All companies must comply with regulations, and some companies are stricter than others. In the medical, financial services, energy, national defense and high-tech industries, the regulatory requirements are complex, especially if the business is global.
Business leaders have to respond. In addition to fines and penalties, the lack of violations or even effective compliance plans will also cause losses to customers, markets, investors, and sometimes the loss of financing capacity and required business licenses.
In addition, in today’s information environment, if regulatory compliance is disclosed, the negative impact on brand and reputation may be particularly harmful, so trust in enterprises and products may weaken in the next few years.
What is more worrisome is that even if we intentionally neglect or neglect to accept the restriction requirements, we may also sue individuals(civil and criminal). The US Department of Justice continues to focus on prosecuting individuals(especially those in power) with better deterrence.
This document advises business leaders on how to strategically address regulatory requirements to fulfill their responsibilities and build the most effective compliance capabilities.
Leadership response
Regulators believe that active participation in leadership helps all companies strive to comply with regulations.
According to the US Department of Justice, “… the most important thing is the role and actions of management”(among the factors affecting compliance). And, according to the US Treasury Department… in order to effectively develop compliance programs, clear leadership support is required. ”
Obviously, you know that without a little direct and firm leadership, compliance can easily be weakened or failed.
However, the motivation to deal with limiting risks is different. In extreme cases, regulatory risk will be ignored, underestimated or sacrificed to pursue different priorities. As a result, compliance is externally concerned and only checked by events or, worse, completely ignored.
Other extreme requirements include compliance by customers, the company’s board of directors, regulators, key partners and suppliers, or risk assessors and auditors. The leadership had to respond.
Ideally, compliance risks should be fully mitigated and assumed to be part of the overall risk posture of the organization. Thereafter, the Company’s leadership and the Board of Directors should make a clear and competent response.
take action
So what should business leaders do? The usual advice is to cultivate the “top tone”, pursue the “obedient culture”, and pursue the “drift with the tide”. These are indeed helpful, but they are not enough. This also applies to a single emphasis on integrity and morality. Although helpful, it is not enough.
Consolidating compliance into the organization’s actual business requires careful consideration. This means that compliance must be an inherent factor in the daily behavior of the organization.
Typically, compliance personnel are added or the compliance team is positioned as a subsidiary of the organizational architecture. This is similar to managing talent without integrated human resources skills, or ensuring accurate financial reporting without standards based accounting skills. No wonder compliance is often a struggle, and potential violations(at least of relevant policies and directives) are the root cause of persistent insecurity.
The solution has enough influence and ability to build the compliance function of strategic positioning in the formal organizational hierarchy and become a participant in the company’s decision-making, direction and relationship.
The US Department of Justice hopes that the compliance plan is well designed, honest and feasible. This means that compliance is not a combination of policies, actions, processes, and alerts. And this is certainly not an occasional distraction or afterthought.
Practical list of enterprise leaders
Taking into account regulatory guidelines and expert recommendations, the following 20 questions can be used as a checklist, assessment tool, and action plan for corporate management to ensure effective compliance.
You.
-
Have you made a clear statement of your commitment to comply with your regulations, including your compliance approach?(In codes of conduct, mission or value statements, company policies and similar documents)
-
Do you have a board committee with sufficient expertise to regularly participate in, understand, evaluate, monitor, and address compliance issues and challenges?
-
Is a senior risk and compliance committee composed of business and functional leaders established to understand the situation and audit, resolve and support compliance functions through authority, guidance and supervision?
-
Can the top compliance officer(CCO) and support staff be appointed as needed to give full play to the position, autonomy and direct contact of the company’s leadership and board of directors?
-
Do you implement compliance functions to ensure the independence, autonomy, and independence of business operations and other departments, such as sales and operations, and prevent conflicts of interest?
-
Put the compliance department in the same position as other basic functions(such as human resources, finance, tax, business, security, etc.). “.?
-
Delegate front line compliance responsibilities to relevant operational functions. For example, does the three lines of defense COSO agreement ensure transaction monitoring and control?
