Driving ethical behaviour in a global organisation

Tone at the top is important but not enough to build and sustain an ethical corporate culture in a global organisation. Measuring behaviour and monitoring compliance are just as critical. Liban Jama, a partner in EY’s forensic and integrity services, explains how to drive ethical behaviour in a global organisation.

What you’ll learn from this episode:

• Open and honest dialogue is essential to building an ethical corporate culture in a global organisation.
• Simple value statements can align corporate protocols with cultural mores and customs in countries where doing business can be fraught with ethical problems.
• Tools are available to set up metrics that help measure ethical behaviour and monitor compliance.
• Internal audit and the finance function play critical roles in providing the board and senior leadership with line of sight into risks and how effective controls are in supporting corporate ethics throughout the business and its supply chain.

Play the episode below:

To comment on this podcast or to suggest an idea for another podcast, contact Sabine Vollmer, an FM magazine senior editor, at Sabine.Vollmer@aicpa-cima.com.

Transcript

Sabine Vollmer: Policies and tone at the top are not enough to promote ethical behaviour. Monitoring and measuring adherence is as important. In today’s episode of the FM podcast, we offer steps to drive ethical behaviour in global organisations. I’m Sabine Vollmer, a senior editor at FM magazine, and I’m talking to Liban Jama, a partner in EY’s forensic and integrity services, who moderated a panel on the topic at Ethisphere’s 2019 Global Ethics Summit.

Considering how important leadership is to promote ethical behaviour throughout an organisation, what are the best practices to deal with an executive or manager who produces outstanding results but behaves in a way not consistent with the organisation’s values?

Liban Jama: Well, my view — and that’s an outstanding question — I think the first sort of operating principle is that no individual or work product is worth risking an organisation’s ethical values or standards. So, from my perspective and in my experience, leadership really have to take an active role in monitoring and making sure to address behaviour that is questionable from an ethical perspective, or you have the perception of being contrary to the organisation’s standards. And so, from my perspective, again, training is incredibly important. But what I mean by “training” is being able to build a culture and an environment where there’s open and honest and transparent dialogue within your organisation. I’ve seen, as part of my work in integrity and forensic services here, it as the most important way to address such behaviour.

Vollmer: Is that how it is dealt with in real life?

Jama: In a number of organisations, indeed, it has been. It’s really a tone at the top type of perspective, and how leadership addresses it. And so, we’ve seen it with respect to a number of our clients, where there is a real focus on governance and culture. There’s a clear understanding on the organisation’s vision and mission and ethical obligations, most importantly. And they’re dealing with it from the perspective of making sure the policies are actually implemented in real life — the code of conduct and organisational values are actually brought to life. And even in the context where there’s pressures and beliefs that influence decisions that may be to the contrary — you know, we’ve seen it from the perspective of companies who’ve really taken a proactive role. It’s a spectrum, right? As in every — you know, any part of life. But we’ve seen it from the perspective of great tone at the top and then in other areas where there’s work to be done.

Vollmer: What makes this a little more complex is when you have a global organisation with a global workforce that represents different cultures. How do you align the ethical values with these different cultures?

Jama: That’s another great question, given the global nature of our work. And so, I think sometimes we get tripped up in this space about very sort of complex and detailed and cumbersome protocols, as opposed to really pushing forward simpler value statements, which I view are much more powerful and understandable. So in a number of countries where gifts may be acceptable and expected in terms of doing business — and such practices, for example, in the US, would be considered to be problematic and would also even be considered bribes — those conversations on a global level, dealing with the different cultural mores and local considerations, I believe — and I’ve seen it, where it’s been much more effective — where the value statements of saying, “We want to increase honesty, responsibility, fairness, and respect within the workplace.” To have that transparency, to explain to folks that this is sort of the organisational perspective globally that’s being driven by the top of the leadership of the organisation, and that we believe these values, we’re monitoring these values, we’re examining these vales. And if those values are not met, there will be consequences associated with that.

I think that when you’re dealing with a global organisation, a lot of time is spent in terms of trying to figure out the most effective way. But in my experience, here in our integrity practice, a lot of the focus really has been on focusing on governance and cultural issues, training and education, and allowing people to understand that. Here are some baseline principles that cannot be in any way violated. And so here are the things we’re doing to manage that process, where we can use some technology to enhance our procedure to be able to monitor that as well. But it’s a challenge that organisations continue to face as they continue to be even more and more global. Respecting and understanding different cultures but also maintaining a general standardised value system within the organisation that are based on really — as I stated at the outset — simple, straightforward value statements.

