Tag: culture of compliance

Categories
Compliance and ethics business case studies

Deep dive on what happened at Enron

Almost 16 years after Enron declared bankruptcy in December 2001, questions about the root causes of the financial fraud and ensuing publicity of the corrupt business practices there persist. Despite the subsequent years where other major bankruptcies and the global financial crisis may have somewhat desensitized the public to these scandals from the greater business world, the many answers to the “why” of Enron’s fraudulent business practices are still fascinating to contemplate.

  • Enron: The Smartest Guys in the Room: This 2005 documentary, based on the 2003 book of the same name written by Fortune magazine reporters Bethany McLean and Peter Elkind, and directed by noted filmmaker Alex Gibney, is the seminal work on the Enron scandal. The film goes back deep into Enron’s history to unpack why its success of the 1980s and 1990s and its desire for sustained growth and competitive edge in new business areas, drove its fraudulent practices ever deeper into the corporate culture. Great attention is paid to those “smartest guys” – Kenneth Lay, Jeffrey Skilling, Andrew Fastow – and their sometimes philosophical, occasionally political, and always profit-motivated, views of management that contributed to the fraud.

 

  • The Crooked E: The Unshredded Truth About Enron: This television movie from 2003 is based on the book Anatomy of Greed by Brian Cruver.   Cruver was an ex-Enron employee and detailed his personal experiences there in addition to those of several anonymous colleagues, some very senior members of the organization. The movie shows how the lack of organizational integrity made an impression on Cruver, a good person who found himself doing bad things because of the unethical environment and processes in which he was working. The excesses of the corporate culture are shown in great detail and in contrast to the suffering of shareholders, including many employees who had their retirement funds entirely invested in the company, that followed the company’s collapse in 2001.

 

  • Enron Explained: An Insider’s Account: On a similar, but non-dramatized note, this 2006 C-SPAN American Perspectives program provides a deeper look at the workings of the accounting practices and corporate culture at Enron. This time it is from Robert Bradley, who was the Director of Public Policy Analysis at Enron. Bradley provides detail into the technical aspects of the accounting fraud as well as his personal perspective on Kenneth Lay. From Bradley’s point of view, Lay’s actions should be viewed in light of the narrow framework in which he had worked, achieving great success in his years at Enron by focusing on profit-driven business strategies that promoted driving for financial gains and did not emphasize strategic ethical decision-making. While certainly not an excuse for lack of personal accountability, or a legal defense, this is a powerful lesson for how strong organizational contexts and heuristics can impact employee integrity.

 

  • Bigger than Enron: The PBS documentary series Frontline took on the Enron story in 2002. This program suggests presciently that the bankruptcy of Enron, which immediately became one of the largest scandals in the history of American business, could actually have the harbinger of the deeper systemic weaknesses. From the current standpoint, of course, this points directly to the subsequent economic and regulatory crisis in the global financial markets that began to unfold in public in 2007-2008. From this perspective, the root causes of that crisis go much deeper than the fiscally unsustainable growth of the sub-prime mortgage market and subsequent securitizations. Instead, epic failures in the oversight system – from management, from government, and from outside business partners such as auditors – exposed investors to huge losses and enabled corporate fraud such as occurred at Enron and other major companies before and, indeed, after its 2001 collapse.

 

  • Sherron Watkins at UNC Kenan-Flagler Business School: Sherron Watkins was Vice President of Corporate Development at Enron and is known to history as the author of the August 2001 memo to CEO Kenneth Lay detailing the questionable accounting practices she noticed in the company’s financial reports. Five months later her memo was made public, and she is therefore thought of as the Enron whistleblower. Watkins was criticized in the aftermath of Enron’s bankruptcy for not going public sooner and not immediately escalating her suspicions of the fraud to Enron’s regulators or law enforcement. The speeches Watkins has given in the years since Enron’s bankruptcy, such as this one, focus on how complicated acting as a whistleblower is in reality – not what you would do better than someone else in a hypothetical situation, but what you would or could actually do if it happened to you. This is a challenging ethical dilemma and one that organizations must consider in order to create a reporting system in which whistleblowers are encouraged and protected.

