Ethics and the New Compliance Ethos

The most crucial change from the Commission requires that the Chief Compliance Officer (CCO) report directly to the board of directors or supervisory board. The idea is that the CCO is then independent of the other officers in the corporation and in direct contact with the ultimate leadership. Comments respecting these changes pointed to a perceived need to ensure that corrupt management could not stop disclosure at the Board level and that the Board was actively involved in compliance functions.

Under the rubric of a proper “response” to detected criminal activity, the Commission has specified that a business must make remediation efforts, including restitution, to potential victims of its wrongdoing. Thus, a responsible compliance program is one that acts swiftly to make its wrongs right ' before sentencing. Presumably, the costs of such efforts would be recognized by the sentencing court in any restitution order, although there will be inevitable questions and challenges concerning scope, manner, amount and putative victims who are represented by counsel and pursuing remedies through separate legal proceedings.

Finally, the Commission has installed a form of safety valve for companies whose high-level personnel were involved in the activities at issue. Previously, the involvement of high-level personnel meant that the company could not receive a reduction in sentence no matter how robust a compliance program it had established. High-level involvement was reason enough to distrust the effectiveness of the program as a whole. Now, however, recognizing that even state-of-the art programs can be defeated by those intending to conceal unlawful activities, the Commission will permit a reduction if four criteria are met. First, consistent with the initial amendment described above, the CCO must report to the Board. Second, the company must have discovered the problem first. Third, the company must have reported the problem promptly to the government and, fourth, none of the involved high-level personnel can be a part of the compliance function in the business.

As safety valves go, it is a small one because typically outsiders (such as government investigators) discover the violation first, especially where high-level personnel have gone about concealing it. Nonetheless, it avoids the per se rule that made reductions impossible and compliance programs therefore valueless in a significant number of prosecutions.

The Tone from the Middle

Last March, the OECD issued “Good Practice Guidance on Internal Controls, Ethics and Compliance Programs.” In keeping with the current trend, “ethics” has moved ahead of compliance not just in the title of the OECD's Guidance document, but in the OECD's references to “Ethics and Compliance Programs” generally.

The Guidance document has many helpful suggestions, but its core emphasis is two-fold. First, the OECD strongly suggests a “clearly articulated and visible corporate policy” that avoids legalese and allows for easy dissemination throughout the business. Middle managers are thus expected to “set the tone” for their direct reports in the same fashion as the top-level managers. Second, like the Commission, the OECD expects direct and visible oversight of the ethics and compliance function by Board and senior business executives. Combined with ensuring the proper tone from the middle, the ultimate goal is to make ethics and compliance as much a part of business operations as actual business.

There is a detectable bias against corporate counsel in these recommendations. Many existing programs place the oversight function with the legal office, typically the “Senior Vice-President and General Counsel,” a natural fit given familiarity with legal requirements. But both the OECD and the Commission are adamant that the oversight function belongs at the Board and Audit Committee level. There is good sense in this, given the natural and proper instinct of corporate legal officers to take a defensive stance when problems arise.

'Ethics' As a Weapon

The danger in the Commission's and the OECD's new emphasis on a strong ethical component in compliance programs is the obvious one that just what “ethics” means has been the subject of philosophical debates for millennia. The reason ethics should be debated anew in this context is that prosecutors and judges hold considerable discretionary authority in the charging and sentencing function. A highly malleable concept like “ethics” leaves the exercise of this discretion open to very individualized, and inconsistent, interpretations.

The pronouncements of the Commission and the OECD on the subject of ethics appear to rely upon a “natural law” theory of ethics, which assumes that individuals are able intuitively to understand basic principles of self-governance. Thus, we intuit that it is a good thing to be open and to favor disclosure. In the context of conflicting interests surrounding a criminal problem in the business context, however, natural law can fail us quickly. One such situation is the very common one that arises when a business faces the question of what to do with a long-serving and loyal employee whose zealousness has lead to a bad mistake. The common wisdom is that such an individual must be fired for the good of the company as a whole, but certainly this conflicts with our intuitive notions of what is good for the company (taking into account morale, broader responsibility, etc.) and our intuitive belief in rehabilitation as well as our competing considerations of loyalty.

More sophisticated and more modern ethical tools fare no better. The same conundrum is no more easily solved when one takes the utilitarian approach. What is good for the greatest number might be an emphasis on rehabilitation, just as easily as it might be the absolute minimization of risk, including the patent risk that the loyal but erring employee presents. Indeed, to the extent that maximizing shareholder value is considered acting in the interest of the greatest number of persons, even questions about whether to disclose wrongdoing are open to serious debate.

