Author: Compliance Culture

Categories
Last week round-up

Last week on Compliance Culture

Check out last week’s posts on Compliance Culture, in case you missed or want to revisit them.

Many thanks for reading!

Categories
Compliance in popular culture

Selected Frontline documentaries on financial crisis and compliance

Frontline is a documentary series that has been broadcast by PBS since 1983. The series covers a broad range of social, political, and historical topics. Among these documentary programs have been several episodes that have covered financial crises or compliance issues in the markets or at organizations. These topics range from the 2008 global financial crisis to an overview of corruption and unethical behaviour on Wall Street to fraudulent and misleading practices within specific companies that contributed to market instability and economic collapse.

  • To Catch A Trader and insider trading – This 2014 episode covers the history of SAC Capital Advisors, a group of hedge funds founded in 1992 by Steven A. Cohen which was very successful for many years but declined after numerous investigations by the US Securities and Exchange Commission for insider trading. Several former traders were indicted by the US Department of Justice and the firm itself pled guilty to insider trading charges, subsequently shrinking away after returning external investors’ money to them and divesting the rest of its capital. SAC Capital Advisors no longer exists as of 2016, but the divestment process is ongoing and continues to raise questions about conflicts of interest and ethical practices at the firm. As for Cohen himself, he runs what was once SAC Capital Advisors as a family office and remains active in the financial industry despite his failure to supervise at SAC.

 

  • Dot Con and financial markets fraud during the dotcom bubble – From 2002, this episode looks at the “dotcom bubble” of the late 1990s, when the financial markets were crazy for new internet companies and their IPOs were aggressively marketed to the investing public. At the time this was a totally new frontier and the growth of the bubble was fuelled by aggressive allocation practices in the IPO process. Did the eagerness to exploit this new market tip over into fraudulent or misleading handling of the IPOs? In the rush to take companies public, risks were certainly ignored or unknowingly assumed by investors. Transparency in the marketplace was really lacking, and no one wanted to miss on profits to slow down and question whether what was going on was appropriate or advisable. This is a formula which is bound to repeat over and over again in future financial market advances and collapses.

 

  • Inside the Meltdown and the causes of the 2008 global financial crisis – This 2009 documentary starts with the seeds of fear that were sown in late 2007 about the effect that the bursting housing bubble would have on Wall Street investment firms. Saddled with bad debt and hounded by rumors of instability, in 2008 financial organizations began to decline and collapse precipitously. First Bear Sterns, and then Fannie Mae and Freddie Mac, failed and needed rescue. Then finally in September 2008 came Lehman Brothers – and from the Treasury Secretary Henry Paulson, who was subject to immense political pressure and criticism from the handling of prior crises, there came no bailout. In the aftermath of this, the financial crisis unfolded and ensued. Questions still remain about how this happened so quickly and severely, who caused or could have avoided it, and whether the plans to fix it and avoid it happening again have been effective.

 

  • Money, Power and Wall Street and the effects of the 2008 global financial crisis – In a sense picking up where the previous documentary left off, this 2013 episode looks at the often problematic efforts to recover from the financial crisis. In the many efforts to repair the global economy and strengthen the system to withstand future crises that are similar or more several, the financial markets and the governments that regulate and supervise them have struggled against themselves and each other. With investors and taxpayers all over the world on the hook for the risk and the bill, bold decisions as well as failures to act have characterized the rescue and rebuilding process, and continue to raise doubts about the resilience for the future.

 

  • The Warning and failure to regulate the derivatives market – This 2009 documentary looks at the financial crisis not from the perspective of the firms that weakened the market or collapsed within it, but from one segment, the derivatives market. This market is mysterious and key regulators took a hands-off position in investigating or managing it. The fears were that regulating the market could lead to financial crisis; it’s possible that not regulating it was one of the key causes of the downturn, in the end. These complex dynamics which prevented changes in the risky derivatives market still exist in governments and the markets today. Failing to change or move on from these to close the regulatory gap suggests that future crises are inevitable.