 

The Enron business case remains one of the most famous examples of modern corporate fraud and corruption. Studying the root causes behind the fraudulent accounting and business practices provides insight for why an effective controls and reporting framework is so important for investor protection and markets integrity.

Categories
Compliance in current and historical events

The Madoff Ponzi scheme scandal

For more than 40 years, Bernie Madoff was one of the most prominent figures in the US financial services industry.   His trading firm, Madoff Securities, was founded in 1960 and due to its early adoption of then cutting-edge technology quickly became one of the major market makers in the business. The firm’s technology that it participated in creating later became the NASDAQ trading exchange. Apart from its brokerage business, Madoff Securities also offered investment management and advisory services to many prominent clients. These included banks such as Banco Santander, HSBC, RBS, and BNP Paribas; hedge funds; university endowments; charitable organizations; and famous individuals such as Steven Spielberg, Zsa Zsa Gabor, Sandy Koufax, and Elie Wiesel.

Madoff himself was very well-known in the securities industry. He was on the board of directors of the Securities Industry Association (SIA), the predecessor to the Securities Industry and Financial Markets Association (SIFMA), and served as chairman of SIA’s trading committee. He was also active in the National Association of Securities Dealers (NASD), the self-regulatory organization (SRO) for brokerage firms and exchange markets that predated the Financial Industry Regulatory Authority (FINRA), and served on the board of directors of the SRO, for a period even as its chairman

This last professional designation for Madoff seems ironic now. In reality, Madoff’s investment management business was revealed in December 2008 as a $65 billion Ponzi scheme, the largest financial fraud in US history. This massive fraud was carried out by Madoff and a close group of associates right alongside his legitimate brokerage business and taking full advantage of his huge network of investors and prominent reputation in the industry. In the scheme, trades and returns were completely fabricated and investor redemptions were funded by new infusions from individuals that Madoff aggressively pursued, touting his performance.

Despite numerous SEC investigations of various areas of Madoff’s business, and several outside analysts publicizing urgent and detailed concerns about the business and its purported performance claims which could not be replicated for authentication purposes, this scheme continued unmitigated for at least 15 years, per Madoff’s admission. It may have gone on for as long as 30 years, back to the very beginning of the investment advisory arm of Madoff Securities.

Madoff struggled to keep the fraud going as the global financial crisis caused the markets to contract throughout the fall of 2008, and investors sought redemption. Still, he managed to stay afloat until December 2008, when his sons, Mark and Andrew, confronted him about bonuses he wished to pay amid the mounting investor redemptions. Madoff confessed to his sons that the investment management business was a fraud, and his sons then reported him to law enforcement. In the subsequent months the shocking scale of his fraud and the losses it caused became the subject of public fascination.

For interesting insights on the fraud and scandal surrounding Bernie Madoff’s Ponzi scheme to defraud investors, check out these videos:

  • The Madoff Affair – An episode of the PBS documentary program Frontline from May 2009, when the complete scope of the scandal was still being discovered, which aims to tell the story of the fraud from the beginning and question how it was able to go on for so long.

 

  • The Man Who Knew – This March 2009 60 Minutes segment features Steve Kroft interviewing Harry Markopolos of Rampart Investment Management. Markopolos was a vocal critic and doubter of Madoff’s claimed investment returns. He attempted to alert the SEC on a number of occasions to the fraudulent practices he believed he had discovered in his study of the alleged performance of Madoff Securities, but he was ignored or his claims were not thoroughly investigated.

 

  • Ripped Off: Madoff and the Scamming of America – This is an April 2009 which looks at Bernie Madoff’s fraud in comparison with other Ponzi Schemes of the prior hundred years. With this study, the investigation assesses the magnitude of the damage Madoff’s scheme caused and places it in context of the global financial crisis which was beginning to deepen at the end of 2008.

 

  • The Hunt for Madoff’s Money– This February 2009 segment from the ABC news program 20/20 asks where the money that Madoff defrauded from his investors went, other than fund withdrawals by others’ withdrawals. The investigation looks at the luxury lifestyle and properties of Madoff and his family members and associates that were enriched by his fraudulent investment management scheme.

 

 

  • Madoff Victims on Guilty Plea – In this March 2009 report from CBS News, nine people who lost their investments in Madoff’s Ponzi scheme speak to Katie Couric about their reactions to the exposure of the massive fraud and his guilty plea that resulted in him being sentenced to 150 years in prison without standing trial.

