Your Compliance & Ethics Function: Aligned, Not Maligned

Today, more than ever, your organization needs you. As a Chief Compliance & Ethics Officer navigating the increasingly complex regulatory landscape, your objectivity and expertise provide your board and senior leadership team with a beacon to guide them. Oftentimes you are viewed as the guardian at the gate.

While your colleagues and directors will likely embrace and support your role, your precautionary observations, and your recommendations, that enthusiasm does not always translate vertically throughout the organization. Members of your team may already have encountered the resistance that emerges when raising regulatory compliance, ethics or internal control concerns in the midst of deadline-driven projects. Not often do the profit center managers in our organization stand up and cheer our scrutiny and counsel when we review their proposed product and service offerings, marketing materials, and incentive compensation plans.

We do not further the compliance & ethics mission in our organization when our role is viewed in isolation as too far removed from the day-to-day goals and objectives of our organization. Let’s face it—our organization was most likely founded to obtain a for-profit or not-for-profit objective, not to support our compliance & ethics function.

Over the years I have identified some key steps that allow own compliance & ethics role to align tightly with the growth strategies and objectives that our organizations strive to implement. I refer to these steps as getting down into the MUD:

·         Meet as many key managers at all levels in your organization as feasible. The more colleagues you become familiar with, the greater likelihood that your involvement will be sought out earlier in the planning, development, and execution of new programs, products, and initiatives.

·         Understand genuinely the plans, imperatives, and metrics that drive key managers in your organization in their respective roles. When you truly understand the why, what and how of each division and department, then you will be better able to anticipate and address potential regulatory compliance, ethical, or internal control exposures.

·         Defer to your operational colleagues when a decision does not require approval from you. Your credibility as Chief Compliance & Ethics Officer is strengthened when you resist the urge to exert your will upon every decision in a project, program, or product launch.

When we take the time to get to know our operational colleagues, understand their roles more fully, and defer to their subject-matter expertise, we will find that those same colleagues are much more likely to invite us to advise them regarding regulatory compliance, ethics, and internal control matters. Instead of being maligned as the killjoys at headquarters, let us become aligned with our shared organizational mission as we serve to safeguard it from foreseeable risks.

Enterprise Risk Management: Captain Kirk Confronts the Final Frontier

When faced with the regulatory mandate to incorporate or improve your organization's enterprise (or enterprise-wide) risk management (ERM) process, we can sometimes feel like a Klingon confronting Tribbles. To succeed with ERM within our organization, we must instead adopt the attitude expressed by Captain James Kirk in the'Day of the Dove episode: "There's another way to survive. Mutual trust...and help."

Several years ago, the federal banking regulators set off on a mission to bring Enterprise Risk Management (ERM) to the forefront of financial institution governance expectations. In the ensuing years, state insurance regulators have joined the mission through the National Association of Insurance Commissioners (NAIC) Own Risk and Solvency Assessment (ORSA) model act. The topic continues to get considerable attention in recent regulatory guidance, including Federal Reserve Board (FRB) supervisory letters 12-7 and 08-8. The Federal Reserve Bank of Chicago (FRB-C) devoted considerable attention to the topic at its 2011 conference.

What appeared to be a distant risk management galaxy in the late 1990s has certainly become an oft-discovered governance imperative for financial institutions. As a financial industry executive, you know that you have been charged with the responsibility “to boldly go where no man has gone before.” Much like the voyage of the storied U.S.S. Enterprise, your voyage has taken you to strange new worlds as you have sought to develop or improve your ERM model.

When you have set out to build a robust risk management infrastructure to integrate, coordinate and facilitate forward-looking risk management throughout the enterprise, you invariable have encountered (or will encounter) skeptics. Captain Kirk addressed this challenge in the 'A Private Little War' episode: "The only solution is...a balance of power. We arm our side with exactly that much more. A balance of power...the trickiest, most difficult, dirtiest game of them all. But the only one that preserves both sides."

