In our decades of working with complex organizations on their ethics and compliance (E&C) programs, my colleagues and I have seen a wide variety of structures. We’ve seen stand-alone programs, programs under the control of a legal department, and outsourced programs. We have seen programs run by E&C professionals, programs run by a multi-headed GC, and programs run by outsiders. While we readily admit that there is no one way to structure an E&C program, we have come to believe that there are a few common traits of the best programs:
- A designated and committed leader. Generally, we prefer to see an E&C program run by a dedicated Chief Ethics and Compliance Officer (CECO) rather than one run by another business leader (for example, CAO, GC, COO) wearing two hats. It is certainly reasonable to invest an existing framework (for examplethe GC) with CECO accountability, but for a number of reasons this is not ideal.
- A high-ranking leader. A successful CECO must be able to attract the attention of other members of the organization. It is difficult to investigate the actions of the vice president of sales when the head of the organization’s E&C organization is only at the director level.
- Clear reporting authority to the CEO and Board. Although reasonable people can argue about the best placement of a CECO (for examplereport to the CEO, report to the GC, etc.), there is no good argument against ensuring that the CECO has the capacity (and responsibility) to bring the appropriate questions directly to the CEO and /or to the board of directors.
- A written program. It is difficult to implement, enforce and evaluate a program that only exists in the ether. Meaningful E&C programs must be focused, organized and documented. And employees need to know where to find them.
- A clear investigation plan. Even the best E&C program will not prevent transgressions. Thus, there should be a thoughtful and consistent plan for reviewing and addressing nonconformities. The plan should integrate the roles of different stakeholders, including the legal department, human resources, internal audit, E&C and others.
- Adequate resources. In a recent speech, DOJ Chief Prosecutor Kenneth Polite gave his perspective on the steps companies should take to ensure a meaningful E&C program. Properly staffing the program with resources was very high on his list. This includes adequate facilities, resources, professional development opportunities and, of course, staff.
- A distinction between the legal department and the E&C office. Many organizations house the E&C function within the legal department. Although there is no prohibition against this, I argue that there are advantages to a standalone E&C function. Among other things, a stand-alone E&C function provides better protection of legal department attorney-client privilege. And the legal department can always take advantage of E&C professionals to support investigations with a properly drafted (and applied) cover letter. If the E&C office and the legal department are to be combined, it is essential to develop procedures and practices for determining which side of the line a given activity falls on.
We do not mean to suggest that these are the only best practices for setting up an effective E&C program, or even that they are the better best practices. But our experience strongly suggests that these are very good starting points. Maybe you have others. We would love to hear from you.
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.