Categories
Best Practices

Using ethical dilemmas for creating a compliance training dialog

For effective compliance training, learners must be prepared to discuss and challenge dilemmas independently and with others. The details of specific policies, directives, and regulations can quickly become very dry and irrelevant, whether the audience is made up of compliance officers, senior managers, or new starters. To prevent topic fatigue and keep important compliance training vivid and engaging for those attending awareness sessions, it is important to encourage discussion. An active participant will think, care, and learn more than one who is just watching the clock for the end of the program.

One way to spark discussion that can be employed at all levels is using ethical dilemmas. This is effective either as a stand-alone program, where attendees are introduced to ethical dilemmas and spend time in groups discussing their ideas and views, or as an icebreaker to a content session, to grab the audience’s attention and test their knowledge from the beginning. This can provide an approach to then thinking about the practical handling of compliance subject which is both easy and enjoyable.

Considering and responding to ethical dilemmas helps learners to build fluency with ethical decision-making and evaluating potential conflicts of interest, especially in balance with their own possible interests. Giving meaning to the impact of behavior and choice is significant for establishing cultural values that emphasize individual responsibility and integrity. Dilemma analysis involves several simple but thought-provoking steps following the prompt:

  • What is the ethical question?
  • What personal values are relevant in considering this ethical question?
  • Who are the parties with interests in this dilemma?
  • What are their interests and how do they conflict?
  • How can the ethical question be answered and what are the potential consequences?
  • What is the decision in response to the ethical question?
  • Is the choice that came from the decision-making process of the dilemma possible/practical to do in light of all considerations and consequences?

Ethical dilemmas used as such for prompts in compliance training should be universal and straightforward. In general, dilemmas used to teach this style of thinking to beginners or to instigate audience participation in at the start of a session should not focus on specific employee responsibilities or business functions. For very advanced and targeted audiences it may be acceptable to give a anonymized example of a dilemma they may come across in their work, but for the most part, daily life dilemmas are more relatable and more fun to discuss, regardless of the experience level of the participants.

Some examples of simple dilemmas that can be analyzed as described are:

  • You are meeting some friends at a standing room-only concert and arrive late. As you approach the venue you walk past your friends, who are got there early and are waiting near the front of the line. They tell you they have been there for almost two hours and invite you to join them where they are in the line, even though the end of the line is very far behind them.
  • Your company has been considering some wellness initiatives to offer to employees as benefits but hasn’t contacted any providers yet. Your roommate just finished yoga teacher training and wants to get experience as a corporate instructor.
  • You are taking an exam after studying hard for days to prepare and attending every class the entire term. However, you woke up this morning with a terrible cold and can’t focus. You know the professor will not allow a rescheduled or make-up test. There is no proctor in the room and you have all of your course material with you.
  • You and your partner have a joint bank account where you are both named. Your partner is one week into a two week trip abroad when a letter comes from the bank. You have to fill out and return a form with both your and your partner’s signatures. If you don’t return the form within two business days you will not be able to use your credit card.
  • You are taking your relative to an urgent doctor’s appointment. The parking lot is quite busy but all three of the parking spots designated for disabled drivers are empty. Your relative has no problem walking, but you are already five minutes late for the appointment.

Choosing simple prompts like the ones suggested above will allow the learners to be more creative and perhaps to even engage in discussion with themselves. The facts may be straightforward, but the huge array of perspectives and outcomes that people can suggest is always impressive. By keeping the dilemma prompt at a level everyone can understand regardless of his or her own background and initial interest, the dialog can be truly inclusive. This allows the person who is running the training session to fall into the role of a true facilitator, which offers the enriching experience of watching individuals converse organically on these provocative questions.

Categories
This week preview

This week on Compliance Culture

Be sure to visit Compliance Culture this week for posts on these topics.

  • Monday: Using ethical dilemmas in compliance training
  • Tuesday: Bernie Madoff and financial fraud
  • Wednesday: Root causes at Enron
  • Thursday: Trends in counterfeiting of consumer goods
  • Friday: Diverse viewpoints on ethical dilemmas

Don’t miss it!

