1. Corporate Compliance & Ethics Programs Leveraging Technology, Best Practices and Outcomes in Execution LawNet, Inc. Conference - August 2004

2. Todays Outline What isnt eLearning (and what is) Driving forces behind adoption How it works Execution issues and 10 case studies

3. GOOD vs. BAD

4. Why compliance/ethics programs? The 3 Driving Factors… Improve behavior & work environment Reduce risk/avoid liability Align with Federal Sentencing Guidelines

5. Improving Behavior – Stats to Consider 46% observe one or more specific types of misconduct 44% dont report misconduct due to belief: –(1) no corrective action will be taken; –(2) information not be confidential 1 in 3 say employees show respect for fellow employees whose success is based on questionable ethics practices Newer and younger employees 2x less likely to report misconduct… yet experience 2x greatest pressure to engage in misconduct Source: National Business Ethics Survey, 2003, Ethics Resource Center

6. Where effective program in place, employees more likely to: Trust the actions of top management. Have a higher level of job satisfaction overall (lower turnover, more productive) Report misconduct; believe those who violate are held accountable Feel less pressure to commit misconduct Safeguard company brand and reputation Focus on sustainable long term business performance contributions as opposed to looking for short-term gain Weather transition (mergers/acquisitions/layoffs) more easily – National Business Ethics Survey, 2003, Ethics Resource Center ROI Benefits of an Effective Program

7. Reduced Risk/Avoided Liability Compliance is expensive ($$$) –Electronic discovery, disruption, legal expenses Litigation, settlements and claims are even more –PLI-Corpedia solutions recognized by insurance industry for risk reduction –Lower D&O, EPL, E&O rates Consider a different LH outcome… Some Numbers… $20b spent by regulatory agencies $850b spent by corporations to comply $850b reduction in market cap due to scandals $200b - $565b in white collar crime $$$b in litigation / penalties / fees

8. Federal Sentencing Guidelines An organization shall exercise due diligence to prevent and detect criminal conduct and… Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. - US Sentencing Commission When determining whether to charge a corporation criminally for the acts of employees, prosecutors should determine whether the corporations employees are adequately informed about the compliance program and are convinced of the corporations commitment to it. - Larry D. Thompson, Deputy Attorney General New guidelines in effect as of Nov 1. 2004

9. Sentencing Guidelines Overview Establish standards & procedures Assign high-level authority Not bestow authority to unethical executives Communicate & educate Monitor, audit & evaluate Implement anonymous reporting systems Apply consistent incentives & discipline Respond, correct & modify

10. What do we have to do?

11. Types of Topics Covered 200+ Topics Include Sarbanes-Oxley Code of Conduct Financial Integrity & Assurance Ethical Decision Intellectual Property Information Security Harassment Record Keeping & Destruction Health & Safety Anti-Money Laundering Conflicts of Interest Insider Trading Gifts & Gratuities Illegal Business Practices Antitrust OSHA etc..

12. How does an effective compliance program appear to an organization? 99% Workforce Penetration Proof of Employee Comprehension Proof of Employee Comprehension

13. How does an effective compliance program appear to employees? Step 1: Open Registration EmailStep 2: Access Training Menu Step 3: View CEO IntroductionStep 4: Take Course

14. Learning Methodology Legal concept-based Reinforcing story-based scenarios Customized to client organization Testing for comprehension Compliance and ethics situations vary Teach the underlying concept FIRST… Use cases to reinforce Result: More effective decision making vs. imitative learning

15. Best Practices Q: Can we define the practices of leading corporations? A1: Process-based Practices: Open Compliance & Ethics Group (www.oceg.org)www.oceg.org A2: Principle-based Practices: The 5:8 Principles

16. OCEG Nonprofit Initiative (www.oceg.org) Akin Gump, Strauss Hauer and Feld LLP American Bar Association (ABA) American Corporate Counsel Association (ACCA) American Institute of CPAs (AICPA) American Insurance Group (AIG) American Society of Corporate Secretaries (ASCS) Arent Fox, LLP Blackboard Bridge Associates Bryan Cave, LLP CalPERS Corpedia Education Corporate Integrity Services Center for Applied Business Ethics Debevoise & Plimpton Dechert LLP Deloitte & Touche Deutche Bank doubleDrum Capital, LLC DuPont de Nemours Ernst & Young EthicsPoint Ethics Resource Center (ERC) Fleetwood Retail Frank B. Friedman and Associates Foley Hoag LLP General Dynamics General Electric General Electric Aircraft Engines Gilbert and Associates Governmental Insurance Exchange Goodwin Procter, LLP Grant Thornton Groupo Nuevo Gulf Insurance Harris, Wiltshire & Grannis, LLP Holland & Knight, LLP Honeywell Howrey, Simon LLP Institute of Business Ethics Institute of Internal Auditors (IIA) Intel ISS IRRC KPMG Kaye Scholer, LLP Kraft Foods Latham & Watkins, LLP Lehman Bros. Littler Mendelson, LLP Louisiana Pacific Marsh, Inc. Mathews and Green, LLC McKenna Long & Aldridge, LLP Michelin North America Microsoft NCS Pearson New York City Pension Funds Orrick Herrington and Sutcliffe, LLP Practising Law Institute (PLI) Professional Liability Underwriting Society (PLUS) Pfizer Proskauer Rose, LLP PricewaterhouseCoopers Skadden, Arp LLP Swidler Berlin, LLP Walgreen Winstead Sechrest & Minick, LLP Zurich Financial Services 200+ individuals 100+ organizations since January 2003

