This is the third in a series of five posts suggesting best practices for implementing corporate cultural change.  For an overview of all the tips on this subject, check out this preview post.  The first post in the series discussed tone and conduct at the top.  Last week’s post was about the importance of consistent, visible enforcement.  Today’s post will discuss strategies for creating and implementing effective policies.  The fourth post in the series, on March 19, will focus on putting in place procedures that are complementary to those policies.  Finally, on March 27, the fifth and final post will discuss tips for going beyond training in order to create effective and engaging employee education initiatives to boost awareness and compliance culture.

As discussed in the last two posts in this series, concrete changes to organizational culture cannot be accomplished through mere rhetoric, even when it is underlaid by sincere desire for progress.  Compliance program best practices must be observed and supported by senior management and top leadership in order for effective controls and cultural values to take root throughout the organization.

Creating and implementing concrete, values-based policies is critically important for organizations to demonstrate operational commitment to improvement.  In order to take material advantage of momentum for reform in the examples set at the top in both attitude and behavior, as well as to nurture the culture of compliance created to support organizational justice and fairness, the policies in place must formalize this all.

The below points are some suggestions for corporate compliance programs to consider for ideal characteristics of policies to put in place to encourage integrity, ethical decision-making, and organizational systems to prevent misconduct, protect employees, and punish violators:

• Clarity – Policies need to state clear rules and principles that can be not just read and accepted, but also understood and embraced.  The language used should be simple, straight-forward, and coherent – detailed enough to be meaningful, but concise enough to be useful for all audiences.
• Values-driven – One of the main drivers behind any policy should not be to merely fulfill a requirement or tick a box, but rather to evoke the organization’s values.  In this, policies put in place can honor the corporate culture of compliance in order to protect vulnerable individuals, deter decisions that lead to inadvertent or intentional wrongdoing, and punish both violators and the systems that enabled their misconduct.
• Risk-based –  Coupled with the values that matter most to the organization’s culture, policies should also reflect the real risks that are present in the business and the world at large.  In order for any policy to be effective, it must address the real problems and adopt an approach to taking them on that is sensitive to both the corporate culture and the actual risks which need to be eliminated, mitigated, or accepted.
• Self-critical – In order for the policies’ principles to be properly attuned to the values and risks of the organization, leadership must take a self-critical approach and follow-through on the insights gained from it.  Organizations have to be honest with themselves in assessing their own limitations, deficiencies, and challenges.  Much like tone at the top, this cannot be a cursory or rote effort, but rather must embrace a true picture of the shortcomings and inadequacies in the controls.  This way, policies can be crafted that are effective in light of real problems and insufficiencies.
• Practical –  Any requirements that are put in place through policies should be linked to concrete, defined expectations to underscore practicality of the requirements.  To be effective, policies must consider and relate back to root causes for their creation.  Most importantly, any practical policy will emphasize clear communication of the desired cultural practices for employees to follow.

Check back next week, Monday March 19, for the fourth post in this series of five, which will continue the theme of this post by discussing procedures that will be consistent with and supportive of the policies discussed here.