 

These are only just some Frontline episodes from over the years of the program that have touched on historically important events and issues relating to financial crisis and corporate compliance. These compelling documentaries provide a rich and informative, yet accessible, view into the complex and wide range of these topics.

Categories
Trends in business compliance

Round-up on the ethics of the Internet of Things

The Internet of Things refers to physical devices which are inter-networked and can share and store data between themselves. This includes things such as televisions, cars, buildings, and other objects that have network-connected technology inside that allow these objects to be accessed and controlled remotely via computer-based networks. This also includes systems that operate in this way, such as smart homes, grids, and cities. These things can be identified and operated individually but also are part of the interconnected system and can have co-dependencies.

There are obvious ethical issues with a highly connected and complex system such as the Internet of Things, where tremendous amounts of data are stored and shared and ultimately used in often mysterious or unclear ways – certainly to improve the intelligence of the Internet of Things and make it operate more efficiently, but also potentially for malicious or dishonest purposes.   Security vulnerabilities in a system which is remotely accessible are also an alarming risk, as unauthorized intrusions or destructive attacks could render everyday items such as cars or door locks inoperable or turn items such as smart houses or transportation networks against their users.

  • The technology that drives the Internet of Things has grown explosively, and legal and compliance frameworks have not been able to keep pace. Questions of liability that arise from cyberattacks on the Internet of Things and rules of responsibility governing companies working within this space are largely undefined. The Internet of Things may bring change to society similar to that of the Industrial Revolution. A thoughtful view on regulations and ethical guidance to protect privacy and security from the earliest design point in the industry is crucial: The Internet of Things Needs a Code of Ethics
  • Among all the fears of artificial intelligence and sentient, unfriendly robots with autonomous weapons, the real risk of the Internet of Things will still lie in the hands of humans. Hackers are a big threat to the system’s security and this risk must be taken seriously, with organizations investing in controls to prevent and mitigate attacks, intrusions, and disruptions that could damage devices, harm people, and interrupt business operations: Why Hackers Will Become a Significant Threat to the Internet of Things
  • The data produced in the Internet of Things is a major security and privacy consideration. Users of these interconnected devices may not realize how much information the devices have about them and their activities. The Roomba, a small robot home vacuum, was an early-comer to this market. The company that makes it, iRobot, has said it hopes to make money from selling maps of users’ living rooms to other companies. Using customer data for profit from a third-party is nothing new in the internet company world, but there are many questions of privacy, notice, and consent which remain to be answered: The Internet of Things is a data farm, Roomba won’t be its only profiteer
  • Cybersecurity fears about the Internet of Things extend to the U.S. government as well, where legislators have proposed to make sure that smart devices can receive security updates like traditional computers. Lawmakers also seek to prevent manufacturers from hard-coding passwords into their system tools that can be manipulated by hackers to take control of the related devices. The U.S. government is just as interested in the objects of the Internet of Things as consumers are, and safeguarding against present and future risks from them is top of mind: Two U.S. lawmakers think the government has a new cybersecurity problem: The Internet of Things
  • So what does all this mean for the future of the Internet of Things? Will the risks of it slow its growth or it will it continue to advance in both complexity and connectivity, its risks unchecked or outpacing the frameworks created to control against them? It appears likely that the value and appeal of connection, and the fear of not being able to function and communicate, will outweigh the desire to want to withdraw from it for safety and privacy purposes: The Internet of Things Connectivity Binge: What Are the Implications?

The intelligence and complexity of the Internet of Things will continue to grow as consumer applications become more in demand and commonplace. The need for strong security standards and clear customer protections will expand in kind. Privacy, safety, and control are all ethical concerns which compliance programs at the companies working on the Internet of Things will have to consider prominently in future risk assessments and strategic plans.

Categories
Compliance and ethics business case studies

Silicon Valley and undoing the normalization of sexism as corporate culture

Much of the attention on Silicon Valley in recent months has been not for new technological innovations or advances in the markets. Unfortunately, the public discussion surrounding the high-tech and start-up world, and the individuals and companies that finance that industry, has been focused on worst practices for corporate cultures. As society at large grapples with gender equity, racial and ethnic representation, generational workstyles, politics in the workplace, and many other diversity challenges, the most frequent conclusion seems to be that the state of things in 2017 is not as progressive or integrated as may have been assumed.