Still more ethical tools could be explored in this debate, but they work against prescriptions like the OECD's for clarity and ease of application. Kantian categorical imperatives, for example, require that we impose upon ourselves and others the logical consequences of our actions and, as a result, might have us disclosing wrongdoing in every situation regardless of the harm it might do to the company as a whole and to innocents whose livelihoods are at stake.

In short, the more complicated the situation, the more complicated the ethics. It does not serve the ultimate interests of anyone'especially businesses ' to continue a philosophically empty charade. The result is that we now risk losing all credit for having spent many hours and large sums for a program that is deemed deficient because ethics is a highly debatable subject.

State What You Believe

The most defensible and risk-averse tactic for businesses that are amending their programs in the wake of these new developments is to do something more than write a paeon to broad ethical terms but, instead, articulate more specific values. If company leaders don't believe in the automatic firing of long-serving employees who have erred, even if criminally, then they should state that. If disclosure is something that the company wants to consider carefully on a case-by-case basis, then they should state that as well. If confidentiality of individual and professional activities is a respected value in the company, then that too should be identified as a strong “ethical” value in the company..

Such values are not the code of the outlaw, and need not be cast as such. Their articulation at least allows counsel to point out to a prosecutor or a judge that the company's values are clearly articulated and have integrity, even if the prosecutor or judge does not agree with them. Without at least that, there is only ambiguity, and a company will have no ground to argue forcefully that its program warrants recognition in the course of investigation or sentencing.

Jeffrey T. Green ([email protected]), a member of this newsletter's Board of Editors, is a partner in Sidley Austin LLP's Washington, DC, office and a member of the White Collar practice group.

All of us who are involved with compliance programs as advisers and counselors must take heed of recent developments at the U.S. Sentencing Commission and the Organization for Economic Cooperation and Development (OECD). While these developments alone are significant, they reflect a continuing sea change in compliance philosophy ' one that prioritizes “ethics” and “values” as the central component of all compliance programs. At first blush, high-minded talk about ethics and values sounds good, but a more frank dialogue is warranted about just what “ethics” means and whether this development unfairly favors enforcement officials.

Take Me to Your Leader

In April, the Sentencing Commission promulgated changes to Chapter Eight of the Guidelines, applicable to businesses. Section 8B2 advises a reduction in the culpability score for businesses that have established “Compliance and Ethics Programs.” In that same section, the Guidelines set forth criteria for effective programs. These same criteria are mirrored in the various Department of Justice (DOJ) policy memoranda regarding when to prosecute businesses. The Commission's views on what constitutes an effective compliance program are therefore important, and the changes detailed here will take effect on Nov. 1 unless Congress intervenes (which is not expected).

The most crucial change from the Commission requires that the Chief Compliance Officer (CCO) report directly to the board of directors or supervisory board. The idea is that the CCO is then independent of the other officers in the corporation and in direct contact with the ultimate leadership. Comments respecting these changes pointed to a perceived need to ensure that corrupt management could not stop disclosure at the Board level and that the Board was actively involved in compliance functions.

Under the rubric of a proper “response” to detected criminal activity, the Commission has specified that a business must make remediation efforts, including restitution, to potential victims of its wrongdoing. Thus, a responsible compliance program is one that acts swiftly to make its wrongs right ' before sentencing. Presumably, the costs of such efforts would be recognized by the sentencing court in any restitution order, although there will be inevitable questions and challenges concerning scope, manner, amount and putative victims who are represented by counsel and pursuing remedies through separate legal proceedings.

Finally, the Commission has installed a form of safety valve for companies whose high-level personnel were involved in the activities at issue. Previously, the involvement of high-level personnel meant that the company could not receive a reduction in sentence no matter how robust a compliance program it had established. High-level involvement was reason enough to distrust the effectiveness of the program as a whole. Now, however, recognizing that even state-of-the art programs can be defeated by those intending to conceal unlawful activities, the Commission will permit a reduction if four criteria are met. First, consistent with the initial amendment described above, the CCO must report to the Board. Second, the company must have discovered the problem first. Third, the company must have reported the problem promptly to the government and, fourth, none of the involved high-level personnel can be a part of the compliance function in the business.

As safety valves go, it is a small one because typically outsiders (such as government investigators) discover the violation first, especially where high-level personnel have gone about concealing it. Nonetheless, it avoids the per se rule that made reductions impossible and compliance programs therefore valueless in a significant number of prosecutions.