Categories
Last week round-up

Last week on Compliance Culture

Check out last week’s posts on Compliance Culture, in case you missed or want to revisit them.

Many thanks for reading!

Categories
Compliance in popular culture

Corporate compliance and “the arc of the moral universe”

It is one of the most frequently-used and beloved quotes for champions of progressive values: “The arc of the moral universe is long, but it bends toward justice.” This famous line from Dr. Martin Luther King espouses a certain determinism, from nature or faith, that morality favors fairness and the truth in the end, even if it takes a long time and a lot of effort to get there.

Perhaps further motivation behind these words can be sussed out by understanding the original lines by which Dr. King’s statement was inspired. The older quote comes from Theodore Parker, a 19th century minister and abolitionist. He stated, in full: “I do not pretend to understand the moral universe; the arc is a long one, my eye reaches but little ways; I cannot calculate the curve and complete the figure by the experience of sight; I can divine it by conscience. And from what I see I am sure it bends toward justice.”

Parker was also a Transcendentalist scholar who wrote prolifically on the subject of justice and the conscience, and the sanctity of the rights of all people in the service of those virtues. In Parker’s view, then, justice can be elusive or disappointing, but it is unequivocally a moral force, and progress toward it, however slow and halting, is a high state of being for people and governments. In light of Parker’s remark, Dr. King’s words indicate that individuals alone cannot be definitively satisfied that society will become universally just, but this should not dissuade them from their commitments to their ideals or their personal responsibilities to uphold them, in both private and public.

However reachable this sentiment may seem to be (or not be) over history and in practice, this idea can still provide inspiration to those wishing to positively impact the journey toward a just society. Individuals, for example, may take this concept as a reinforcement of personal conviction, the kind which is passed down over generations in pursuit of an ideal. Organizations such as political action committees, community groups, or charitable organizations may see as a direct call to diligent and persistent public activism with the goal of societal change, often enforced by legal action.

But what about corporations? The concept of the corporation as a legal “person” is always controversial in contemporary society because it conveys rights and protections on companies that many feel should be limited to natural persons only. However, with this designation comes responsibilities and obligations also, and not just ones that may be important in a courtroom. Corporations can do their own part to positively impact progressive toward justice by adopting business values that elevate morality and encourage organizational and employee commitments to integrity and fairness.

  • Social responsibility sells: As companies compete in the ever-crowded global marketplace, price and product are far from the only deciding factors between success and failure with consumers. Companies are now putting their social responsibility interests at the forefront. This shows up in their business values that they communicate to their employees as well as their advertising, corporate branding, and strategy that they bring to the market and identify themselves with to their customers. Consumers want strong personal associations with companies when they have many choices for retailers or service providers. Embracing social responsibility and commitment to progress, inside and outside of organizations, gives corporations a competitive edge and a striking identity that helps them to stand out and be remembered.
  • Representation is key: It is well known that the workplace has much improvement to do before it starts to even appear as diverse as society is outside of the office. Representation at all employee levels, from starters to executive boards, is important in the efforts toward inclusion. In order to aspire for equality and diversity, people of all backgrounds need to first be present and practically included. Then the real effort for change can happen, where this truly representative group can start to work together toward the integrated, equitable type of collaboration and open access that is still lacking from many broader communities and discussions in the world in general.
  • …but tokenism is toxic: In order to support this ambition, however, obstacles must truly be removed, and merit and performance have to be the standards by which people are promoted and co-working is established. Representation in name only, or to fulfil an appearance, is empty and non-progressive. Companies must commit against token inclusion and truly seek to integrate and cooperate authentically. Only then can responsible corporate citizens inspire in the world the changes they see in themselves.
  • Transparency fosters a more equitable working environment: As the saying goes, sunlight is the best disinfectant. Open processes at a corporation will lean more easily toward equitable outcomes for employees and consumers. Unethical management decisions are easier to take and justify if they are concealed and never need to be explained. Having to reconcile the interests and feedback of others, however, helps toward mitigating unfairness. There will always be some amount of bold intolerance or exclusion, just as there will always be a few bad apples. However, it’s much more productive to focus on the decision-making that can be nudged toward a positive viewpoint and those people who will do good things when they are appropriately informed and supported to do so.
  • Integrity promotes sustainability: Sustainability – not the type that encourages re-using recycled coffee cups or only printing documents if it’s really necessary, but the type that focuses on longevity and sensibility of business practices and relationships – is, like social responsibility, a key competitive advantage. Integrity as a main business strategy shows that organizations value their relationships and want to make the right decisions not just for their profit, but for their partners and the future. In this sense, a strong moral code for business values represents both an investment in the aims of justice as well as a preparation for success.