But make no mistake about it—ERM is not optional and is here to stay. Thus, we often will find ourselves educating senior leadership colleagues and independent directors about ERM, in parallel with obtaining the necessary data to build, enhance, and report upon our ERM model. ERM cannot simply become a once-and-done exercise that ends up on a binder on your credenza.

Building a culture around ERM involves acclimating leadership throughout the organization to a continuous reporting system that identifies and addresses emerging risks. Strategic initiatives and ongoing business planning are evaluated in light of current and emerging risks and incorporated into analysis and leadership and board decision-making. ERM becomes a discussion item on at least a weekly basis within the leadership team, and a standing agenda item for your board, often through an ERM committee. Reports are designed to be condensed, accurate and meaningful for decision-making.

Internal Audit and Compliance play key roles in the ERM process. The periodic review and validation of the model through targeted risk assessments must be conducted under the direction of the organization’s senior leadership to support the organization’s risk appetite.

Occasionally, Captain Kirk and his officers would find themselves enmeshed in a scene from Earth's pre-space travel history, yet the episode always ended with our beloved travelers safely back aboard the U.S.S. Enterprise. As your ERM model and methodology evolve, it is likely that the organization will also never return by the way that it arrived, because external variables will continually infiltrate the ERM model. Most notably, your organization’s ERM will remain under the scrutiny and be subject to the recommendations of your prudential regulator. There simply is no going back.

Continue to be the evangelist for sound enterprise risk management in your organization, devoting yourself to encouraging, educating and embracing your colleagues as you faithfully fulfill the ERM governance role entrusted to you. Much like Kir, may you live long and prosper in your role.

Forecasting the Digital Future: Avoiding a “Friend Request” from the FTC

The regulatory burden upon corporate social media strategy was further increased when the Federal Trade Commission (FTC) issued its revised .com Disclosures guidelines on March 12, 2013 (http://ftc.gov/os/2013/03/130312dotcomdisclosures.pdf). The original guidelines had been published in 2000, long before “dot com,” “smartphone,” and “social media” became household terms. This highly anticipated revision of the original document had been underway since May 2011, and appears to have been closely timed with the recent FFIEC social media rulemaking.

Guidelines are often drawn from successful FTC administrative actions against violators. While guidelines do not carry the weight of formal law, guidelines do define norms that will often trigger subsequent FTC regulatory investigations, and thus must be regarded by industry within the advertising risk management framework. That being said, the FTC admits that there is no set formula for a clear and conspicuous advertising disclosure. Don’t you relish ambiguity amidst federal regulation and potential for fines?

The FTC reiterates that general principles of advertising law apply online, but new issues arise almost as fast as technology develops and new issues have arisen concerning space constrained screens and social media platforms. No one would deny that most organizations intend for all of their advertising to fairly and accurately portray their products and services.

Complying with advertising law within the four corners of a typical print advertisement or within the storyboards of a video advertisement present a more limited range of challenges. The digital marketing frontier has introduced an infinite number of complex issues, including the more rapid evolution and retirement of technology hardware and software platforms. For example, many of us have become familiar with the rise of Apple and Android apps, even as app makers have decreased or eliminated the creation of BlackBerry apps.

Against this backdrop, the FTC places the burden of understanding and complying with the technological limitations of burgeoning online and mobile platforms upon the advertiser. Compliance monitoring and periodic internal audits should be embedded into your social media risk management strategy.

The major takeaways from this revised guidance as they apply to social media are:

·         The FTC Act’s prohibition on “unfair or deceptive acts or practices” encompasses online advertising, marketing, and sales.

·         Required disclosures must be clear and conspicuous.

·         If an ad is viewable on a particular device or platform, any necessary disclosures should be sufficient to prevent the ad from being misleading when viewed on that particular device or platform.

·         If a particular platform does not provide an opportunity to make clear and conspicuous disclosures, then that platform should not be used to disseminate advertisements that require disclosures.

The prescriptive and restrictive nature of the FTC’s guidance requires advertisers to develop and test advertisements across the rapidly-evolving landscape of mobile devices, including tablets and smartphones. Ignorance of emerging technologies will provide no corporate defense to an FTC-initiated action in light of the explicit expectations expressed in the March 2013 guidelines.

