Chief Ethics

desmond7

the_chief_ethics.pdf

Home >Business & Finance homework help >Management homework help >Chief Ethics

The Chief Ethics and Compliance Officer: A Test

of Endurance

PATRICK J. GNAZZO

ABSTRACT

The Chief Ethics and Compliance Officer (CECO) is an essential and important function in organizations. The CECO position is, however, a relatively new position and, as such, is not yet institutionalized as a separate function within those organizations. This article addresses what the author believes are the reasons the CECO should be independent from the General Counsel and that the position should report to the highest levels within that organization, including the Board of Direc- tors. The questions addressed will have a lasting impact on the strength and lasting viability of the CECO in organizations in future years. The author outlines seven conditions that, if met, will enhance and fortify the CECO position for the future.basr_396 533..553

This article and the public lecture on which it is based were made possible through a generous grant by the Verizon Foundation. The author and the Center for Business Ethics would like to express their thanks to the Verizon Foundation for its support. Patrick J. Gnazzo is Former Chief Ethics, Risk and Compliance Officer of CA Technologies in New York. E-mail: [email protected].

Business and Society Review 116:4 533–553

INTRODUCTION

I assume that many of you in this room have little or no

experience with an organizational compliance/ethics officer. Well, I was in your shoes 20 years ago when my employer

asked me to become United Technologies Corporation’s chief compliance officer. Now, 20 years later, I can honestly tell you that being a chief ethics and compliance officer, a CECO, was my most rewarding career experience. Further, I believe deeply that the reason behind why the CECO function was so rewarding to me is exactly the same reason why the CECO function should be impor- tant to most of you in this room.

No matter what career you choose after you leave Bentley, an effective CECO will make your job all the more enjoyable. An effective CECO has your back, and he or she will make it easier to say “no” to the inevitable pressure to cut corners or bend the rules. An effective CECO allows employees to devote their energies to being productive rather than protective.

At times in this presentation, I will mention the ethics function and the compliance function as separate functions and then as a combined ethics and compliance function. For a number of reasons, the strong opinion among my colleagues is that the function should not be split, most notably because the combined function has the power to help an organization do the most good. I agree with that position and have had the combined responsi- bilities at both of my former organizations.

There are, however, conflicting views that surround combining the two functions into what we in the community now call the CECO: the chief ethics and compliance officer. I hope that at the end of this session, you will agree with me that there are very compelling arguments in support of the CECO function as an organizational department head participating in management decisions alongside the other functional department heads such as the chief legal counsel and the chief financial officer.

The CECO is a relatively new function in corporate America. By new, I mean the function is only about 20 years old. I’m sure 20 years may seem like a long time to many of you in this room, but it is a comparatively short time when you consider that the Dow Jones Industrial Average Index started in 1882 and that 1790 is considered the year that the investment market was born.1

534 BUSINESS AND SOCIETY REVIEW

I first became involved with compliance in 1986, when my company, United Technologies Corporation (UTC), considered joining a group of defense contractors in an organization named the Defense Industry Initiatives, referred to today as DII.2 By way of background, DII was founded by 32 large companies doing business with the U.S. Department of Defense. UTC, one of these 32 defense contractors, is a $56 billion corporation with a number of business segments, including Otis Elevator, Carrier Air Condi- tioning, Sikorsky Helicopter, Pratt & Whitney Jet Engines, Hamil- ton Standard, and UTC Fire and Security. In 1986, UTC was the seventh largest defense contractor and employed over 200,000 individuals of whom only 90,000 were U.S. citizens.

These 32 defense contractors, UTC included, decided to form the DII organization for two reasons. First, they believed that they needed to establish compliance programs within their organiza- tions to better prevent the kinds of fraud that were appearing in the national news almost daily. In fact, the catchphrase in the media at the time was that “fraud, waste and abuse” was a major problem in the defense industry. The reputation of defense con- tractors was so bad during this period that public polling surveys had defense contractors ahead of used car dealers and Congress as organizations they least trusted. To emphasize this last point, at that time my mother read about these bad defense contractors in the Pittsburgh Press, and knowing that I worked for UTC, called very worried and asked me, “Are you a crook?” I told her that having raised me with her values, she shouldn’t worry about me going to the dark side. But when the average citizen reads about the government paying $7,000 for a coffee pot or $10,000 for a toilet seat, you can understand my mother’s concern. And, there- fore, the second reason these defense contractors wanted to form DII was their hope that a public stance promoting solid compli- ance programs would give both the Department of Defense and the public at large confidence in the defense contractors’ deter- mination to clean up their own house. History has shown that their establishment of compliance programs was the right thing to do for their organizations.

