structure and aim of compliance in the future, and the steps that various stakeholder groups might pursue in order to support those normative visions. Ultimately, the discussion circled back to two basic points. The first was the observation that transformational change in the compliance field is already well under way, partly in connection with the specific vectors discussed in the symposium white papers (e.g., the P2P trend, professionalization, and the debate over privilege). In one sense, then, the question for stakeholders is not whether the compliance field is likely to shift to a new paradigm in the future, but rather how the shift can be influenced in a maximally productive and useful direction. Second, the symposium discussion returned to the idea that boards and senior executives have become increasingly concerned with managing reputation risk for their companies, and that the evolution of compliance is occurring within a broader landscape of corporate governance that is also shifting. For boards and executives in particular, the transformation of compliance invites some reflection on the nature of corporate reputation risk and the potential for compliance programs and CECOs to serve as a useful asset in analyzing and responding to that risk. The discussion in this session touched on several other major focal points: • Boards can take steps to strengthen C&E capability and monitoring efforts. • Management can focus on both structure and culture in the organization. • Government can help by setting consistent standards and leading by example. • Compliance officers can strengthen the field through improved efforts on role definition, professional development, education, and communication. x