For further contemplation on the concept of the moral universe and its predisposition to justice, and the nature of humans within this, amidst the challenges of the secular world and the frustrations of the individual, Theodore Parker’s “Of Justice and The Conscience” from his Ten Sermons of Religion is a powerful and interesting text.

Categories
Trends in business compliance

Round-up on higher education compliance

Many of the challenges of modern society in general are writ large in the world of higher education. The obstacles to ethical decision-making that are prevalent for individuals and organizations in business are also present in the educational environment. Campus culture often represents a microcosm of culture at large, with many complex social dynamics playing out in close quarters. Students as well as educators and administrators are confronted by complicated moral dilemmas as generational divides and differing expectations for justice, integrity, and duty of care coexist.

  • In taking the administrative decision to close a popular but controversial student dormitory, the Massachusetts Institute of Technology stepped into the thorny issue of informed consent. In order to support their choice to deaccession “Senior House” as a student housing, MIT used data from student surveys that were supposed to be anonymous (but were actually tagged with geolocation information) to collect evidence that the dormitory was the source of high drug usage, low graduation rates, and other behavior deemed unsafe or unacceptable by the Chancellor’s Office. This methodology of gathering data from students and their organizations without explicit expression of the purpose and its intended usage, and the questionable decision-making that stems from it, bring into question the ethics of universities’ relations with the students for whom they are supposedly providing a supportive and inclusive community. The closure of Senior House by MIT is seen as part of a trend of university administrations to exact more control over students’ lives, including conduct they may expect to be unrelated to their educational relationship with their school, such as things that happen off-campus, when school is out of session, or even online:  A Weird MIT Dorm Dies, and a Crisis Blooms at Colleges
  • Given the insular culture that many university academic departments are known for cultivating – focused on competition and comparison and often resulting in isolation and highly politicized decision-making – hostile working environments can quickly emerge on interpersonal levels. Unlike most at-will employees in the job market at large, however, many experienced professors have security of tenure and therefore their interactions with colleagues are not always checked by their fear of reprisal that could lead to losing their jobs. In some situations this can create workplaces that value and promote individuals for their academic prowess but turn a blind eye to claims of troubling personal behavior with colleagues or even students. Universities are often accused of failing to adequately investigate these allegations or not even providing a sufficient framework for safe and effective reporting. Hierarchical departments allow powerful, tenured professors to exploit their positions, with addressing toxic behavior taking a backseat to protecting those reporting harassment:  She Was a Rising Star at a Major University. Then a Lecherous Professor Made Her Life Hell.
  • “Call-out culture” – in which people, often in groups, point out statements or actions of others that they see as problematic or abusive and take down the person in question – has been fed by the public’s appetite for controversy and the prevalence of the internet and social media, where otherwise innocuous events between friends can be broadcast all over the world for commentary, criticism, and ridicule. While understandably some of the intent of call-out culture is to suggest and reinforce more positive, informed standards for interactions in a more inclusive society, this often goes too far. Far from just being restricted to taking down those who act with the intent to cause offense, or educating those who are unaware of the real implications of things they do and say involuntarily or too casually, this culture has fostered an environment where innocent behavior is subject to ridicule and derision. In the university setting, this fear of group criticism is very destructive to creation of community. Being unable to have dialog in the classrooms and student centers of universities has a major chilling effect on sharing of views and open learning:  The Destructiveness of Call-Out Culture on Campus
  • The call-out culture trend described above between students also exists on campuses between professors and other academics. Instead of playing out on social media, this dynamic takes place from editorial boards and academics who read papers in journals, or even just commentaries on papers in journals, and then pile on to criticize the author’s intent. Leaving aside the merit of any arguments made among these groups, the dynamic is the same, of stifling dialog and using groupthink to determine which expression is acceptable or even legitimate. Often this criticism is not very informed and even extends to having the outright intent of policing which and whose ideas are considered worthy of engaging with and debating about:  Academe’s Poisonous Call-Out Culture 
  • Another impact of social media and the internet on the classroom has been the rise of the “teacher influencer” – educators who are given free educational software or equipment, and even sometimes paid in addition, to use for their students in exchange for making posts online or giving talks about the products. These teachers can argue convincingly that their students benefit from access to these products, and that their business arrangements are taken on with the sole objective of benefiting their students in a time when school supplies and improvements are vastly underprovided and underfunded.   However, the standards for disclosure of these arrangements and the handling of the potential conflicts of interest that can arise even from the most innocent, helpful intentions are uncharted ethical territory:  Silicon Valley Courts Brand-Name Teachers, Raising Ethics Issues