Many high-profile Silicon Valley organizations have coped with this revelation of corporate intolerance very publicly. Among them is Kleiner Perkins Caulfield & Byers, a high-profile venture capital firm. Managing partner John Doerr was an investor in some of the highest profile first generation technology companies to come to market: Intuit, Netscape, Amazon, Google. When he hired Ellen Pao in 2005 as his chief of staff, it seemed like he was assertively signalling that Kleiner Perkins wanted to take the lead on elevating qualified women to visible leadership roles in Silicon Valley, where men have overrepresented women in management, and within the even more traditionally male-focused venture capital domain.

Pao’s experiences throughout her tenure at Kleiner Perkins, capped off with her 2015 gender discrimination lawsuit and her firing before that lawsuit came to trial, indicate a different environment. Rather than being valued for her contributions and promoted on her merits, Pao alleges that she was harassed after a workplace romance went bad and that she was often marginalized in her role, expected to take on essentially personal assistant type duties while investing or higher level tasks went to male colleagues. Instead of contributing to a gender-integrated workplace where individuals were elevated for their accomplishments, insights, and commitment to their jobs, Pao paints the picture of a dysfunctional and increasingly hostile environment.

Kleiner Perkins did not have policies or training against sexual harassment at the time Pao worked there. A control framework to identify, prevent, and address these corporate culture issues is imperative. Any company that does not set a tone on these matters and take the time to thoughtfully and proactively set expectations for an integrated, balanced organizational culture demonstrates no credible commitment to workplace equality and the merits of the diversity of viewpoints this brings with it.

Many cultural changes have been underway for so long that they are taken for granted or even pushed against by now as creating an undue burden in the other direction. The truth, however, is that these movements toward a more balanced, integrated workplace are still stymied by a lack of genuine commitment. Ideally the office would looks much more the best version of the world, where people are elevated for their merits and not their demographic traits, and are not kept from even getting on the road to success because of someone else’s decisions about their right to work because of a trait like gender. In order for this to really develop, though, leaders in business (both established ones like Kleiner Perkins and start-ups who are defining their corporate values for the first time) need to take ethical stock of where they stand and if they can commit to creating a culture where all people are accepted and utilized for their merits, then they need to do so visibly and meaningfully. The time of tokenism or promises without true intention needs to be past so that people of all kinds can get into legitimate leadership positions and then pay it forward to the next generation behind them.

Pao did not prevail in her lawsuit, but perhaps it will endure anyway as a test case. While it did not result in a guilty verdict, cases like this one can be a cultural watershed for policy and enforcement standards in companies to mitigate legal risk. Perhaps also other women working in, or fired from, Silicon Valley under similar circumstances can see where Pao succeeded and failed in her legal strategy and take up the cause on their own behalves. Bringing these issues into the public light can certainly drive change in creating a cultural imperative for women in tech to speak up and out.

For more insight on Pao’s experiences in Silicon Valley and happened with her lawsuit against her former employer, see this excerpt from her book on The Cut, originally from New York Magazine.

Categories
Compliance in current and historical events

Cybersecurity and the hacking of Hollywood

Cybersecurity appears near the top of any compliance officer’s risk assessment. Addressing the ever-evolving concerns around it is a priority on the strategic annual plan for any compliance program. Modern society’s reliance on technology and the internet is always increasing. Along with the many benefits of technology’s interconnectedness and conveniences comes risks to data privacy, information theft, unauthorized intrusions, and security breaches.

While all businesses are vulnerable to these threats, recently the spotlight has been on Hollywood and some high-profile hacking campaigns that have seriously impacted the entertainment industry. Damaging emails have been published, produced shows and scripts have been ransomed, and private photos have been leaked due to storage and server facilities being breached.

