Alert: "Integrity Compliance for Small and Medium Sized Companies" [Part 2]

In our last alert, we discussed the first three fundamental categories of an effective compliance program: (1) Risk Assessment; (2) Management Buy-in; and (3) Code of Conduct [see our previous alert for the full discussion  on these categories]. The next four are just as crucial:

These core principles are the foundation of an effective compliance program in any size business. The ways in which the principles are implemented, however, will vary depending on the context of the business. Such adaptations for different sized businesses will be the subject of a future alert. But all leaders should consider whether their business has a compliance program at all and, if so, whether it is sufficiently robust to address each of these principles. If not, the first step is for management to direct an integrity evaluation and risk assessment and implement or upgrade the current compliance program.

1. Training and Communication: An effective compliance program must be clearly communicated to all levels of the organization. Communication alone, however, is not enough. The company must allocate the resources to provide and document effective training of employees with regard to compliance issues.
2. Reporting: Reporting includes at least two critical aspects. First, the company must be clear that every employee has both the duty, and also the opportunity, to report any potential violation of the company’s integrity program. That reporting should be designed so that, if necessary, the information reported is kept confidential, and the reporting employee may remain anonymous. There must be an express (and enforced) prohibition on retaliation for such reporting. Second, there must be clear channels for updates, oversight, and lessons-learned to be communicated to senior management.
3. Third parties: An effective compliance program does not only look inward, but also looks outward. Policies and procedures to perform due diligence on third-party business partners are essential to any compliance program. The company must communicate its ethical standards and values expressly to third-party partners. Contracts with such partners should include reference to the company’s integrity compliance program, audit rights, and provision for termination if that partner is found to have violated such standards. There must also be ongoing monitoring of the relationship, including requesting annual compliance certifications, audit rights, and proper internal controls to monitor the payments made to those third-parties.
4. Testing, Review, and Adaptation: No integrity program can be constantly effective without continuous improvement. The program must include policies for the regular reevaluation of risk, review of the business environment, testing of controls, and assessment of the program’s current suitability. Further, each time an investigation is conducted, the company should review the process to determine whether improvements should be made. When appropriate, modifications should be made to overcome the shortcomings identified.