Corporate Ethics Compliance * Required by Federal Sentencing Guidelines, Department of Justice, the Sarbanes-Oxley Act, the U.S. Securities and Exchange Commission, the NYSE, and the Office of Inspector General: Department of Health and Human Services, and many other agencies. *This presentation is from Katherina Wulf’s “Ethics and Compliance Programs in Multinational Organizations”

Corporate Ethics Compliance Elements of Corporate Ethics Compliance Element 1: Risk Assessment Element 2: Corporate Culture Element 3: Oversight by the Board and Senior Management Element 4: The Ethics and Compliance Office Element 5: Code of Conduct Element 6: Receiving complaints Element 7: Training and Communication Element 8: Assessment of compliance activities Element 9: Incentives and discipline Element 10: Response to misconduct Element 11: Employee screening

4 Structural Elements of Ethics Compliance Element 1: Risk Assessment Element 2: Corporate Culture Element 3: Oversight by the Board and Senior Management Element 4: The Ethics and Compliance Office

Element 1: Risk Assessment potential exposure to criminal conduct; a broad view of the risks that could impact the organization’s reputation for ethical and legal conduct.

Element 1 Step 1: Decide whether to do it separately or as part of enterprise assessment Step 2: Appoint a risk management team “general counsel, the chief ethics and compliance officer, legal subject matter experts, and, if necessary, business unit or functional heads such as internal audit, human resources, finance, IT, regional heads, other subject matter experts, and outside attorneys or consultants.” (Wulf)

Element 1 Step 3: Risk Identification “internal and external sources of risk information, including the organization’s past audit results and litigation or claims history, the size and root causes of incidents in the organization’s industry, and major trends” (Wulf)

Element 1 Step 4: Data Gathering and Analysis Gather data Analyze data Current risks Tools to identify risk Strategies to mitigate risk Emerging risks Analyze data

Element 1 Step 5: Risk rating “the likelihood of occurrence, the severity of the risk, and the effectiveness of existing mitigation controls of the various risks. Adjustments to the rating scale may be required depending on each organization’s appetite for risk, as well as any characteristics particular to an industry or operating environment.” (Wulf)

Element 1 Step 6: Risk Communication and Information “a detailed description of the risk assessment, the determined risks, and the action plan…to address, monitor, and manage” these risks. (Wulf) Convey this information to senior management, and to all relevant parts of the organization.

Element 2: Corporate Culture Step 1: Analysis of the Existing Corporate Culture “A corporate culture is made up of these shared values of different stakeholders that are reflected in their collective actions…The total sum of all the collective values and behaviors of all employees and managers is the company’s culture.”

Element 2 Step 2: Assessment of the Corporate Culture Codes of conduct accord with culture People aspire to go beyond mere compliance Informal norms, rituals, stories, and traditions demonstrate to people what behavior is expected Business objectives are “reached in a manner that is true to your values.” Appropriate behavior gets rewarded/punished, perception of fairness, the leadership is willing to talk about ethics

Element 2 Step 3: Implementation of an Action Plan “a shared vision of the future and a shared set of values that clarifies the organization’s intentions and gives employees purpose and meaning (is) integrated into all business operations and decisions.” “the organization’s processes and systems must reflect the shared values and behaviors with appropriate consequences for those who are not willing to comply.”

Element 3: Oversight Step 1: Right Tone from the Top Step 2: Monitoring the Program’s Key Components Step 3: Regular Updates for Senior Management and the Board Step 4: A Code of Conduct for the Board of Directors

Element 4: The Ethics and Compliance Office Step 1: The Organizational Structure options “the stand-alone structure, with the ethics and compliance office as a separate business unit. the semiautonomous structure, the ethics and compliance office is administratively a component of another business unit. In the centralized structure, the ethics and compliance office is responsible for the program for the entire organization. the decentralized structure, in which the rather small ethics and compliance office develops the program, but each business unit then has its own ethics and compliance office that implements the program according to its own needs.”

Element 4 Step 2: Leadership Credentials and Competencies of the CECO CECOs often have a background in law, auditing, human resources, or security knowledgeable of the business operations and the company’s strategies and goals. able to work with the board of directors, senior management and many different departments. a passion for ethical conduct and compliance.

Element 4 Step 3: Professional Development and Certification Be a member of a professional organization and stay current. (e.g., Ethics and Compliance Officer Association, www.theecoa.org/imis15/ECOAPublic/) Step 4: Reporting Structure of the CECO Options: CEO, Board, general counsel

Element 4 Step 5: Outsourcing the Ethics and Compliance Function If the program is completely outsourced, the organization is still responsible for meeting the regulatory requirements. The company loses controls over the ethics and compliance operations, but it is still liable.

Element 4 Step 6: The Relationship with Senior Management and the Board Step 7: Resources and Budget Sufficient staffing and budget to maintain hotline, provide training, do risk assessments and audits, record keeping. Step 8: Ethics and Compliance Committees or Councils