Anti-Corruption Compliance:

Are Employees Becoming “Over-Trained”?

By: Greg Esslinger[1]

November 3, 2011

As the US Department of Justice and US Securities and Exchange Commission, and now the UK Serious Fraud Office, continue to make known their expectations regarding the sufficiency of compliance programs, companies continue to try proactively to get ahead of the curve. With the backdrop of the US Sentencing Guidelines and prominent conventions such as the OECD, the US and UK governments both have identified corporate tone, leadership, due diligence, monitoring and remediation as key components of a successful and defensible compliance program. Similarly, they have made clear that immediate and continuous training of employees is integral to the equation.

In response, companies have begun to provide more and more accessible (read: web-based) anti-corruption and related regulatory training programs. Predictably, a panoply of vendors have surfaced offering state-of-the-art customizable online training modules, complete with scenarios, live actors, knowledge checks and certifications. Online compliance training has now become a cottage industry serving a wide array of organizations faced with the daunting task of communicating a Western regulatory concept to tens of thousands of employees across multiple languages, cultures and jurisdictions – again, under the watchful eye of various enforcement bodies.

Communicating the rules and expectations of compliance to employees who are on the front lines of the bribery risk is critical to compliance success. Indeed, the “failure to prevent” offense within the UK Bribery Act, a clear expansion from US law, arguably adds heightened importance to the concept of adequate communication as compliance programs come under a new type of scrutiny as a potential affirmative defense. Larger organizations seeking best-in-class compliance programs often conduct periodic self-checks or risk assessments, performed in conjunction with internal audit or similar monitoring activity. Smaller companies with more limited resources may approach this risk assessment activity less formally. Regardless, as recognized by the Guidance to the UK Bribery Act, this risk assessment activity is the foundation for the design of an adequate compliance program.

As a natural part of these risk assessments, companies are interviewing local personnel to test how well policies and procedures are being communicated across multiple levels of the organization. The goal is to measure whether and how well employees can articulate the specific risks related to their operational activity and then link the relevant policies to those activities. This includes measuring the “soft” elements of compliance like “tone at the top” and cultural and other human nuances, principles squarely acknowledged in the US Sentencing Guidelines, the OECD Good Practice Guidance and the Guidance to the UK Bribery Act as important to the overall measure of a program’s functionality and often a challenging metric in the context of an acquisition.

In practice, those of us involved in frequent risk assessments, especially in smaller organizations, are still seeing a lack of understanding of these complex issues at the local level – which brings us back to the subject of training. Since the “training boom” of the past several years, it has become evident that employees in larger organizations are becoming better and better at articulating the applicable law and its nuances, right down to the FCPA’s element to “obtain or retain business” and its books and records provisions. One wonders whether this parroting of legalese is indicative of increased awareness or the result of repetition of stale online and mass-administered training modules over time.

This difficult question brings to light a serious issue: whether repeated online and other mass training will over time actually have the unintended effect of desensitizing employees to, rather than making them more aware and cautious of, bribery and other corrupt activity. This result may impact the effectiveness of a company’s risk assessment, which will be subject to less reliable results when employees’ knowledge is surveyed as part of a company’s regular compliance monitoring. Similarly, the impact may be an unclear picture of a target’s compliance program’s effectiveness during pre-acquisition due diligence. Worst-case-scenario is that a key employee makes a bad decision because in her desensitized state she fails to recognize the danger of her interaction with a government official.

There is little, if any, guidance available on the required frequency or content of a compliance training program, although most experts agree that employees should be trained as part of new-hire orientation and at least annually thereafter. Despite the risk of unintended consequences, cutting back on training to avoid the effects of repetition is therefore not advisable, especially with compliance programs coming under a new “adequacy” measure. Rewriting (and then re-translating) training modules every six months to keep up with changes in the legal framework is also not a viable economic option for most companies – again underscoring the value provided by outsourced training vendors that can do this much more efficiently. And yet, it is critical for companies to cover the more esoteric human element of compliance to get assurance that compliance programs are working as expected, i.e., measuring the “soft” aspects of compliance like “tone at the top,” as described above. So, to prevent employees from becoming desensitized by frequent training and to keep employee surveys and interviews efficacious, here are some practical suggestions:

· Make sure someone “owns” the training program and that it is the right person. Organizations, following traditional departmental delineations, may place the training onus on Human Resources. However, the concepts and risks associated with anti-corruption and bribery are not only serious, but have complex legal implications. It is important that the Human Resources department is not left alone to deal with – and educate people about – these issues.