In many ways the academic setting, for secondary education as well as at the university level, can be seen as an incubator for these social disruptions that occur in every area of contemporary life. Educational institutions are struggling with cultural changes that redefine the responsibilities in and limits of authority. Issues of consent, safety, cultural values, and conflicts of interest all prompt compelling compliance dilemmas in the higher education domain.

Categories
Compliance and ethics business case studies

Instagram and the internet’s code of ethics

Instagram is a very popular social media app based on sharing photos and videos, publicly and to selected users as well as via direct, private message. It was launched in 2010 and since April 2012 has been owned by Facebook, another giant in the social media industry. In less than the decade of its existence, Instagram has grown a very large and active community, where users can interact with their friends and “followers” as well as other communities who maintain a presence there, public figures, media sources, and corporate brands.

All of these wildly different groups, from all over the world, sharing content and commentary on one platform, is exciting and promises many opportunities for collaboration. Along with these positive connections, though, of course come negative surprises and possibilities for challenges and abuses. With all the influence Instagram has through its popularity comes also responsibility for defining the standards and limitations of the community as well as what it will put out into the internet and the world.

Instagram has faced its share of criticism for its efforts to implement and maintain effective controls and reporting mechanisms.   Instagram relies heavily on user reporting of inappropriate content, such as posts depicting illegal activity or the use of “coded” hashtags and emojis to conceal but continue on with such practices. Understandably, even the most aggressive attempts to keep up with the pace of this behavior on social media will fall behind quickly, leading to criticism the community is unsafe. When Instagram is too proactive or reaches in deleting comments, posts, or users, however, then controversy about overreaching into privacy and expression begins in response.

Kevin Systrom, one of the original creators of Instagram and its current CEO, wants to work this balance between protection from abuse and freedom of expression. Under his leadership, Instagram is dedicated to ensuring that the content and tone on the platform is compliant with its community guidelines. Changes to the comments sections on photos – including allowing users to filter out comments that had certain words, or to post photos without comment sections available – are intended to encourage safer self-expression by the posters who might otherwise fear harassment or offensive content in response below their photos.

Platforms such as Instagram, of course, can never be neutral – any technology’s relationship with its user is one that is fraught with moral concerns, starting right at the ethics of its design, which is made only more complex by algorithms, robot users, and the real users who make their own decisions about the content to share and promote that run the gamut from universally appropriate to offensive, harassing, or even illegal. In such a context, applying a code of ethics is a very hard task, but perhaps it is the inherent difficulty of doing this that makes it so important to try.

Creating filters and tools to hide and promote, prevent and engage, either when deployed by the community management behind the scenes or when elected by users, is just the beginning of the design choices engineers have made at Instagram to implement technical responses to problematic tone in some corners of the platform. Instagram tries to deploy artificial intelligence to help also, to sort real posts from fake and to learn from the data to understand why innocent comments or content may be abusive to the context, a concept called word embeddings. AI has its limitations, of course, but in any rules-based approach to governance it’s necessary to start with something good and then make continual efforts to make it better, rather than leave risks un-addressed while in hopeful pursuit of the best.

Time will tell how effective Instagram’s efforts to make the platform a safer place for expression really are, and what they really accomplish – a place which is open for creative sharing and communication creation, but not to toxicity and abuse, or a censored, sanitized, disingenuous photo collection where self-expression is restricted and speech censored? Perhaps Instagram will succeed in going against the tide on the internet and in much of life, where the level of social discourse seems to have gone low, tinged by anger and dark with people’s worst impulses, and make a place where the conversation can be a bit more civil, even if it has to be filtered first to get there.

