I’ve spent the last 16 years of my career helping companies design, build, and improve upon their compliance and ethics programs. (And the nine years before that practicing law. So, yes, 2020 marks a big birthday for me. But, alas, I digress … already! 😊 ) Much of the work my team and I have done during that time involves assessment — of compliance risks, compliance programs, and compliance policies.
Risk, program, and policy assessments may sound dissimilar, but they are fundamentally more alike than they are different. In each case, the ultimate goal is to determine the effectiveness of an organization’s efforts — how useful its compliance policies are, how successfully it manages compliance risk, how effectual its overall compliance program may be.
When conducting any kind of a compliance-related assessment, there are three important facets to consider:
- Design: Are the policies, risk management protocols, and/or compliance programs well designed?
- Implementation: Have they been implemented as designed?
- Impact: Do they have their intended impact?
The first two facets are relatively easy to determine and are typically based on one or more familiar, well-recognized frameworks.
The big challenge, really, is how to assess impact.
It’s imperative to gather information — and opinions — from people. Real, live people.
Impact metrics are, by their nature, usually more subjective than they are objective. And that means it’s imperative to gather information — and opinions — from people. Real, live people.
In our experience, most compliance assessments do, in fact, include both objective and subjective dimensions. (Much to the dismay of many auditors and data analysts!!) It’s simply the nature of these initiatives. But, most companies are still not getting the full picture
Measuring Impact With a Top-Down AND a Bottom-Up Approach
The vast majority of assessments include executive interviews — from the C suite down to the VP level. A top-down approach like that is good. It’s important to understand the tone at the top and the opinions of those in senior management.
Yet, most companies stop right there, which begs the question: How much do senior leaders really know about what’s going on down in the trenches — especially in large, global, and/or decentralized organizations??
In our view, the only way to truly understand whether a company’s compliance efforts are effective is to connect with the people who do the grunt work — the associates who make the motor run, the workers without whom an organization would not grow. In many cases, those are the folks who are the most affected by compliance policies, procedures, and controls. They will be far more likely to know whether a process is faulty or effective, whether people follow the rules or skirt them, whether their colleagues understand their responsibilities or don’t even care.
How much do senior leaders really know about what’s going on down in the trenches — especially in large, global, and/or decentralized organizations??
If you want a dose of reality, incorporate a bottom-up approach in your assessment activities and talk to the masses. Conduct employee-only focus groups, launch a compliance survey — one that’s far more substantive than the five questions you may be granted in your annual pulse survey. To borrow from Joe Murphy, a virtual legend in the compliance space, “It’s amazing what people will tell you if you just ask.” After all, your colleagues at the top are far more likely to wear rose colored glasses — and to see the glass as half full than as half empty. So, gather information both from the top and the bottom. The truth is usually somewhere in between.
Oh, and one more thing: Don’t put off conducting a more fulsome assessment due to COVID!
Oftentimes, organizations don't undertake a bottom-up approach because of logistical challenges. Believe it or not, the global pandemic may have made it easier to reach a larger audience. Virtual communication tools — and everyone's increased familiarity with them — are making it simpler and less expensive than ever to connect with employees who may be in different locations and time zones and/or on different schedules. We’ve found that virtual interviews, focus groups, and desktop reviews can be just as effective as in-person discussions, as long as you leverage video technology.
Ready to get the biggest bang for your assessment buck? Our Advisory Services team can help. Reach out to us at hello@rethinkcomplianceco.com to set up a free consultation. We’d love to chat about your compliance program, risk, or policy assessment needs.
