Training has long been recognized as a cornerstone of any best practices ethics and compliance program. As far back as 1992, “Conducting effective training programs” was listed in the Federal Sentencing Guidelines[2] which mandated “effective training” as one of the factors the US Department of Justice (DOJ) will take into account when a company accused of a Foreign Corrupt Practices Act (FCPA) violation is being evaluated for a sentence reduction.
Approaches to Training
But what is an “effective training program”? Andrea Wrage noted in Ethisphere Magazine[3] that there are two general approaches to ethics and compliance training. The first approach focuses on knowledge of the rules “as clear and sharp as barbed wire” so that the cowboys in the company will not run wild. This is the approach most US in-house lawyers feel is required for their company’s operations and sales teams and is generally designed to help avoid criminal liability.
The second approach focuses training on ethical values and is more prevalent in Europe, where ethics and compliance are more designed to communicate a company’s underlying corporate values in its operations. This approach anticipates that most employees are decent and law-abiding and will not knowingly engage in bribery and corruption. Additionally, you can never create enough rules to govern every situation and train each employee on every rule, so a company must hire trustworthy people and give them sufficient information to make the correct ethical and compliant decision. Wrage characterized the two different approaches as “ethics” vs. “values.”
Both approaches have merit, but both can catastrophically fail without the other components of an effective compliance program. For instance, having a “gold standard” code of compliance and ethics alone is not enough. Although it was not brought down by an FCPA violation, the Enron code of ethics was viewed (at least at one time) as one of the strongest in the energy industry. And Siemens had one of the most robust codes of ethics for a European company, before its multi-billion dollar (or euro, take your pick) fine and profit disgorgement. So, the training on both of these companies’ “gold standard” codes of ethics did not turn out to be too helpful. More recently Wells Fargo also had a first class code of conduct and internal reporting hotline but still allowed its fraudulent accounts scandal to go on unabated for several years before regulators fined the company some $185 million. Yet as noted by Kerri Grosslight in her article “Minimize Risk by Maximizing Accountability,”[4] training is one of the key components of an effective compliance program.
What should a company’s training focus on to be effective under the Sentencing Guidelines? It appears that effective ethics and compliance training should emphasize both approaches. Americans are long taught what the rules are in whatever life they choose. They expect to be told what the rules will be, so that they know where the line is drawn that they should not step over. Probably the single comment I have heard the most, when putting on ethics and compliance training in the US, is, “Just tell me what I can and can’t do.” However, really effective training requires that employees be able to apply the rules to the incredibly wide and ever-changing situations that confront them in the real world. This is where communicating a company’s values is important. In other words, how would your conduct look if it was plastered on YouTube the next week? The 2012 FCPA Guidance recognizes that different types of training can be appropriate to not only different organizations, but even different groups within one organization. The 2012 Guidance stated, “For example, companies may want to consider providing different types of training to their sales personnel and accounting personnel with hypotheticals or sample situations that are similar to the situations they might encounter.”
The key is that a company assesses its own base to determine the compliance risk it faces and then ranks the groups within the company who may need more focused training. You need to train the right people. You must prioritize which audience to educate by starting your training program in higher risk markets and focusing on directors, officers, and sales employees who may have direct contact with government officials or deal with state-owned entities. Again, focus initially on training country managers in your company’s high-risk markets, then expand geographically and through the ranks of employees.