For more detail on Kevin Systrom’s ambition of making Instagram a safe haven and role model platform on the internet, and the challenges that both motivate and complicate this mission, see Nicholas Thompson’s story on Wired.

Categories
Compliance in current and historical events

Compliance lessons to learn from the 2017 Equifax cybersecurity breach

Equifax is one of the major US-based consumer credit reporting agencies. It operates globally and due to their nature of its business, maintains sensitive and personal information on more than 800 million individuals and more than 80 million organizations.

In September 2017, Equifax announced that it had experienced a cybersecurity intrusion in July 2017 which impacted the data of up to 200 million consumers from the US, Canada, and the UK. The handling of this breach by Equifax was widely criticized and questioned. Among the controversial aspects of it were the two month delay in publicizing it, the lack of specific information about the data compromised, the inadequate and possibly even unsafe system and support provided for impacted consumers, and the perception of possible insider trading by company executives in the days after the breach took place but before it was public.

As the problematic response to this cybersecurity incident unfolded, Equifax’s various blunders and missteps in the public handling of the situation formed a guide for worst practices in such a scenario. As the dialog around Equifax’s response has shown, poor crisis management in the public eye only compounds the consumer protection problems.

  • Companies do often have legitimate reasons for delaying notifying consumers, regulators, and the public at large about data breaches. Sometimes companies do not even know they have been breached right away. Even once they are aware, sometimes law enforcement will request that they do not disclose the breach. Different types of data may be subject to different disclosure requirements, so companies also sometimes have to take time to determine what data was involved. However, these delays still can be very problematic for consumers, who can be unknowingly at risk and make assumptions about the seriousness with which their data is stored and maintained which might be very far from reality.  Why it can take so long for companies to reveal their data breaches 
  • While Equifax was taking its time notifying consumers and regulators of the data breach, questions abound about when – and what – people on the inside knew about it. This is because only a few days after the July 29 cybersecurity intrusion, on August 1 and August 2, several executives at Equifax sold shares. These transactions were not part of scheduled trading plans, but they were not total liquidations of their positions, and the company says that the executives were unaware of the breach at the time of the trades. However, the perception of possible insider trading is hard to avoid once the timing of this activity is revealed. If they truly did not know about the cybersecurity problem, it would have been wise at least to inform key senior management of the breach and advise them to avoid trading in the stock while in possession of inside information.  Three Equifax Managers Sold Stock Before Cyber Hack Revealed
  • Despite how secret most people in the US see their financial data as being – especially social security numbers and bank account or credit card information – current privacy laws are lacking in many key areas when compared to those in other parts of the world such as the EU. Top of mind among privacy concerns, including the need for consumers to input personal data to check whether their other personal data has been compromised, is that over a month went by before Equifax notified the public of the cybersecurity incident at all. In the 40 days that went past, the data could have been used for many illicit purposes without consumers even being aware they were at risk. Laws in the US currently differ between states with regards to breach notification requirements. There is no unifying directive in the US for the standard where personal data is concerned, such as there will be next year in the US under the General Data Protection Regulation, which requires notification within a maximum of 72 hours. Perhaps a higher standard in the US such as this one would reinforce seriousness of these events to organizations and improve consumer protection and communication processes when they occur.  Equifax breach disclosure would have failed Europe’s tough new rules
  • While these data breaches are unfortunately becoming so common that the public is often less alarmed by them now than in the past, irresponsible or insufficient responses by organizations to these breach still provoke justifiable outrage and calls for change. Consumers being desensitized to the exposure of their personal data just shows how widespread the problem is and how insufficiently the interests of the consumers are guarded. However exhausted the public may seem to be with the ongoing leaks and hacks of their private data, this is no excuse for organizations affected by them to respond with the same passive, indifferent attitude. Equifax’s lack of detail and inadequate communication displayed to the public that they did not care about the invasion consumers were suffering, which is quite a different message than one of fatigue by victims who have had this experience too many times to excuse. The reputational risk suffered by such corporate carelessness is extreme, and hopefully will drive consumers to advocate for a higher standard of responsibility and responsiveness from keepers of consumer data.  The Banality of the Equifax Breach
  • As the public contends with the reality of the Equifax data breach – that subsequent hacking attempts stemming from this breach are inevitable and that companies like Equifax do not meet the standard of care for protecting this private information in their possession – what can anyone do in the future? Holding companies accountable for their poor service by taking their business elsewhere is often the only choice consumers have to voice their displeasure. In the current system individuals aren’t really able to avoid the consumer credit reporting agencies, but organizations could opt to create and use independent systems with more secure infrastructures. These corporate users could drive a technological shift that would also benefit individual consumers. Blockchain and related technologies could provide the solutions to these vexing and chronic security concerns that the existing system seems unable to address.  It’s time to build our own Equifax with blackjack and crypto