At the time DII was being formed, I was UTC’s associate general counsel responsible for U.S. government procurement, and as such, I was asked to review the requirements for membership in DII. Specially, I was tasked to advise the Chief Executive Officer

535PATRICK J. GNAZZO

(CEO) on any legal risks with the DII membership requirements. I, as the associate general counsel for U.S. government procure- ment, recommended against joining DII. That recommendation may come as a surprise to colleagues in the ethics and compli- ance community who have known me for 20 years. My role as associate general counsel and the recommendation I gave to the CEO are central to this presentation. My analysis today of the conflict surrounding the CECO position centers on the business judgment behind the CECO’s decisions. A lesser role for the CECO, I believe, impacts the quality of those business decisions and the CECO’s effectiveness in protecting the interests of all the organization’s stakeholders, including employees, shareholders, customers, suppliers, and the community.

I recommended against joining DII for two reasons. First, one of the absolute requirements of DII was that all the member com- panies had to promise they would make a voluntary disclosure of a procurement violation when they discovered it. And second, each company was required to establish hotlines so that employ- ees could report any alleged violations (we attorneys like to put “alleged” in front of anything that sounds bad). These hotline allegations would then require investigation and a voluntary dis- closure of the findings to the government.

Obviously any voluntary disclosure could lead to fines and imprisonment of individuals, and under the False Claims Statute, possible debarment (exclusion from bidding on future U.S. gov- ernment business) of the corporation for up to three years.3,4 As an attorney, I believed it was not in the best interest of my organization to voluntarily disclose alleged violations. In other words, it was not in my corporation’s best interest to give up its constitutional right against self-incrimination. Further, the very fact that we would be asking our employees to come forward with allegations of wrongdoing would place my organization in a posi- tion of beating the bushes for alleged bad acts when in reality, without the hotline, we might never become aware of an alleged problem, let alone have to report that alleged problem to the government.

Fortunately, the UTC CEO rejected my recommendation against joining DII, not because my analysis was flawed, but because the CEO believed the corporation had a responsibility to give its customers and the public (including my mother in Pittsburgh)

536 BUSINESS AND SOCIETY REVIEW

confidence that the corporation was not defrauding the U.S. gov- ernment and its taxpayers. Thus, UTC’s membership in DII, as well as that of the other 31 corporations, was made solely on the basis of business considerations, not legal considerations. Inter- estingly, I can still remember a former general counsel of Litton Corporation, Norm Roberts, publicly stating at an ABA public contracts event that he was pleased with the fact that he was able to convince his CEO not to join DII for the same reasons laid out in my recommendation. In his role as the general counsel, his legal recommendation won out over joining DII for business reasons. Based on my experience over the last 20 years, my CEO’s business decision was the right thing to do because he put his customer first.

My presentation today is in four parts:

• First, my definition of business ethics and compliance; • Second, why organizations need a CECO and a discussion of

its responsibilities; • Third, the controversy surrounding the position and whether

that controversy is preventing the CECO from becoming a permanent fixture in organizations;

• Finally, I will end this lecture with some recommendations that I believe would assure the stability of the CECO function and its proper positioning within organizations.

On this point, many organizations establish strong CECO posi- tions after they have been found guilty of some serious criminal violation and are required to have a strong CECO function under the terms of a settlement agreement. This is what happened to my former employer Computer Associates (CA Technologies today). Under the terms of their Deferred Prosecution Agreement (DPA), CA was required to establish a strong CECO position.5 I was hired in 2005 to fill that role, and in addition, later became the chief risk officer. I would be happy to discuss deferred prosecution agreements in our follow-on sessions, but suffice to say that CA is no longer under the DPA. After I moved to become the general manager of CA’s government business, my former function was split into three, with each responsibility reassigned to another function in the company. What happened at CA happens so many times after organizations are no longer required under some mandate to maintain a strong CECO function.

537PATRICK J. GNAZZO

I will now address the definitions of compliance and ethics. I hope these definitions explain why the functions are still having difficulty being integrated into organizational structures on a consistent and universally accepted basis. First, my definition of compliance is adherence to all the laws, regulations, rules, and policies governing an organization. And if there is a compliance officer function, it should be responsible for ensuring that all aspects of those organizational requirements are being managed properly. Clearly, compliance is an oversight function. Notice that I didn’t say that a compliance officer should manage all aspects of compliance in each of the functional areas. The compliance offic- ers should be in a position to give the Board of Directors, senior management, and the shareholders assurances that each of the organization’s functional areas is complying with the laws and rules that they are responsible to manage. It should be noted that the U.S. Sentencing Commission in their organizational guidelines concluded that, for an organization to mitigate against maximum penalties, the existence of an identifiable compliance program must have been in place at the time the violation occurred.6 The assumption is that the violation is more likely an anomaly when an organization has put all the right elements in place to comply with the law.