The guidelines are well-written and provide a robust appendix of sample advertisement do’s and don’ts. But social media strategists will need to maintain a constant technological vigilance as new web-enabled technologies come to market. Otherwise, don’t be surprised if you receive a “Friend Request” from a new friend at the Federal Trade Commission and learn an entirely new definition of “clear, conspicuous, and proximate”.

Strength and Sustainability: Collaborative Compliance Amidst Complexity

I simply do not have all of the answers. There, I have said it.

My simple statement sums up the collective admission of Compliance, Audit and Ethics professionals globally. The annual proliferation of domestic and international regulatory requirements continues to proceed at an ever increasing rate. When only a decade or two ago, a chief compliance officer might likely have understood the details of all regulatory responsibilities within his/her realm, many of us have now grown accustomed to reliance upon specialized colleagues to identify the details of specific branches within our own compliance universe. At least two easily recognizable trends have led to this reality: global commerce and systemic failure.

Global commerce has both driven and benefited from technological and economic advances throughout history. Progressing beyond the steamships that replaced clipper ships, the internet built upon the initial success of the transoceanic cables laid long ago. While local trade rules and customs remain, the international Law of the Sea has been joined by International Free Trade Agreements and transcontinental legal structures, most notably the European Union, where supranational legal structures both supplant and co-exist with domestic laws and regulations.

Systemic failures that have led to financial crises within nations as diverse as Greece, Ireland, Japan and the United States have resulted in the now-familiar remedies of International Monetary Fund austerity measures, the Third Basel Accord, and Dodd-Frank  Wall Street Reform and Consumer Protection Act, to name a few examples. Regulators have sought to eliminate pathways to fraud, largess and market manipulation widely blamed for the global crises by promulgating lengthy and complex regulatory solutions.

Compliance professionals who once may have laid claim to comprehending and administering compliance programs involving an entire continent or nation have succumbed to a level of regulatory complexity that makes such independent mastery incomprehensible. Even for those of us who oversee primarily domestic compliance programs, international influences are now omnipresent in Dodd-Frank, the Bank Secrecy Act, FCPA and the U.K. Bribery Act of 2010.

At the end of the day, Compliance, Audit and Ethics professionals are exactly that—professionals. We do not simply throw our hands up and decry the unfairness of increasingly complex regulatory requirements. True to our nature, we seek to understand as much as possible about our responsibilities to fulfill those compliance requirements in conjunction with our organization’s core mission and objectives. But our inquiries and information gathering must extend beyond our own individual knowledge and planning. Today’s increasingly complex regulatory environment requires us to collaborate with colleagues both within our organizations and beyond.

I would propose that now is the time to build stronger, more sustainable Compliance Programs through intelligent collaboration. It must not be viewed as a sign of ignorance or laziness when we humbly and actively partner with fellow Compliance, Audit and Ethics professionals to ascertain best practices. Likewise, we must continue to embrace the business line leaders within our own organizations to build collaborative compliance solutions that fulfill our regulatory responsibilities without unnecessarily impeding daily operations and long-term strategies.

Effective Regulatory Compliance…we may not each be able to do it alone, but we can certainly do it more constructively together.

An Invitation to Connect: The FFIEC Embraces Social Media Regulation

Financial Institutions in the United States have a new “friend” to contend with in their social media circle.

Given the exponential increase in the influence social media has had upon the financial institution landscape in recent years, compliance professionals could have anticipated the recent Federal Register notice. On January 23, 2013 the Federal Financial Institutions Examination Council (FFIEC), composed of the OCC, the Federal Reserve Board of Governors, the FDIC, the NCUA, the CFPB and the State Liaison Committee (“the Agencies”) jointly issued proposed guidance for public comments to be received by March 25, 2013.