The Tone from the Middle

Last March, the OECD issued “Good Practice Guidance on Internal Controls, Ethics and Compliance Programs.” In keeping with the current trend, “ethics” has moved ahead of compliance not just in the title of the OECD's Guidance document, but in the OECD's references to “Ethics and Compliance Programs” generally.

The Guidance document has many helpful suggestions, but its core emphasis is two-fold. First, the OECD strongly suggests a “clearly articulated and visible corporate policy” that avoids legalese and allows for easy dissemination throughout the business. Middle managers are thus expected to “set the tone” for their direct reports in the same fashion as the top-level managers. Second, like the Commission, the OECD expects direct and visible oversight of the ethics and compliance function by Board and senior business executives. Combined with ensuring the proper tone from the middle, the ultimate goal is to make ethics and compliance as much a part of business operations as actual business.

There is a detectable bias against corporate counsel in these recommendations. Many existing programs place the oversight function with the legal office, typically the “Senior Vice-President and General Counsel,” a natural fit given familiarity with legal requirements. But both the OECD and the Commission are adamant that the oversight function belongs at the Board and Audit Committee level. There is good sense in this, given the natural and proper instinct of corporate legal officers to take a defensive stance when problems arise.

'Ethics' As a Weapon

The danger in the Commission's and the OECD's new emphasis on a strong ethical component in compliance programs is the obvious one that just what “ethics” means has been the subject of philosophical debates for millennia. The reason ethics should be debated anew in this context is that prosecutors and judges hold considerable discretionary authority in the charging and sentencing function. A highly malleable concept like “ethics” leaves the exercise of this discretion open to very individualized, and inconsistent, interpretations.

The pronouncements of the Commission and the OECD on the subject of ethics appear to rely upon a “natural law” theory of ethics, which assumes that individuals are able intuitively to understand basic principles of self-governance. Thus, we intuit that it is a good thing to be open and to favor disclosure. In the context of conflicting interests surrounding a criminal problem in the business context, however, natural law can fail us quickly. One such situation is the very common one that arises when a business faces the question of what to do with a long-serving and loyal employee whose zealousness has lead to a bad mistake. The common wisdom is that such an individual must be fired for the good of the company as a whole, but certainly this conflicts with our intuitive notions of what is good for the company (taking into account morale, broader responsibility, etc.) and our intuitive belief in rehabilitation as well as our competing considerations of loyalty.

More sophisticated and more modern ethical tools fare no better. The same conundrum is no more easily solved when one takes the utilitarian approach. What is good for the greatest number might be an emphasis on rehabilitation, just as easily as it might be the absolute minimization of risk, including the patent risk that the loyal but erring employee presents. Indeed, to the extent that maximizing shareholder value is considered acting in the interest of the greatest number of persons, even questions about whether to disclose wrongdoing are open to serious debate.

Still more ethical tools could be explored in this debate, but they work against prescriptions like the OECD's for clarity and ease of application. Kantian categorical imperatives, for example, require that we impose upon ourselves and others the logical consequences of our actions and, as a result, might have us disclosing wrongdoing in every situation regardless of the harm it might do to the company as a whole and to innocents whose livelihoods are at stake.

In short, the more complicated the situation, the more complicated the ethics. It does not serve the ultimate interests of anyone'especially businesses ' to continue a philosophically empty charade. The result is that we now risk losing all credit for having spent many hours and large sums for a program that is deemed deficient because ethics is a highly debatable subject.

State What You Believe

The most defensible and risk-averse tactic for businesses that are amending their programs in the wake of these new developments is to do something more than write a paeon to broad ethical terms but, instead, articulate more specific values. If company leaders don't believe in the automatic firing of long-serving employees who have erred, even if criminally, then they should state that. If disclosure is something that the company wants to consider carefully on a case-by-case basis, then they should state that as well. If confidentiality of individual and professional activities is a respected value in the company, then that too should be identified as a strong “ethical” value in the company..

Such values are not the code of the outlaw, and need not be cast as such. Their articulation at least allows counsel to point out to a prosecutor or a judge that the company's values are clearly articulated and have integrity, even if the prosecutor or judge does not agree with them. Without at least that, there is only ambiguity, and a company will have no ground to argue forcefully that its program warrants recognition in the course of investigation or sentencing.

Jeffrey T. Green ([email protected]), a member of this newsletter's Board of Editors, is a partner in Sidley Austin LLP's Washington, DC, office and a member of the White Collar practice group.