In an organizational structure, there are many departments and thus many areas of expertise and responsibility. I am going to mention quite a few functions, because I believe this will make my point clearer: legal, financial, human resources, manufacturing, information systems, environmental, tax, records management, sales, engineering, community relations, real estate, government relations, communication, marketing, and several more depending on the nature of the organization. Each one of those areas is a center of expertise within an organizational structure. Each one of these areas must be responsible for compliance with both exter- nal and internal rules, policies, and laws affecting their function. So for example, the general counsel (GC) is the expert on antitrust laws, and therefore, is responsible for ensuring that the organi- zation is not violating those laws. Likewise, human resource is responsible for adherence to the Fair Labor Standards Act and EEOC. Finance is responsible for compliance with Sarbanes- Oxley and the Generally Accepted Accounting Principles (GAAP), information systems is responsible for ensuring that there is no

538 BUSINESS AND SOCIETY REVIEW

unauthorized use of software on the organization’s computers, and so on.7 I could present hundreds of these examples, but more importantly, please note that I have given several examples in which the GC is neither the expert nor responsible in a particular area of compliance. This point is important and will be addressed later when I discuss the conflict over who should be responsible for oversight of organizational compliance.

Thus, I believe that the responsibility of the compliance officer and the compliance function should be one of oversight on behalf of the Board of Directors. To this point, there is a famous Dela- ware Chancellery case, called Caremark, where the court clearly stated the Boards of Directors must be knowledgeable of the proper workings of their company’s compliance programs.8 A com- pliance officer is able to report on the state of compliance through the use of tools such as audits, surveys, interviews, and investi- gations arising out of hotline calls or ombudsmen issues. I would be happy to elaborate on the workings of hotlines, ombudsmen programs, and whistleblowers during our follow-on sessions this week.

My definition of business ethics is the establishment of pro- nounced values and culture for an organization. This goes to the heart of how an organization wants to be perceived by its stake- holders and, yes, even by its competitors. An ethics officer, as part of an organization, is responsible for ensuring that an organiza- tion’s values are always part of management’s thought process at decision-making time. The operating culture of the organization should always play a part in the decisions of the organization, and this responsibility for protecting the organization’s culture can be both rewarding and frustrating. It’s rewarding because, when an organization acts to preserve its good culture in business deal- ings, there is an added beneficial effect on stakeholders’ positive attitude toward the organization. This is especially true for employees.9

However, with the average turnover of CEOs running about four to five years, preserving culture is difficult at best and, sometimes, for an ethics officer, it feels like we are pushing a pencil up a hill with our hands tied behind our back.10 This can become most challenging when the economy is weak or your products aren’t selling and profits aren’t meeting Wall Street’s expectations.

539PATRICK J. GNAZZO

Here is just one example of how a change in culture can send a mixed message: A CEO of one company encourages employees to email him with their ideas, complaints, or concerns, and he works hard to respond to each email personally—even if initially it is to say that he has asked one of his functional areas to investigate the issue and get back to him within a certain time- frame. The CEO then responds back to the employee with the results of the investigation. This CEO has established his form of an open communication program. Now imagine that he is replaced four years later with a new CEO who might be faced with poor earnings results and was hired to manage a turnaround. The new CEO might not think that the former CEO’s form of open communication is the right way to devote his time and energies. In discontinuing the practice, it doesn’t necessarily mean he doesn’t care about his employees’ concerns. But that may be the message received when he asks his staff to just forward the emails to an appropriate department. Understand, I am not saying that every aspect of an organization’s culture is good and that every culture should be preserved, but I will tell you that the constant changing of cultures makes violations of law and policy more likely. I say that because when employees understand an organization’s values, they will more likely act to protect them than when values and culture are in flux, confused, or even eliminated altogether.11

Great organizations have published values and sets of high standards, establishing a culture that makes the organization a positive place in which to work. Having someone responsible for preserving those values and ensuring that those values are considered at the time major decisions are made distinguishes a good organization that complies from a great organization that leads.

The role of perpetuating the culture belongs to management. However, prior to the advent of ethics officers, the connection of culture and compliance was distant or nonexistent. The dual role of the CECO makes compliance stronger, because the positive culture reinforces the organization’s message of always doing the right thing. “Don’t lie, cheat, or steal” is a powerful message when combined with a message of good citizenship, including commu- nity involvement, philanthropy, environmental leadership, and open employee communication programs.12

540 BUSINESS AND SOCIETY REVIEW

Organizations with great cultures care about how their stake- holders view them. They manage their companies with an eye toward both internal and external perception, and they want their organization’s values and culture maintained and protected. Therefore, when an organization says “you can rely on the safety of our products,” it backs up that statement with action, from design to production. Such action gives an organization a repu- tation for caring about the safety of its consumers as well as the safety of its employees. An organization that strives for quality as well as safe products, for protecting the environment, and for the safety and well-being of its employees is, in my experience, also an organization that strives to always do the right thing.