  • In November 2014, Sony Pictures was hacked by a group calling itself Guardians of Peace. The cyberattack used malware to steal and then overwrite and delete the data on half of Sony’s computer network worldwide. Not only did Sony have to deal with a major technology infrastructure crisis, but shortly after, the leaks began. The stolen data from the company that was subsequently published ranged from embarrassing personal emails of executives and celebrities to unreleased movies to sensitive employee information. The hack was eventually blamed on North Korea and their effort to suppress the film The Interview, a claim which is still disputed by some today. The fallout from the cyberattack and the insufficiency of the company’s preparations against it offer many difficult lessons in cybersecurity and corporate defences within it: Inside the Hack 
  • Netflix was compromised by a hacker going by the name thedarkoverlord, who posted ten episodes of the network’s hit show Orange is the New Black to a torrent site on the internet. The leak occurred after a ransom request was not met, first by a production vendor affiliated with Netflix and then by Netflix itself, demonstrating that cybersecurity at third-party vendors can also be a business risk: A Group Of Hackers Is Holding Hollywood Captive — & Here’s What It Wants
  • In another ransom case, Disney suffered a hack involving the latest movie in the Pirates of the Caribbean franchise, compromised while on the servers of a post-production facility. Work is often sent out to vendors in the industry who will do it for the lowest cost, but may not promise the most robust network security to prevent intruders from accessing the content and ransoming it to the owners. This phenomenon is becoming increasingly common and expensive: Cyberattacks once again roil Hollywood, but can anything be done about it?
  • HBO sustained a major cyberattack, possibly from various sources, on their servers which demonstrate how vulnerable major organizations can be to leaks, hacks, and social media hijackings. This event shows that HBO, and other organizations like it, face cybersecurity threats from a variety of sources: suppliers, insiders, intruders, and more. Ransom demands were involved here too, but other threats seemed designed just to test security protocols or to intimidate and embarrass: Breaking Down HBO’s Brutal Month of Hacks
  • Other than content owners such as networks and studios, Hollywood talent agencies, such as UTA, ICM, and WME, have all also been the target of cyberattacks. In the case of UTA, the intrusion occurred through the phone system and spread from there to the computer network, with a ransom demand following. Many of these hackers openly acknowledge they are motivated just by financial gains from ransom payments, so some companies are being advised to pay up and avoid damaging or embarrassing information and valuable content being leaked online: FBI Gives Hollywood Hacking Victims Surprising Advice: “Pay the Ransom”

The increasing frequency and visibility with which the technological systems of Hollywood companies are being targeted for cyberattacks indicates that this will remain a top risk for some time to come. The threats to the reputations of individuals and organizations involved, as well the economic and reputational risks, require that lessons learned from the situations above be implemented into practical and technological improvements to cybersecurity programs.

Categories
Best Practices

Compliance practices for encouraging whistleblowers

Whistleblowers are people who speak up to expose information or activities indicating wrongdoing by individuals, departments, or organizations. They may reveal this information internally, such as to a supervisor or to a designated business unit or hotline. They may also reveal it externally, such as to regulators, supervisors, or the media. Corporate cultures should enable employees to have the courage and compulsion to act as whistleblowers in situations where it may be necessitated.