This broad-based guidance proposes to address the applicability of federal consumer protection and compliance laws, regulations, and policies to activities conducted via social media by banks, savings associations, and credit unions, as well as by nonbank entities supervised by the Consumer Financial Protection Bureau.¹  Viewed in the broader context of enterprise risk management, the Agencies are seeking to ensure that all supervised financial institutions are effectively assessing and managing risks associated with activities conducted via social media. Specifically, the financial institutions will be expected to incorporate consumer compliance and legal risks, as well as reputation and operational risks associated with social media activities into their governance structure.

The FFIEC’s entry into social media regulation will likely be met with mixed reviews by financial industry compliance professionals. While many organizations have sought to craft policies and procedures to address this multifaceted communication phenomenon, other organizations have struggled with developing a consensus around how to approach social media governance. For organizations that have yet to create or adequately revise social media policies and procedures to encompass its growing importance to commerce, the FFIEC action may provide the impetus that Chief Compliance Officers can leverage to guide corporate boards and C-suite executives to create a social media governance structure.

I read the proposed guidance with great interest. I had expected the FFIEC to provide guidance regarding a financial institution’s active use of social media in its business and by its employees, both in their capacity as employees as well as off-duty. The proposed guidance directly addresses the Compliance and Legal Risks posed by social media with regard to deposit and lending products, payment systems, anti-money laundering and financial privacy. The regulation of an active social media presence clearly reflects the consumer protection best practices that an organization would apply to its other outbound channels, including print, television, and radio marketing, as well as authorized corporate communications.

The portion of the proposed guidance that I found even more insightful was the Reputation Risk topics the FFIEC chose to explicitly consider. Some executives offer the opinion that if their organizations don’t actively foster a social media identity, then the need for social media governance is eliminated. The FFIEC instead acknowledges that even an organization that chooses to forgo promoting an active social media presence is subject to the risks that can be thrust upon an organization by the public. Noting that reputation risk is the risk arising from negative public opinion, the proposed guidance delves into the realm of dissatisfied consumers and negative publicity that can cause significant harm to a law-abiding financial institution. In addition to Fraud and Brand Identity and Third Party Concerns, the FFIEC directly addresses a financial institution’s affirmative obligation to monitor Consumer Complaints and Inquiries initiated via social media.

In an economy overflowing with consumers clamoring to ensure that “there’s an app for that,” financial institutions have worked actively to develop social media channels to harness consumer demand to varying degrees. Additionally, those same consumers who routinely update their social networks (both personal and professional) from their smartphones while waiting for the train or purchasing a latte’, will also launch a Twitter rant or a scathing and aptly-named blog post about your organization before they’ve left your premises. This proposed guidance, which will likely receive many comments before being issued in its final form, is going to eventually become part of your prudential regulator’s examination process.

I would propose that now is the time to address your organization’s social media governance process. Working with your board of directors and your senior leadership colleagues, you can assess the current status of your policies and procedures; identify and address perceived gaps; and provide appropriate guidance to employees within your organization before the regulators arrive to test your practices. Action now will likely ensure that your regulator hits the “Like” button later.

1         Federal Financial Institutions Examination Council [Docket No. FFIEC-2013-0001]: “Social Media: Consumer Compliance Risk Management Guidance,” http://www.ffiec.gov/press/Doc/FFIEC%20social%20media%20guidelines%20FR%20Notice.pdf

COMPLIANCE NEVER SLEEPS

Ever so slowly a consensus appears to be emerging that the economy has been improving in the United States. Though some economic indicators, including the unemployment rate and consumer sentiment, remain stagnant, we are witnessing a rebound in private sector hiring, new construction, and equities investing. Equity is returning to homeowners and mortgage refinancing has returned. Innovation continues to flourish across industries.

And the imperative for vigilant corporate compliance programs and professionals has never been greater.

Lest you brand me a killjoy at the party of renewed American prosperity, let me encourage you to pause and reflect upon the post-recessionary periods of the past several decades.