The CECO position, therefore, is the logical function to help preserve these values, and should not be separated from the person responsible for compliance oversight. My reasoning is best supported by how an organization promotes and protects an open communication program, such as hotlines, ombudsman pro- grams, or various forms of protected written communications. The protection of employees from retaliation, when using those pro- grams, should fall to an individual who is charged with protecting the culture and is responsible for the oversight of the functional departments’ compliance programs. Protecting employees who are asked to come forward with concerns goes a long way in main- taining a positive organizational culture and adhering to the laws controlling the organization’s operation.

I want to be very clear on several points. First, organizations are required to obey the law. They can try to maintain compli- ance, with or without oversight, but if they want to ensure the compliance, oversight needs to be an organizational function. Second, you can have a compliance program without an ethics program, but you really can’t be an ethical organization without functional compliance programs and a fully empowered compli- ance oversight function.

A key question central to today’s discussion is this: After more than 20 years of recommendations regarding the importance of the ethics and compliance officer from Bentley’s Center for Business Ethics and other organizations such as the Ethics Resource Center, the Ethics and Compliance Officers Association, the Society of Corporate Compliance and Ethics, and the Rand Center for Corporate Ethics and Governance report “Corporate

541PATRICK J. GNAZZO

Governance, Compliance, and the Impact of Regulation—The CECO Perspective and Role”;13 after the promulgation of the U.S. Sentencing Commission’s organizational guidelines, which advised federal judges to take into consideration the existence or the lack of existence of an organization’s compliance program before sentencing; after huge corporate scandals such as Enron, WorldCom, and the collapse of the home mortgage market; after hundreds, if not thousands, of corporate and individual criminal indictments and convictions; and finally, after legislation such as Sarbanes-Oxley and Dodd-Frank.14

Why, with all that has happened during the last 20 years, is there still resistance to the need for and the separate positioning of the CECO function?

I believe there are four reasons. First, the CEO and senior management do not believe the oversight function is necessary because “everybody wants to do the right thing.” Everyone wants to do the right thing, but everybody’s right thing is not the same, and even some right things are really not that important. So why do you need an identified compliance function?

When I was growing up, my mother told me a story which was funny at the time but later enlightening as I began to function in my first compliance role. The story is about my grandmother, Mama Maggie, who was a very religious woman who prayed for me and the rest of the world every day. She lived with my family and did all of the cooking, managed our household, and took very good care of my sister and me while my mother worked outside the home. Mama Maggie had the love and respect of her friends and family and was a role model for all of her 11 grandchildren.

She did something else, too. My wonderful, saintly grandmother made and sold wine during prohibition. She sold it to the neigh- bors, her neighborhood police and firemen, and even to the neigh- borhood politicians. My grandmother broke the law every time she made and sold her wine. When I asked her why she did something clearly illegal, she told me she did it to put food on her family’s table.

Organizations, no matter the size, are made up of human beings. Every one of those human beings has her or his own level of ethics brought to the organization from their upbringing at home; their place of worship; their community, friends, teachers; and even their first employer.

542 BUSINESS AND SOCIETY REVIEW

Think about all the upstanding citizens who passed you or whom you passed on your way to Bentley today—people who were driving over, maybe way over, the speed limit. When deciding to speed, people rationalize that a particular law is not as important as many of the other laws we adhere to every day. Maybe they even had an excuse, “I had to speed because I didn’t want to be late for Pat Gnazzo’s lecture.” Many of today’s speeders probably would not condone the employment of child laborers or bribe a foreign government official. They might, however, throw a candy wrapper out the car window or maybe even do some texting while speeding. These individuals make a personal choice every day as to which particular rules to follow and which to ignore. Organi- zations with hundreds or thousands of employees need to have rules, policies, and codes of conduct. Without these, the organi- zation opens itself up to uncertain liability, out-of-control expenses, or possible criminal penalties. Employees need to know what is expected of them. They also need to understand that if they want to work for a particular organization, they have to follow the organization’s rules, policies, and code of conduct. And I might as well add this now while I’m addressing this need for organizational rules: They need to know that there is someone with the responsibility to ensure that they and everyone else are adhering to those rules.

Similar to my grandmother’s reason for her breaking the law, here are the three of the most common excuses used when an individual is found to have violated a company policy or broken a law. No need to write these down as you will undoubtedly hear them used many times during your business career:

• “I did it for the organization” (mind you, the organization specifically told its employees not to violate policy or law),

• “I didn’t know it was a company policy or a law when I broke it” (no matter that the individual signed a copy of the code of ethics and showed up for the training, and the requirement was called out in both instances),

• And finally, my favorite, “My boss made me do it” (this is the answer that bothers me the most, because after it comes anything from “the boss threatened me” to “the boss winked when I said what I was about to do” to “the boss told me not to tell him or her how I was going to fix the problem”).