-
Set compliance responsibilities(including discipline) and incentives(including promotions and bonuses) for leaders and managers of the organization, regardless of the operations or functions assigned?
-
The overall commitment to compliance in conflict of interest screening, increased compliance or policy violations, recruitment, allocation and promotion decisions?
-
Are you subject to review and input from the compliance department from the beginning, including all strategic decisions such as new business pursuits, products or services, customer and supplier contracts, partner and joint risk contracts, acquisitions or mergers?
-
Have you implemented a regulatory investigation process to evaluate all third-party relationships, including suppliers, contractors, partners, and new employees, before applicable contracts and employment?
-
Implement third-party certification and control plans to screen, evaluate, monitor, evaluate, support, train, integrate, and comply with third-party regulations
-
Does the compliance department locate and authorize access to relevant operational data and information for comprehensive oversight?
-
Do you want to use specialized regulatory subject expertise to integrate compliance into the company’s risk assessment and mitigation efforts?
-
In particular, do you authorize the audit department to develop or develop specific thematic capabilities for high-risk compliance risk exposure, investigate major findings and report to the company’s management/board of directors?
-
Have you implemented hotlines, comment mailboxes, gateways, and other red flag reporting mechanisms to alert people to policy and compliance, unnecessary compliance, and enforcement?
-
Do you have an enterprise wide central plan to track violations and remedial actions, and support self reporting and proactive disclosure of security processes?
-
Ensure that compliance costs are fully included in any business expansion, project, or risk.
-
Regularly review compliance budget allocations to ensure that you have sufficient time to successfully implement regulations, including expertise and human costs, education and development, legal resources, professional association membership, travel, research, and technology.
-
Entrust relevant business departments P& l Does the cost of compliance(objectively determined or confirmed by the compliance and accounting departments) include in the management cost? Note: Bearing the cost of compliance only from the perspective of the company does not really assign responsibility for compliance, nor does it explain the actual cost pursued by operations or businesses.
Many of the actions implied by the above questions are usually prescriptive. Other suggestions are provided only in specific cases. But in order to have enough impact, all these must establish compliance functions with legitimacy, authority, influence, resources and feedback to effectively fulfill its mission. And all compliance initiatives must be effective.
Moreover, hooligan incidents can never be completely avoided, but as long as all the above issues are seriously addressed, such incidents will be minimized, indicating that the leadership has fulfilled its responsibilities.
Some considerations
To enhance compliance, the following assumptions are important:
a. The implementation of compliance programs and procedures must be assigned to compliance experts(unless you have extensive compliance training and experience, you are not a good manager or smart lawyer). Compliance is an established professional effort.
b. Compliance mainly depends on the effectiveness of other functions. For example, if accounting lacks appropriate procedures and standards, it will be difficult for compliance departments to implement controls to prevent money laundering or bribery. If the procurement is lax in supplier entry and supervision, it is difficult for the compliance department to screen sanctions and implement compliance agreements; if the logistics cannot control the supply chain, it will be difficult for the Compliance Department to prevent prohibited transactions, such as exports to embargoed destinations.
c. Using consultants can be helpful, but it is often distracting. Only fully built-in consultants can fully understand companies and organizations to define and implement compliance plans. In the process of compliance design and implementation, familiarity with enterprise personnel, operations, direction, challenges and structural characteristics is irreplaceable.
Last sentence
Any leadership involvement proposed in this document must not result in additional expenditure beyond the compliance budget. If they do significantly increase compliance costs, it is fair to assume that compliance resources are insufficient. This in itself is a problem that requires leaders to think carefully.
On the other hand, positive actions arising from the above issues can significantly reduce compliance costs, prevent violations, and improve the efficiency and effectiveness of compliance programs and functions.
Finally, it needs to be pointed out that the lack of direct and serious leadership participation in regulatory compliance is not only unconvincing, but also may be an oversight of regulatory responsibility. The description in this document is a feasible way to make every effort to achieve effective compliance, so as to ensure that the company’s management will not be recruited due to weaknesses or failures.