When organizations emerge from the austerity and uncertainty of a recession, like action movie survivors emerging from a post-apocalyptic underground bunker, leaders seek to return to the familiar and comfortable patterns of pre-recession growth. We want to sell things. We want to build things. We hire people and purchase systems and tools to do both. And we want to do it quickly to make up for lost time and to satisfy pent-up consumer demand.

I propose that, as leaders, we should also pause to reflect upon the patterns and practices that led to the recession in the first place. On a microeconomic level, the organizations whose actions precipitated the recessionary events often succumbed to false notions of success built upon skewed compensation plans, short-term corporate financial results, and process or quality breakdowns. While the industries may change from financial crisis to financial crisis, the factors that string the past two decades’ mortgage banking, energy trading, and technology busts together are not very dissimilar.

So, what is the difference between the company that succumbs and the company that succeeds over the long term in the very same industry? I would conclude that it rests upon universal adherence to an unwavering compliance program. Like guardians at the gate, the joint efforts of Compliance, Audit, Security, and Ethics professionals stand firm against cultural shifts within some organizations that allow foundations to crack.

As we move beyond this most recent recession into our blossoming period of prosperity, I encourage you to take a moment to re-evaluate your investment in your organization’s compliance program. Even as you bolster production and sales efforts to meet consumer demand, bolster compliance resources within the organization.

·         Publicize your Code of Conduct and Ethics Hotline.

·         Revisit traditional and emerging high-risk areas of compliance and control exposure.

·         Renew your leadership commitment to the truth that your corporate compliance program is a competitive advantage.

Preparing your compliance program today to withstand the inevitable recession of tomorrow will ensure long-term prosperity for your organization.

COMPLIANCE: A VALUE-ADDED SERVICE TO THE ORGANIZATION

“It’s a sign of troubled times when the concept of ‘pressure’ becomes an acceptable excuse for ethical shortcuts and moral shortcomings. Pressures are just temptations in disguise and it’s never been acceptable to give in to temptation.”  ~Michael Josephson

As a profession, we have worked diligently to shed the stereotype that long-plagued us, that of being a legalistic cost-center who impeded organizational growth. [While you may not have ever personally experienced the stereotype, let me assure you that many of us have received the sarcastic “oh, here comes Audit/Compliance…”]

Like me, many of you regularly engage in projects within your organizations to provide the compliance and ethics (C&E) perspective.  In some organizations, we are routinely invited to project planning sessions and kick-off meetings, remaining to consult with the project team until implementation. In other instances, we become aware of an in-process initiative that contains elements of regulatory risk and invite ourselves into the project. Either way, C&E professionals provide valuable subject matter expertise to ensure that the organization’s we represent are well-grounded in compliant activities.

That being said, I was reminded recently that our work is not over. A colleague had relayed to me a situation at her organization that continues to cause dismay to C&E professionals. During a stakeholder meeting to explore system integration and replacement options, my colleague put forth a variety of system security and operational suggestions to strengthen the information security and consumer compliance framework from inception. After dismissively alluding to costs associated with these suggestions more than a few times during the meeting, the project leader looked up at my colleague and replied, “Well, we may not be able to incorporate each of these items, but—you know—sometimes you just have to go along to get along…” Apparently, the project leader even slyly winked at my colleague as this was said.

I get a little choked up as I recount my colleague’s reply, as with a spine of steel she looked back (without a wink) across the table and said, “Well, no. This organization doesn’t knowingly build non-compliance into its new initiatives, so I wouldn’t sign off without the controls in place.” When the project leader published the next version of the system requirements, each of the compliance components had been incorporated as submitted, and had been risk scored accordingly.

We are going to be asked to participate in many initiatives over the course of our C&E careers. Certainly we will always seek the most cost-effective and internally-conducive methods to achieve compliant outcomes, because we believe in our organizations and wish to help them succeed in the marketplace.

But occasionally we are going to be asked to step beyond the fiduciary responsibility with which our Board has entrusted us, and which society expects of us. It is in those moments when our fidelity to doing the right thing will supplant simply bowing to doing the popular thing. It is in that moment of fortitude and loyalty to duty that we will have added true value to our organization…