(tracy.saale@schwab.com, linkedin.com/in/tracy-saale-jd) is the Corporate Responsibility Officer and Managing Director of the Conduct Risk Management program at the Charles Schwab Corporation.
How do we know what we don’t know? Conduct, ethics, and compliance professionals routinely ask this question. It is also a question my peers and I frequently posed when I was a special agent and attorney for the Federal Bureau of Investigation (FBI). The FBI’s elite Behavioral Analysis Units (BAU) are renowned worldwide for their outstanding work. They focus on preventing and solving crimes by understanding the psychology that leads individuals to commit certain acts. As a special agent, I sought their assistance in developing behavioral profiles. They provided valuable insights into individual behavior that I was unable to glean through standard investigative techniques. Their expertise in analyzing behavior and patterns of activity helped me become more predictive, resolve my investigations more quickly, and prevent future criminal activity.
I left the FBI several years ago to pursue a career as a conduct and ethics professional in the private sector. I was amazed to learn that similar behavioral analysis techniques were used in the private sector to better understand cultures and mitigate corporate noncompliance and misconduct.
Behavioral science risk management gained traction within the financial services industry after the 2007–2009 financial crisis. In many instances, compliance and ethics professionals were blindsided by the excessive risk-taking and misconduct that occurred during that period. They sought to incorporate enhanced techniques into their risk management processes to be more predictive and prevent the same type of misconduct from occurring in the future. With the encouragement of the Federal Reserve Bank of New York, the Financial Conduct Authority (FCA) of the United Kingdom, and the Dutch central bank, De Nederlandsche Bank (DNB), numerous financial services institutions sought out the expertise of behavioral science teams. These teams assessed corporate culture and individual behaviors to recommend techniques to enhance risk management practices. These techniques have since spread to a wide variety of organizations in both the private and public sectors.
Behavioral science techniques can provide tremendous value within any organization. Behavioral analysis provides a forward-looking, complementary approach to traditional risk management techniques currently being utilized within conduct, ethics, and compliance programs.
Why consider behavioral science now?
The past few years have revealed unprecedented challenges posed by COVID-19, remote work, economic uncertainty, and the “Great Resignation.” Numerous studies have demonstrated a widening gap between what employees are thinking and doing and what leaders perceive their employees are thinking and doing. For example, while employers and the media largely attributed the recent spike in nationwide employee attrition rates to salary concerns, a study of online employee profiles found that toxic corporate culture was the strongest predictor of employee attrition. Toxic corporate culture was determined to be 10 times more critical than compensation in predicting turnover.[1] We must better understand what drives employee behavior not only from an employee satisfaction and retention viewpoint but also from a risk perspective. Behavioral science techniques can help us better identify root causes of what may be driving employee actions and impacting corporate culture. With this knowledge, we can more proactively remediate cultural concerns and nudge employees toward desired behaviors and away from potential misconduct.
What can behavioral science detect that traditional techniques do not capture?
Behavioral scientists can help detect the seemingly infinite number of biases impacting human judgment and behavior. Some of the more commonly observed biases are confirmation bias (we favor evidence that confirms our position), conformity bias (we seek acceptance instead of doing the right thing), and status quo bias (we choose to stay in our current situation rather than make a change). Behavioral risk analysis can identify blind spots that cause gaps in our understanding of why we make certain choices. Common blind spots include ethical illusions (most people believe they are more ethical than they are), ethical fading (humans frame decisions with euphemisms like “judgment call” or business decision” to ignore the ethical dimensions of our choices), reward systems (organizations can unintentionally incentivize unethical behavior through rewards systems), and motivated blindness (we overlook unethical behavior for our personal gain).[2]
Behavioral analysis can be extremely effective in identifying behavioral drivers. Common behavioral drivers range from individual biases based on personal beliefs and experiences to broader contextual biases such as those related to remote work and the economy. Other drivers may include organizational biases related to a company’s business model, governance, policies, and incentive plans, and social biases related to factors such as employee psychological safety and social norms within an organization’s culture.[3]
What is a behavioral risk management review?
Behavioral risk management reviews are comprehensive assessments performed by teams of behavioral risk professionals in disciplines such as organizational psychology, behavioral economics, and sociology. The teams may review an entire entity or focus exclusively on processes or units designated by the organization as a higher risk for noncompliance or misconduct. A typical review may include in-depth confidential conversations with key personnel; in-person or virtual work observations; online surveys; analysis of performance, risk, and human resources metrics; and evaluation of policies, procedures, and Codes of Conduct.[4] The teams then evaluate qualitative findings against quantitative data to understand how employees react to certain professional situations. Reviewers typically provide a targeted mitigation strategy to directly address any concerning behavioral drivers. Mitigation strategies can include a series of solutions such as nudge-lab workshops, gamification techniques, training, focused employee engagement, management tool kits, leadership development sessions, recurring follow-ups, and cultural surveys to assess the effectiveness of the solutions.[5]
What are nudge and gamification solutions?
Nudges are common behavioral risk mitigation solutions. A nudge is “any aspect of the choice architecture that alters people’s behavior predictably without forbidding any options or significantly changing their economic incentives.”[6] In other words, nudges are subtle reminders that impact our behavior. They are generally inexpensive. A familiar COVID-19-related nudge is the placement of footprint decals on floors to encourage us to remain six feet apart. An example of a workplace ethical nudge is positioning employee attestations at the top of expense reports instead of the bottom; therefore, employees consider the obligation to be truthful while completing the document.
Gamifications are another typical solution. They can be digital or nondigital. Gamifications involve incorporating gaming elements into our daily activities to motivate us. Workplace examples might include an app with quizzes on ethical decision-making, reward programs, and raffles.
How can behavioral analysis help us improve compliance messaging?
Behavioral analysis can also help organizations gain a better understanding of how their compliance messaging may be perceived by employees. If compliance messaging is confusing or ambiguous, employees may interpret it inaccurately. Additionally, unclear messaging may cause employees to believe compliance is not taking a concern seriously, and the guidance may simply be checking a box.
With either option, employees may use ineffective guidance to rationalize misconduct. For example, Codes of Business Conduct and Ethics (“Codes”) are often ignored or misinterpreted by employees if they are too long, contain overly legalistic language, or appear to be a management directive that does not align with operational reality. Organizations can potentially increase employee compliance with their Codes by using plain language to eliminate common rationalizations for misconduct, deleting excess content to make them easier to understand, and incorporating employee input into Codes to tap into social norms and focus on fundamental shared beliefs.[7]
Compliance and risk professionals should consider enhancing their current programs with these and other behavioral science techniques to proactively mitigate risk.
Takeaways
-
Conduct, ethics, and compliance professionals can incorporate behavioral science techniques into risk management practices to proactively identify and address behavioral drivers through process and organizational changes.
-
The behavioral science approach combines identifying behavioral hot spots, an in-depth behavioral risk review to assess cultural concerns, and targeted interventions to mitigate risk.