  • Set clear expectations for conduct: The most ethical corporate culture is one that has clear values and norms which can be expressed and reinforced at all levels. A culture in which expectations about employee and organizational integrity are expressed openly and referred to in justifying business decisions is a culture where employees will also be comfortable challenging behavior and choices which appears to fall outside of those expectations. An organization’s culture should be openly intolerant to unethical behavior and explicit about the right processes and practices. This way, deviations can be easy to see for participants and ethical blindness or responsibility shifting can be replaced with compliance awareness and individual accountability. People will have the confidence to speak up about wrongdoing if they are certain that they know and believe in what the right action should be.
  • Model speaking out from the top: The tone at the top is an important driver of whistleblowing. Employees should see that leadership also speaks up boldly against wrongdoing and admits to shortcomings or omissions. Senior management and/or supervisory board members should be visibly engaged in seeking to prevent, identify, and correct inappropriate conduct and practices. If employees see that those at the top of the organization are reinforcing the cultural principle of exposing problems, then they will respect the necessity of this role and be empowered to take it seriously.
  • Facilitate ease of access to reporting: A major reason why employees do not take action is because they do not know how. All employees should be provided with information about whistleblowing procedures and given the opportunity to ask questions and check understanding, including discussing dilemmas, about when whistleblowing would be appropriate or applicable. It is also imperative that the mechanism for the whistleblowing, once the employee endeavors to do so, is accessible and publicized. If there is a hotline, a dedicated mailbox, or a specific person to reach out to, then employees should be able to find and follow the procedure without being discouraged by undue difficulty of the process.
  • Provide active feedback: People will not act as whistleblowers if they believe nothing will come of their reporting. Organizations must actively recognize people who come forward and keep them as informed as possible of steps that are being taken. Employees must know that if they step up to report an issue, they will be listened to meaningfully and that the appropriate people will take action. Constructively listening to the person who is whistleblowing is the first necessary step. Then, the employee should be kept informed of what will follow and, once any investigations are complete, the outcome. This way the employee knows that taking on the responsibility and risk of stepping forward will be attended to with the appropriate seriousness.
  • Control against retaliation: Most importantly, whistleblowers should be protected and shielded from recrimination. While false claims or dubious motivations need to be discouraged, genuine whistleblowers who wish to reveal and stop harmful business practices should not be punished. In order to enable people to come forward as whistleblowers, organizations must adequately reassure employees that they will not face termination, demotion, harassment, or other mistreatment in response. Corporate cultures must forbid professional retaliation in any form in order to create an environment where an employee with evidence of unethical or fraudulent business practices could step out as a whistleblower.

The role of the whistleblower is extremely important in raising the legal, ethical, and compliance standards of organizations. Having a corporate culture in which this reaction to wrongdoing is promoted is, in and of itself, crucial for developing a controls framework which prevents and addresses misconduct effectively.

Categories
This week preview

This week on Compliance Culture

Be sure to visit Compliance Culture this week for posts on these topics.

  • Monday: Best practices for encouraging whistleblowers
  • Tuesday: Cyber attacks and the Hollywood entertainment industry
  • Wednesday: Sexism and Silicon Valley corporate culture
  • Thursday: The ethics of the Internet of Things
  • Friday: Frontline documentaries on financial crisis and compliance

Don’t miss it!

Categories
Last week round-up

Last week on Compliance Culture

Check out last week’s posts on Compliance Culture, in case you missed or want to revisit them.

Many thanks for reading!

Categories
Compliance in popular culture

Selected lectures on dishonesty and mistrust

In a follow-up to last Friday’s collection of videos on honesty and trust, now the polar opposite, dishonesty and mistrust. It is equally important to understand the motivations behind unethical behaviour as it is to have a view of the reasons for good behaviour. Unsurprisingly, most often these impulses are intimately related. Dishonesty, for example, is encouraged when individuals do not see trustworthiness as an important measure of success or character. On the other side, giving trust is very difficult when credibility has not been established.

