I have been attending and speaking at seminars and conferences for a long time. Hopefully I've shared some worthwhile ideas, and I know I've found most of the events helpful. In looking back at them all, however, I am struck by a single constant, and that is complaining. Complaining about proposed and new laws. Complaining about regulators. Complaining about nearly anything that might impact attendees' compliance programs.
Some speakers have made a career out of complaining and, in some respects, putting the fear of God into conference-goers. Many of the complaints have been well grounded. (But then aren't all of our complaints?) All along, I thought that companies would eventually figure out how to meet regulatory expectations, and that the compliance world would settle down. Well, I was really wrong on that one-one reason I'm not a gambler.
I have to admit that I was a charter member of the Complaint Society And, to a certain extent, I still am a complainer. But as time has passed and I can now see the forest despite all those darned trees, it is evident that while complaining does have its place and can sometimes bring value, it is probably better to redirect that energy into getting things done. What is more, given the current environment surrounding consumer compliance, money laundering, terrorism, and fraud, we need to focus on the root causes instead of simply the fix.
It's About Bad Actors
If I could ask for a show of hands, how many of you want ISIS to expand in the US? Or, how about your everyday North Korean sympathizer being able to easily channel funds north of the 38th parallel on the Korean Peninsula? I suspect, or maybe more so hope, that your answer in each case would be an unequivocal "No."
Well, here's a fun fact. Anti-money laundering laws and sanctions by the US Office of Foreign Assets Control and its counterparts around the world are there to help prevent bad things from happening. And, they are not going away. In fact, expect them to become even more challenging for financial services companies.
So while, yes, it is painful to comply in many ways that vary by institution, the focus needs to be on compliance, and compliance begins with culture. Why? Because the compliance officer cannot do it alone. Building a rock-solid program is no good without buy-in and execution by the business.
Compliant to the Core
The ability to build and maintain an effective compliance program may begin with a knowledgeable compliance officer who can execute its design, implementation, and oversight. However, its success and-most important-sustainability reside in culture. Culture drives everything, since without a culture of compliance within an institution, even the best compliance officer will fail.
It has often been said there needs to be a "tone at the top." This is true, since without the most senior executives and board of directors driving the bus in the right direction, culture doesn't have a chance to take root. However, while this is a key attribute to catalyzing the right culture, it is only a piece of the overall puzzle.
From here, culture needs to cascade down and across an institution. It needs to be embedded deep within the core values and into every aspect of an institution's operational framework. Without middle management's dedication and buy-in to the culture, execution and sustainability will fail.
Historically, the tone at the top was the driving force behind culture. CEOs might have sent out an annual note on the importance of ethical behavior along with the institution's code of conduct, and that was it. Maybe there was some follow-up afterwards. Wallpaper, to say the least. Policy without execution and validation is no better than no policy at all.
Middle management is where the rubber meets the road. Managers carry the message, they execute the business plan, they decide who does what and how. So institutions need to ensure their middle management gets it, owns it, and implements it-and if not, gets out.
The MAD Method
During my compliance officer days I worked with some outstanding senior executives and middle managers and some not so outstanding. You can tell who they are on both sides. Think "MAD"-Measurement, Action, Discipline.
Measurement means monitoring and reporting. Regular meetings with key staff, particularly middle managers, are extremely important to maintain a pulse on culture. Metrics such as key performance indicators and key risk indicators should be used. In addition, other information should be leveraged such as customer complaints, audit and regulatory reports, and anything else you can identify as providing meaningful information or data to monitor compliance management across the company.
Action means taking ownership, implementing, and maintaining.
Management-most importantly, middle management-needs to carry the culture torch. Middle managers should ensure their team's day-to-day activities are consistent with the cultural and ethical standards handed down from the top of the house. Top management needs to provide the support necessary in order for middle management to succeed, otherwise the risk increases that middle management will quickly stray off the culture path.
Discipline means taking swift and decisive steps to address any identified culture issues. They should be taken in a consistent manner (in other words, don't play favorites.). This includes anything from impacting compensation to termination.
The MAD method goes beyond the incentive compensation guidelines issued by regulators. The guidelines are a good foundation, but every company needs to look within itself to determine what is in its best interests above and beyond what the guidelines prescribe. For example, if you are rolling out a new process, it requires buy-in from multiple departments to be successful. Everyone needs to take ownership and, if not, the new process fails. Consider baking that "first principle" into a MAD program for the year-or at least until the process is implemented and deemed sustainable.
All in-that's when a strong culture will prevail. You cannot have anything less than that. The alternatives are control breakdowns potentially resulting in disciplinary actions or, even worse, a civil or criminal prosecution. Anyone who has been subjected to a regulatory disciplinary action can attest that the pain and expense is hard to endure. And, with the Department of Justice's recent proclamation through the Yates memo that it will more aggressively investigate individuals for corporate misconduct, it is clearly a lot better to get it right than to be told you got it wrong. Don't tolerate anything but 100% buy-in to your culture of compliance.
View as PDF
Treliant Risk Advisors, Compliance, Risk Management, and Strategic Advisors to the Financial Services Industry, brings to you New Coordinates, a quarterly newsletter offering insights and information regarding pertinent issues affecting the financial services industry. This article appeared in its entirety in the 2016 Outlook issue. To subscribe to our quarterly newsletter, please Contact Us.