Brian D. Annulis (brian.annulis@ankura.com) is Senior Managing Director, Sarah M. Couture (sarah.couture@ankura.com) is Managing Director, and Kayla M. Teune (kayla.teune@ankura.com) is Senior Associate at Ankura in Chicago.
Chief compliance officers (CCOs) understand the importance of creating a culture that identifies and mitigates risks. In fact, not having a culture that timely identifies risks and escalates them was in the top 10 risks according to “Executive Perspectives on Top Risks in 2019.”[1] One of the first steps in establishing a compliant culture is educating and involving the governing body/board in compliance. Guidance documents from both the U.S. Department of Justice (DOJ)[2] and the U.S. Department of Health & Human Services Office of Inspector General (OIG)[3] discuss the importance of a culture of compliance being driven by organizational leaders, or “tone at the top,” and creating and fostering a culture of ethics and compliance with the law.[4] Additionally, the U.S. Federal Sentencing Guidelines indicate that the company’s “governing authority shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight.”[5]
Although it is clear that board needs to be involved, it is common for CCOs to struggle with what the compliance–board relationship should look like in their organization. The reasons a CCO may have difficulty fostering a meaningful board relationship may include:
-
The CCO having limited access to the board in general;
-
Not knowing the best way to engage the board and help board members understand their compliance oversight responsibility;
-
Being unsure of the balance between information overload and not enough information when reporting to the board on the compliance program;
-
Being unsure of the best way to educate the board on compliance and which compliance topics should be included;
-
Lack of certainty as to whom to engage with on the board and how frequently;
-
Compliance may not be a priority in the organization, so the CCO may not get adequate time with the board; and
-
Compliance being looked at as a regulatory necessity to check the box vs. a valuable business partner that reinforces a positive corporate culture.
This article is intended to share a road map on how to effectively create and manage board engagement and interactions to strengthen your compliance program and overall corporate culture.
Understanding challenges to effective board management
When it comes to board engagement and management, the CCO must navigate how to effectively spend time with the board and how to make sure board members are educated about the compliance program and compliance activities happening in the organization. However, this may be easier said than done. There are several challenges that the CCO must overcome to effectively communicate with the board.
First, the CCO must have access to the board. Lack of access can be caused by several reasons, including lack of precedent access to board, senior leadership preventing board access or wanting to be the in-between, or the organization being concerned about reporting compliance information in meeting notes that are required to be publicly available because of various states’ Open Meetings acts. Additionally, access may be further complicated if a central board oversees multiple entities and it is unclear how the CCO should interact with the central board. Whatever the challenge the organization may face, the DOJ emphasizes the importance of a compliance officer having direct access to the board and that this access is key to effectively communicating with the board members.[6] So, access must be the first challenge to overcome to establish a meaningful board relationship.
A second challenge a CCO may face is having an unengaged or uneducated board. According to Society of Corporate Compliance and Ethics & Health Care Compliance Association’s September 2017 survey, only 18% of board members are highly satisfied with the amount of compliance training they receive to the extent they receive training at all.[7] Common challenges the CCO may face regarding board education and engagement include:
-
The board has had inconsistent past interaction with or education about compliance;
-
Board members have a lack of understanding of their compliance and oversight responsibility;
-
They have insufficient awareness of what compliance risks exist and the benefits of an effective compliance program;
-
They view compliance as a checklist rather than a dynamic tool to prevent and detect fraud, waste, and abuse;
-
Members do not understand that they set the tone for compliance and culture in the organization; and
-
They are more focused on financial performance and lack focus and attention on compliance.
A third challenge for the compliance officer is knowing what to report to the board or how detailed the reported content should be. It is important for the CCO to understand what kind of information and level of detail the board prefers and ensure the compliance report (and compliance program) is aligned to the risks in the organization. Some boards want only high-level details, while other boards would like the compliance officer to share some information that is more “in the weeds.” What type of information and level of detail does the board request to aid in its oversight responsibility? As the CCO’s communication with the board evolves, the CCO should have ongoing conversation with board members about their desired depth and breadth of compliance reporting. This will allow the CCO to be the most efficient and effective in communicating with the board.
Once a compliance officer understands and identifies their challenges regarding board participation in compliance, then they can strategically plan how to overcome and manage these challenges.