543PATRICK J. GNAZZO

Another excuse used less often but with equally faulty reasoning and one that cost my company $400 million in fines was “We didn’t think you were serious when you said not to violate the antitrust rules.” This was said at the same time that they admit- ted to violating the law, admitted to understanding the law, and admitted to having read and been trained in the code of conduct (which specifically told employees not to break the law). This excuse is worth repeating. “We didn’t think you were serious.” And I can assure you that they were serious when they said that.

The second reason for the lack of stability in the CECO function is that management and the Board of Directors do not have a clear understanding of the function’s role in the organization. The main reason for this lack of understanding is that many senior managers and boards have little or no experience with a CECO position or what its functions should be managing.

My same grandmother, Mama Maggie, broke her hip at the age of 50 and thereafter walked with a very distinct limp. As I men- tioned earlier, my grandmother took care of me during my child- hood. What I didn’t mention was that one of my nicknames was “Dennis the Menace” and that I was a hyperactive child. My grandmother couldn’t chase after me and therefore devised a way to keep me under her control so that I wouldn’t hurt myself or get into trouble. When she needed to attend to her other chores, she would tie a long rope around my waist and fasten the other end around the leg of the kitchen table. The rope was intended to limit my activities within a certain range. That limit is much like the kind of limit an organization might attach to an expense policy or a company computer-use policy.

So, there was little Patrick, on the kitchen floor, playing within the rope’s limits while Mama Maggie was in another room ironing. Needless to say, my grandmother, like an organization, should not assume that the controls and policies in place are sufficient to protect against or prevent bad acts. One day I noticed that my grandmother had mistakenly dropped one of her sewing needles on the floor. Being the kind of imaginative child that many of us were, I picked it up and proceeded to redecorate, that is, badly scratch, a relatively new refrigerator. I can recall hearing Mama Maggie using a lot of new Italian words that day.

The moral of this story is that you can write policies and a code of conduct, you can attempt to add controls limiting a person’s

544 BUSINESS AND SOCIETY REVIEW

ability to break the rules, but human nature being what it is, at times ingenious, you can’t conceive of every instance of mischief, let alone devise a plan to prevent every instance. The job of a good compliance officer is to audit programs for flaws, like the fallen sewing needle, investigate violations of policies, and then, when necessary, recommend improvements to those policies going forward (like don’t sew anywhere near Pat in the future). This is an important CECO function that management and Boards of Directors need to understand.

The third reason for the lack of a strong CECO function occurs particularly in organizations where management and the board may believe that everybody should be responsible for doing the right thing. This belief, when an organization does get into trouble, usually leads to the senior managers in the organization pointing to someone other than themselves as the one who should have been responsible. Kind of like other duties as assigned after the fact.

I have one final family story. Mercifully, this one is not about my grandmother but about my grandfather, Papa Jim. He was married to Mama Maggie and also lived with us when I was growing up. Every Sunday, Papa Jim would take me to his bar- bershop and cut my hair. (Think about it: a weekly haircut until I went away to college and then was required to maintain short hair because of ROTC [Reserve Officers’ Training Corps]. I had such compassion for the other not-so-cool people in my school.) After my weekly haircut, Papa Jim would give me a quarter to buy penny candy at the five and dime next door while he cleaned his shop for the coming week. (Do you have any idea how much candy you could buy with 25 cents in 1954? A lot.) We would then go to his club, the Sons of Villa Rosa, where I would retrieve bocce balls for Papa Jim and his buddies. In turn, they would buy me chips and pretzels and sodas (“pop” for those of us from Pitts- burgh). I would eat it all, including the penny candy while the men played cards. It was always around dinner time when we returned home, and I would be so full of junk food that I would not be able to eat dinner. This would cause my mother to com- plain vigorously to my grandfather for his lack of control over the amount of junk food I consumed. My grandfather would smile and very calmly tell my mother that it was not his job to teach her son not to ruin his appetite on junk food.

545PATRICK J. GNAZZO

The moral of this story, if you have not already figured it out, is that the compliance officer’s function is one of advice, auditing, investigating, and reporting. Management is responsible for leading, directing, and enforcing the organization’s rules, regu- lations, and policies.

So now I have given you some definitions and explained the need for both functions. I discussed the need for ongoing reviews and constant vigilance. And finally I told you who is ultimately responsible for managing compliance within organizations.