· Train the trainer. Local management should be invested in, and participate in, training, particularly given that they will likely be the first responders if an issue arises. Likewise, training should not be a “corporate” exercise handed down from afar. Employees are much more likely to pay attention to the importance and concrete impact of these issues, if they see and hear from local leadership.

· While training programs are difficult to change frequently, make sure they are updated on a regular basis. Global anti-corruption laws are developing rapidly. Local laws have become more relevant and have changed recently in certain jurisdictions, including China, Russia, India and Indonesia. Changes to company structure and focus often lead to new policies. Updates to the program will provide variations to material and get employees’ attention.

· Along the same vein, outside vendors are incentivized through competition to have up-to-date material. Especially if you find yourself with new operations in emerging markets where English is not the primary language, consider using a vendor to get current training to new employees quickly. Organizations often find that the costs of going outside are less than expected, particularly in relation to the risk.

· However, don’t accept an off-the-shelf approach. Compliance training programs can appear to be similar across vendors. However, most vendors are willing to edit the copy and format of their programs to suit the specific needs of their customers. Companies should work with those vendors or internally to develop very specific examples of bribery scenarios as part of training. Scenarios should speak to the specific industry, jurisdictions and sales channels in which you operate.

· Consider that different functional areas should be trained differently. An accounting supervisor and a regional sales director encounter very different types of corruption risk. For example, in China, the former may be worried about counterfeit fapaio (receipts) while the latter is unsure whether a $200 dinner is acceptable. Training should address multiple perspectives on the bribery risk, tailored to all audience members.

· Risk assessment interviews and audit activity are still important tools to gauge the effectiveness of training. But make sure these processes don’t become repetitive as well. Assessors and auditors thus should vary questions in both content and wording and make sure they survey a good cross section of employees from key functional areas (senior management, sales, marketing, accounting, logistics and HR). Also, companies should seek input from both seasoned veterans and new employees to make sure they are reaching everyone with their messaging.

· Ask the hard questions that get to the true nature of the risk. It is critical to understand the specific risks associated with a particular operation in a particular industry and a particular jurisdiction. In training discussions and monitoring activity, companies should not talk around an issue, but should address it head-on. In other words, use what you know about your organization to find out what you don’t know.

· Use the results of audit and other monitoring activity to help formulate the training content. If a problem or exception arises during monitoring, then it must be remediated. But the process should not stop there. Companies can connect the risk to reality for employees by using re-crafted but real examples of issues that have surfaced. This will go a long way towards ensuring a problem does not arise again.

· Training takes many forms beyond online modules. Training occurs more effectively in live discussions, so encourage your local management, especially in high-risk jurisdictions, to make anti-corruption compliance issues a regular agenda item in office and team meetings. Also, leverage what is learned from risk assessment and audit activity to generate company newsletter material.

· Seek and respond to training feedback. Employees will have opinions about the training they are given, how well they understand it, and whether it keeps their interest. Organizations should take this information and use it to modify and improve their messaging, or even to identify volunteers to assist with training delivery or updates.

Designing and administering an effective training program is a challenge faced by many organizations. The risk posed by training programs going stale or becoming so effusive that they no longer serve their purpose is becoming more real, particularly as organizations expand globally and need to train and monitor personnel in remote jurisdictions. However, as training finds its place in the enforcement arena as one measure of a compliance program’s adequacy, companies should seek to keep their training fresh and updated, and to leverage the information flow provided by multi-faceted training and monitoring activity to ensure employees are not only getting the message, but hearing and responding to it. By adopting the practical suggestions outlined in this article, companies can increase the efficiency of their training programs while reducing the risks associated with employees becoming desensitized to more frequent training.

[1] Greg Esslinger is Senior Managing Director at FTI Consulting, Global Risk and Investigations and is based in Atlanta and Washington, D.C. A former practicing attorney, he has more than 15 years experience conducting domestic and international investigations in support of senior management and counsel in a wide variety of matters. Mr. Esslinger’s experience includes FCPA and government corruption; complex financial fraud; audit committee and special committee investigations; international due diligence and asset tracing; and global compliance program development. He has conducted matters in more than 40 countries across the Americas, Europe, the Middle East, Africa and Asia. The views expressed here are those of the individual author and are not necessarily those of the ABA or the Task Force.

-----------------------------------

The content on this page has been prepared for general information purposes only; it neither is legal advice nor is it intended as legal advice.

Please see the full disclaimer on this website.

Advertisement

Greg Esslinger

Greg Esslinger