  • How to spot a liar (Pamela Meyer) – Lying is not always motivated from a desire to be actively dishonest. It can be automatic, implusive, or even motivated by altruism, insecurity, or curiosity. However, it is always deceptive. Understanding the “tells” that people give when they are being dishonest is important in remaining alert and checking for credibility before giving trust.
  • How to Spot Liars at Work and How to Deal with Them (Carol Kinsey Goman) – Also in the domain of reading people’s non-verbal cues to detect their dishonesty, there are signs specific to the workplace that someone is not trustworthy and dynamics of co-working or being in a team setting that may make people more likely to lie. Identifying when colleagues are lying and understanding why can be a management technique if this is applied to trying to create a tailored environment that will protect and reward honesty. Successful leaders will communicate clearly that they expect their employees to be truthful and will measure honesty and ethical decision-making as part of their performance.
  • The truth about dishonesty (Dan Ariely) – Self-betrayal and the rationalization it provides are major motivators of dishonest behaviour. Intrinsically, people lie and break promises to themselves in every dishonest act they do, because they are overriding their own ideas about right and wrong to give themselves permission to proceed. In this way individuals persuade themselves to ignore their conflicts of interest or flaunt what is socially acceptable because they have deceived themselves into thinking their behaviour is necessary or justified.
  • Why we think it’s OK to cheat and steal (sometimes) (Dan Ariely) – Behavioural economics goes further even than the above, to suggest that people do not always have to actively be dishonest to themselves to be deceptive to others. Possibly, people actually think lying or behaving immorally is acceptable because cultural norms often tolerate and dismiss “minor” dishonesty. Situational context, intuition, or heuristics can be very powerful and override the individual’s obligation to question or consider right from wrong. All opinions about moral behaviour should be thoroughly challenged in order to avoid relying upon false assumptions.
  • The future of lying (Jeff Hancock) – In scenarios such as taking an exam with the opportunity to cheat or filling out a form with the possibility of misstating information, moral reminders of individuals’ legal or social obligations to tell the truth have proven effective in curbing dishonest choices. Could technology and the internet, influences in our society which seemingly have made the truth ever more remote, actually discourage lying by making people’s statements and representations permanent and searchable? Perhaps the accountability of the internet to record everyone’s personal records can encourage them to avoid discrepancies by resisting dishonesty.

Causes of, and rationalizations for, dishonesty and lack of trust are everywhere in both business and life. Because of how common these forces are, it is important to recognize and understand them, so that individuals and organizations may contribute positively to working against their influence.

Categories
Trends in business compliance

Round-up on compliance issues in food technology

Food technology, concerning the production processes that manufacture, transport, and distribute foods, continues to expand as disruptive technologies in general advance. As any practice that impacts food has obvious heavy impact on consumer safety, food technology practices are coming under increased scrutiny. While public attention was once mostly limited to risk-benefit analysis of various foods and the resulting consumer preferences and perceptions, innovative technologies are driving further questions and desires for customer protections and process disclosures.

  • In response to perennial consumer demand for more flavorful and interesting plant-based products to present vegetarian and vegan friendly burgers, Impossible Foods created their Impossible Burger, with soy leghemoglobin giving it an uncanny resemblance to meat and a regulatory problem with the U.S. Food & Drug Administration; can high-profile investors and customer interest overcome food safety concerns and the burdens of government supervisory challenges:  Impossible Burger’s ‘Secret Sauce’ Highlights Challenges of Food Tech
  • Walmart and a consortium of major food companies including Unilever and Kroger are experimenting with blockchain technology to simplify and automate their supply chains, in hopes of making a very complex set of production processes much more agile and enabling quicker investigations into outbreaks of food-borne illnesses, with improved documentation:  Walmart and 9 Food Giants Team Up on IBM Blockchain Plans
  • Another fascinating, developing use of blockchain in order to make the supply chain safer by combating food counterfeiting and tampering, illegal shipping, and industry malpractice by tracking products through the process and requiring non-anonymous, reliable documentation, all informed by industry “spying” that has uncovered the causes of abuses across food business sectors and country cultures:  Inside the Secret World of Global Food Spies
  • Personalized nutrition plans combine the trend for home genetic testing with consumer desires for at-home meal delivery or menu selection services, but how does freedom of choice and a culture of individual preference with emphasis on customization fit in with the goals of libertarian paternalism that can be espoused by suggesting biometrically-determined food choices:  I sent in my DNA to get a personalized diet plan. What I discovered disturbs me. 
  • Amazon continues to search for growth opportunities in the food business after announcing plans to acquire Whole Foods earlier this summer, this time turning to U.S. military technology to aim to deliver meals that do not need to be refrigerated, but will consumers be enthusiastic or will this solution only create new potential problems in trademarking of kits and safe fulfillment of orders:  Amazon looks to new food technology for home delivery

Blockchain will likely continue to pose the most challenging and exciting advances in the food technology industry. Making the supply chain for food more transparent and accountable, and also simpler to navigate, is a lofty goal which would serve the public interest. Integrity and consumer choice in the food business, with or without the impact of regulatory supervision, should drive innovation going forward.