Why then is there still a problem in institutionalizing the CECO function? The final and most troublesome reason that the CECO function is not a permanent fixture in many organizations is management’s fear that the function will impact their business negatively. I’ve heard people say that constantly having to think about culture and values “slows down the decision-making process” and ask “isn’t it just intuitive anyway?”

At this point, my fellow CECOs are expecting me to say affir- matively that “good ethics and compliance are good for business.” I honestly believe that statement to be true, and I look to the collapse of Enron and WorldCom for validation. However, with the survival of the big banks after the mortgage debacle, the strength of Exxon and even BP after the Exxon Valdez and the Deepwater Horizon oil spills, the important message for organizations should be that the lack of goodness can be very costly to the bottom line. I wish I had a family story where good deeds netted huge amounts of money but I don’t. I can tell you that when my oldest daughter was very young, she would tell friends that her daddy was paid lots of pennies just to tell people to be good. So at least in my daughter’s eyes, good ethics was profitable.

What I find interesting is that many of the individuals I encoun- ter either have no idea what a CECO’s duties entail or just believe the function attempts to ensure that organizations “do the right thing.” That belief, which in its simplicity is very close to my young daughter’s explanation, is both rewarding and unfortu- nately, the very reason the CECO function is still not firmly ensconced in organizations today.

Please don’t misunderstand my comments regarding the CECO function. It has received strong support from many sectors over the last 20 years, and exists at almost all the major corporations as well as many smaller organizations within the United States.

546 BUSINESS AND SOCIETY REVIEW

That fact, along with steady international growth, is very positive for the position.

Aside from the rather neutral “I really don’t understand the need” kind of reasons I laid out earlier, there is another reason the CECO position has still not solidified itself in many organiza- tional hierarchies. Strong opposition from one segment of corpo- rate America continues to argue against an independent CECO who reports to the CEO and the Board of Directors. That oppo- sition is, I believe, self-serving. But before I throw stones, I need to give you some additional background.

I have been an attorney for 40 years. I was a litigator; I was a deputy general counsel, and for a short time, an acting general counsel. In addition, I have held several business positions in two large corporations. I understand what legal departments are sup- posed to do, and I understand what business executives expect from their lawyers.

The reason for my concern regarding the durability of the CECO position after so many years of evolving is that many of my fellow CECOs are not senior executives sitting at the same table with the general counsel and the chief financial officer. Many of them do not have the independence, authority, and access nec- essary to effectively protect the organization’s stakeholders. The CECO, 20 years later, is still receiving major opposition from senior executives who see the CECO as encroaching on their responsibilities, when those responsibilities were never theirs in the first place. This is where I say “I know from where I speak.”

The primary advocates of a lesser role for the CECO within an organization are a number of general counsels and at least one of their professional organizations, the Association of Corporate Counsel (ACC).15 Now the problem: When it comes to the word “compliance,” senior management and Boards of Directors take the advice of their law departments because of one significant event that happened in 1991 when the U.S. Sentencing Commis- sion released its organizational guidelines report. But first you need to understand that a lawyer’s reference book called Black’s Law Dictionary doesn’t even reference the word “compliance,” and Webster’s Dictionary makes no legal reference anywhere in its definition of compliance.16 In fact, my dictionary, albeit published back in 1978, doesn’t have a definition of compliance as we in the business world use it today and offers nothing close to the

547PATRICK J. GNAZZO

definition I gave you a few minutes ago. The argument that compliance was and should continue to be the primary respon- sibility of the office of general counsel has only come about because of U.S. Sentencing Commission uses the word to describe the types of programs organizations need to mitigate penalties resulting from criminal violations. That reference to compliance has grown from the need for compliance programs in order to prevent criminal activity, to the use of compliance in all aspects of organizational management.

As I pointed out earlier, when I was a lawyer giving advice to the CEO, I operated within a defined set of parameters. The role of CECO, as it has evolved, is clearly outside the defined role and duties of the general counsel. And I argue that because of these professional and legal responsibilities of the general counsel, the position of the CECO cannot and should not be under the author- ity of the legal department. The inherent conflicts that result would prevent the CECO from performing those functions and duties recognized by many and set out by the Ethics Resource Center’s position article “Defining the Role of the Chief Ethics & Compliance Officer (CECO).”17

Now I’ll throw some stones. I maintain that the only reason the general counsel wants control of corporate-wide compliance is to control the flow of information that might be damaging to the organization. Oversight is not one of those courses I took in law school.

The reason I believe the responsibility for oversight should be with a separate compliance organization is twofold. First, compli- ance oversight should not be in the hands of someone who is responsible for managing a compliance function. One law depart- ment that did have overall compliance responsibility had the hotline on the general counsel’s desk. Just imagine being an employee aware that the legal department was approving postdat- ing contracts so the company could meet the “Street’s” expecta- tions for the quarter. A former general counsel of CA pled guilty for doing just that while having the employee hotline on his desk.