Given the ever-increasing risks surrounding cybersecurity, compliance professionals and individuals interested in cybersecurity risk management can take many cues from the above on what not to do in such a situation from Equifax. Hopefully as organizations continue to live with the risk of such intrusions, and improve their control frameworks to prevent and mitigate them, they also pay attention to the public responses in such situation, to make sure that the statements made and guidance provided are adequate and accurate.

Categories
Best Practices

Communication strategies for increasing employee engagement in compliance programs

Every compliance professional’s strategic annual plan will include seeking increased employee engagement in and attention to the organization’s compliance program. Communication strategies must be carefully devised with the goal in mind of making compliance vivid and interesting to employees. The compliance message can quickly become routine and dry: sign an attestation, request pre-approval, complete a checklist. This sort of messaging alienates employees rather than engaging them. They have only a small function in the compliance operations this way. Nothing is learned or shared, they are just doing a “tick the box” type exercise.

Instead, the true aspiration of the compliance messaging is that employees take interest, learn something new, ask questions, and feel connected to the story of the organization’s compliance program. This is accomplished via effective and appealing communication that speaks to all audiences and sets a new, compelling tone.

  • Key moment messaging: Compliance is highly relatable to current events and new stories. Therefore compliance communications should take full advantage of key moment messaging opportunities. Relate communication topics to outside events to make the objectives of the compliance program even more concrete. For example, if there is a major earthquake somewhere in the world and your office is located in Southern California, take that opportunity to engage with employees about disaster recovery and business continuity policies and procedures. Their interest will already be heightened and the necessity of the information will be at its most tangible.
  • Positive reinforcement: Start with a kudos, congratulations, or positive sentiment. Any action that needs to be taken or improvement that needs to be made based upon the communication will be much better received if the message gets off to a welcoming start. Set a productive tone by thanking employees for their participation in the last request or calling out good insights or high engagement. Then build off that encouragement to bring in the next steps needed and issue the call to action.
  • Branding: Branding and marketing are now important considerations across all business lines and functions. Compliance is not immune to this, as messages from so many sources fight among themselves for precious attention and airtime from employees. Therefore compliance professionals must carefully consider branding options that will maintain the substantive content of their communications yet be adequately branded to be appealing. Using humor or a catchy, fun theme to introduce the communication, before getting to the meat of the message, can provoke curiosity and prompt engagement. Don’t take it too far and make it a joke – but a little bit of amusement can go a long way.
  • Give visuals/shortcuts: On a similar note, think about making simple takeaways from the communication, however complex its overall message. One way to do this is to provide a visual, like an example of a new form that has to be filled as standard procedure, or a chart showing results on an initiative over previous periods and projected future results. If a visual is not applicable, try using acronyms or slogans that will work as mnemonics to help people remember your message and keep the meaning in mind.
  • Make it interactive: The best way to engage employees in compliance communications is to concretely incorporate them in it. Make the messages interactive for them. Ask an open-ended question and promote any responses received so that employees know the request for input is credible. Take a poll or offer a quiz. This way, employees can share in the mission and the effort by weighing in themselves, which allows them to personalize the message and be more likely to remember it.

To interest and appeal to all employees, compliance communications should not be generic or routine. Taking advantage of opportunities to make compliance relatable, and capitalizing on human interest or emotional connections that can be made, will help to make the mission of the compliance program much more interesting and effective.