17. Start with compliance and move to integrity – Effective programs are not built overnight Model ethical behavior expectations – Living out the words Test for impact and measure against peers Focus on the frontline – Younger & newer employees are most vulnerable Systems awareness is not the same as credibility – 44% dont report misconduct due to lack of system credibility The 5 Principles

18. 1.Titled officer with board-level exposure 2.Make available & educate on multiple reporting channels 3.Distribute & test entire workforce on Code 4.Integrate to job and provide case study decision-support tools 5.Communicate CEOs message & personal ethics experience 6.Survey for impact & benchmark a minimum of every 2 years 7.Internally visible reward & discipline as reasonable/feasible 8.Educate by core functional area within 30, 60, 120 DFH rule* * Days From Hire: 30 for Code; 60 for sales, finance & purchasing; 120 for general management The 8 Practices

19. Nobody will follow you if they cant trust you… And when they see a leader that doesnt cut corners, they say, Oh, thats the way its done around here. My advice would be that I think the only thing in the world more important than your health is your reputation Case Studies –Firing the Dumpster Diver –The Jack Welch Handshake Case Study (1): Lockheed Martin & Norm Augustine Innovative Way to Instill Believability & Tone from the Top

20. Case Studies (2-6): Distributing & Testing on the Code No Computers. –Uses kiosk system (Airline) –Paper-based w/tests entered by managers into HRIS (Medical) No Regular Internet Access. – Run locally, upload when email is accessed (Pharma Reps) No Email. –Tracks training by employee ID# (Retail Chain) No Land. –CD-ROM based with satellite uplink (Oil Rigs) Will creates Way – Innovative Internal and External Drivers

21. Company: Major Energy Producer Surveying Segment: Conflicts of Interest Sample Quote: – My brother works for MCI and they are our companys telecom provider. Is there a problem? Case Study (7): Testing/Surveying for Feedback on the Code You want this type of dialogue to take place

22. Company: Heavy Equipment Manufacturer Original Reporting System: –Developed In-House –Specific Individual to Call Revised Reporting System –Augmented by Externally-Based Online & Offline Versions –Invested in education –provided relevant case study how it works Case Study (8): Building Credibility to Report Channels 44% of employees who witness misconduct but dont report it 42% dont believe corrective action will be taken

23. Case Study: High-Technology Company Problem: Unauthorized Use of Resources; Violation of Company Policies Action: Termination of 35 employees – announcement to the rest of the workforce Case Study 9: Internally Visible Reward & Discipline Difficult yet possible to reward behavior without being condescending... but failing to publicize discipline may undermine system confidence

24. Company: Consumer Products Former Training: Ad Hoc & In-Person Revised Training: 30, 60, 120 DFH via eLearning Impact: –No systemic problems discovered; 50%+ expense reduction –Institutionalized repeatable system –Focused on the frontline risks Case Study 10: 30, 60, 120 DFH Rule Newer and younger employees 2x less likely to report misconduct… yet experience 2x greatest pressure to engage in misconduct

25. Not everything is measurable… but good examples exist Reduced Cost of Risk –Companies achieving 15-30% reduction in E&O, EPL and D&O insurance Witnessed Misconduct Reduced by 75% Across Board –When senior managers demonstrate illustrative behavior*, misconduct witnessed drops to 15% from 56% Other Outcomes * (1) Talk about importance; (2) Model behavior; (3) Inform employees; (4) Keep promises

26. Other Leading Practices Observed… Planning Practices –CEO buy-in at outset –Temporary cross-functional teams with EVP-level TieBreaker Design Practices –Invest in quality & customization - less expensive than you think –Instructional methodologies vary by type of workforce Implementation Practices –Respect employees existing knowledge & time Vendor Contracting –Demand disclosure of possible conflicts of interest –Get copies of the software code & records –Due diligence on financials & commitment to industry