I maintain that before 1991 and the advent of ethics and compliance organizations and the CECO position, no one group was responsible for overall compliance oversight. I will tell you that individuals with great legal reputations, like Ben Heinemann, the former general counsel of General Electric Corporation,

548 BUSINESS AND SOCIETY REVIEW

argued that, not only should a general counsel have responsibility for compliance oversight but that oversight should be a joint responsibility with the chief financial officer.18 For those of you who know anything about organizational dynamics, a position reporting to two separate functions is the kiss of death. Remem- ber playing off Mom against Dad, and vice versa, in the hope of tripping them up to get what you want?

I believe strongly that a general counsel’s oversight of cor- porate compliance is a conflict of interest, at best. Because they have a duty to protect the organization, among the ways they do that is with the “privilege argument,” the defense against self-incrimination and in legal actions against whistle-blowers. Senator Charles Grassley used some very colorful language in a letter to Tenet Healthcare Corporation’s CEO complaining about their GC also being the Compliance Office. The complaint was about the GC defending the company against a whistle-blower lawsuit while being responsible for the compliance program. Grassley said, and I quote, “It doesn’t take a pig farmer from Iowa to smell the stench of conflict in that arrangement.”19 General counsels responsible for compliance are no more likely to stop bad acts than organizations that have a separate CECO, but the conflict won’t subject the organization to what Grassley calls the “stench.”

Finally on this point—and not intending to beat a smelly pig— let me point out that lawyers have the right to claim attorney– client privilege, but only the client has the right to waive the privilege. As an adviser to management and the Board of Direc- tors, I’ll note that it may be in the organization’s best interest to waive the privilege and make a voluntary disclosure. Let each of us do our job in the best interest of the organization, and let the board and management decide how to proceed, as my CEO did in joining DII.

There must be another voice (an equal voice) in an organization that can offer another opinion to the manager, who ultimately must make an important decision. The law department rightfully should be concerned with protecting the organization through legal means, and the human resources department should right- fully be concerned with protecting the rights of the employee. The CECO’s role is to guard the organization’s culture, the tone that a company has set, and the company’s reputation.

549PATRICK J. GNAZZO

For example, a risk manager in one of my former companies saved the organization millions of dollars on negotiated insurance rates when managers before him were far less effective. This risk manager also was very good at getting insurance companies to give him very expensive gifts and free trips to some nice vacation resorts. When the company discovered his penchant for gifts because of a hotline call, the manager admitted to receiving gifts but argued that his performance on behalf of the company was never in conflict based on the millions of dollars he saved. We all were concerned by this individual’s actions, but HR was con- cerned that maybe the “no gifts” policy wasn’t as clear as it could be, so we might not be in a position to fire him for cause. The legal department was concerned that firing the individual instead of allowing him to resign could subject the company to claims of duress and coercion by some of the insurance companies in order to force us to renegotiate rates. I was concerned with our repu- tation within our subcontractor community. I argued that keeping this individual employed was not the kind of message we wanted to send to our suppliers. We tell our suppliers that we want quality products at reasonable prices with on-time delivery. Accepting gifts from your suppliers could add the cost of those gifts to their supplied goods and services. This additional cost can impact your products’ competitiveness.

All three functions had legitimate positions and aired their points to management. Because we might come at an issue some- what differently, management gets the benefit of a full range of opinions and is better served before deciding what action, if any, to take. Please understand, all three functions care about the negative impact this manager had on our values, but we each drive our major concern in our recommendations to management. I have many of these types of situations stored in my memory bank, as do my fellow CECOs.

It is important to have someone sitting at the table with the rest of senior management, discussing the impact of certain actions on our values. Unfortunately, my experience tells me that if I was not the elephant in the room, values would most likely not make it on the agenda. Just hearing CEOs like Larry Ellison from Oracle tell the HP Board of Directors that their decision to fire their CEO, Mark Hurd, for questionable activities is “not in the best interests of HP’s employees, shareholders, customers and

550 BUSINESS AND SOCIETY REVIEW

partners” proves to me that some CEOs still don’t get it—or worse, don’t even want to hear it. What is of even greater concern is that Mr. Hurd walked away with over $30 million as severance from HP, even after being fired for allegedly lying on his expense reports to cover up his relationship with an HP subcontractor. In my opinion, the severance package was not in the best interests of the stakeholders, and I am reasonably sure it is not how HP will treat lower-level employees caught committing expense report fraud.

What should be done to solidify the CECO the function? I recommend the following:

1. Although the New York Stock Exchange and the NASDAQ currently require all of their members to have a code of ethics, like the one I have here from Enron, they need to amend their rules to require a CECO to help administer the code.20,21

2. CECOs must have a budget and resources, so as to perform those responsibilities I laid out earlier.

3. The CECO must report to the Board of Directors much like the director of internal audit. Both functions are there to protect the organization’s stakeholders.

4. The CECO must be part of the Board of Directors’ executive session so that issues can be raised out of management’s earshot if necessary.

5. The CECO must make in-person reports, preferably to the audit committee of the board at least quarterly and be present at all of the other audit committee meetings.

6. The Board of Directors must approve management’s pro- posed hiring and proposed firing of the CECO.

7. The CECO must sit in on the organization’s operating, stra- tegic planning, and budget committee meetings.

These recommendations are in agreement with those of the Rand Institute for Corporate Ethics and Governance, as contained in its publication “Directors as Guardians of Compliance and Ethics within the Corporate Citadel.”22 Experience tells me that all seven of these recommendations are necessary, collectively, to solidify the CECO function. Unfortunately, none of these recommenda- tions will be acted upon universally without some mandate from the Securities and Exchange Commission or Congress.

551PATRICK J. GNAZZO

In conclusion, I have been enriched these last 20 years because of my involvement with the CECO function. I truly believe the position is necessary if publicly held companies care about their stakeholders. That point also goes for not-for-profit organizations that care about their clients and their benefactors. And finally, I would be remiss if I didn’t mention the one program that made my CECO function most effective: the ombudsman program and its administration of the hotlines and written reporting mechanisms. A true measure of an organization’s integrity is its support of open communication programs for its stakeholders. Only when man- agement truly wants to hear what their employees and other stakeholders are thinking will they have a culture that makes ethics and compliance a priority.

NOTES

1. http://www.nyse.com/about/history/timeline_chronology_index. html

2. Defense Industry Initiative on Business Ethics and Conduct, history of, http://www.dii.org

3. False Claims Act (31 U.S.C. 3729–3733). 4. Federal Acquisition Regulations, 9.406-4, Period of Debarment. 5. US against Computer Associates International, Inc., Cr no. 04-837

(ILG), Deferred Prosecution Agreement, pages 10 and 11. 6. US Federal Sentencing Guidelines, Chapter Eight, Sentencing of

Organizations, Introductory commentary. 7. The Fair Labor Standards Act of 1938, Federal Equal Opportunity

Commission, Sarbanes-Oxley Act of 2002 (Pub. L. 107–204, 116 Stat. 745), Generally Accepted Accounting Principles (GAAP) developed by the Financial Accounting Standards Board (FASB).

8. Caremark International Inc., Derivative Litigation, 698 A.2d 959 (Delaware Chancery Court 1996).

9. National Business Ethics Survey, How Employees View Ethics in Their Organizations, 2003, 2005, 2007, and 2009. Ethics Resource Center.

10. Forbes, December 16, 2009, “Expect Heavy CEO Turnover Very Soon.”

11. National Business Ethics Survey, 2003, 2005, 2007, and 2009.

552 BUSINESS AND SOCIETY REVIEW

12. Industry Week, 8.4.2000, “A Matter of Ethics.” 13. “Leading Corporate Integrity: Defining the Role of the Chief Ethics

& Compliance Officer (CECO),” 2007 Ethics Resource Center Publication. 14. Sarbanes-Oxley Act of 2002, Dodd-Frank Wall Street Reform, and

Consumer Protection Act of 2010. 15. Association of Corporate Council (ACC) http://www.acc.com/

advocacy/upload/Overview-USSC-Guidelines-Ch-8-Revs-2010.pdf, http://www.acc.com/advocacy/upload/ACC-Submission-to-USSC-Ch-8- 31710.pdf

16. Black’s Law Dictionary, 9th Edition. Webster’s Third International Dictionary, 1961.

17. “Leading Corporate Integrity: Defining the Role of the Chief Ethics & Compliance Officer (CECO),” 2007 Ethics Resource Center Publication.

18. Ben Heinemann article, http://blogs.law.harvard.edu/corpgov/ 2010/12/26/don%e2%80%99t-divorce-the-gc-and-compliance-officer/

19. Letter from Chuck Grassley to Trevor Fetter, Tenet Healthcare Corp. (Sept. 8, 2003), http://grassley.senate.gov/releases/2003/p03r09- 08.htm

20. New York Stock Exchange, listed Company Manual: 303A.10 Code of Business Conduct and Ethics.

21. 350. Qualitative Listing Requirements for Issuers Listed on the Exchange Except for Limited Partnerships (n) Code of Conduct.

22. “Directors as Guardians of Compliance and Ethics within the Corporate Citadel,” What the Policy Community Should Know, 2010, Michael Greenberg, RAND Center for Corporate Ethics and Governance.

553PATRICK J. GNAZZO

not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written

permission. However, users may print, download, or email articles for individual use.