Vollmer: Sure. And having ethical values and then the policies to promote compliance is all good and well, but are there ways to measure an organisational culture that promotes ethical behaviour?

Jama: Absolutely. There are a number of ways to be able to take what is considered to be a very qualitative process and try to put it around metrics, and we’ve been doing that in terms of helping organisations build out a framework to be able to measure improvement, and that’s been a core theme with respect to our integrity agenda here at EY, where we help identify data sources, create metrics, and monitor programmes to increase ethical conduct. And what I mean by that, I really mean from the perspective of having first of all the top-down conversation where you have executives and others in leadership positions being able to raise and ask difficult questions, and essentially setting effective tone at the top for honest feedback so that can be flowed more freely through the organisation.

But it’s also through questionnaires, surveys that are actually narrowly tailored to a particular area of focus, whether it’s on culture, controls, or governance. So that those baselines can then be measured over time within sort of measurements that have gotten sort of buy-in from everyone in the organisation as an appropriate way to think and measure certain aspects. And whether it may be managing through sort of how we continuously improve our controls with third-party due diligence. How do we manage and reward conduct that highlights issues? That’s another thing. Being able to foster and make sure that you’re creating an environment where people who are stepping up to identify areas that are unethical or may raise questions regarding illegality are actually being communicated and shared with others as a best practice, that this person has actually come out and raised an issue that we should follow up on. And making sure that that helps facilitate good decisions. And then it reinforces itself. It becomes another metric to push forward and be able to say, “You know, we’re actually strengthening our culture here.”

And we see it often coming back when you’re doing the feedback and deep-dive analysis of the feedback from people throughout the organisation to say, “Are we meeting your expectations here? Here are the things we’re doing, here are the things we’re seeing, here are the things we’re doing to mitigate against it. What are your thoughts?” And so, I think having that conversation at the outset, letting people know what journey you’re on — and then, most importantly, demonstrating that you’re committed to it. Those metrics allow folks to be able to say, “You know, what? We’re moving in a much more clear and right direction.”

Vollmer: I guess the challenge is to maintain it and to make sure you’re staying on track and you monitor everything. How do you do that? Can you give me an example? And what role does internal audit and the finance function play there?

Jama: Well, I’ll take the second part of your question and weave it back to the first part of your question. So, with respect to internal audit, I view internal audit as a function as being one of the most critical gatekeepers to effective and accurate financial reporting. And what that means and how that ties together is that as a result, internal audit is going to be in a position to be able to challenge management, question management, ask the question to make sure that certain values are being met within the organisation. Because that financial reporting aspect, also working with the external accounting function as well, you’re having that information, particularly for publicly traded companies being communicated to the investing public, who are very much focused on making sure that their investments are within organisations that are meeting certain standards. And so internal audit, they’re often going to be asked to and tasked to monitor ethics hotlines and reporting. And when those reports are made, internal audit’s function is going to be focused on efficiently and effectively getting to the bottom of many of these reports.

So tying back to the hotline and tying back to how this actually works in practice, when you have, as an example, where you have a report on the hotline, you’re going to see very clearly from the organisations that really have a high degree of focus on their integrity agenda, that they’re going to take those hotline requests very seriously. There’s going to be a playbook, an investigative playbook that’s already implemented that they’re going to follow, that has been already thoughtfully constructed to make sure that those items that are reported are escalated appropriately based on the facts and circumstances. There’s going to be a reporting function to people up the chain and perhaps also to the audit committee to say, “We have this function. It’s narrowly tailored and reasonably designed. These are the outputs. This is what’s going on. It’s part of our management and risk management strategy.”

And when you have that occur, and you have an organisation that takes, for example, an allegation of bribery in a particular location that gets reported out to a hotline, then you have, from that perspective, multiple stakeholders mobilising, you have a point of contact and folks are addressing the issue. But most importantly out of that process, you have others within the organisation that are stakeholders who are observing and being able to communicate and say, “When we do find an issue, we’re doing everything in our effort to address that issue, mitigate it, get to the root cause, and try to be better.” And I think that part of the challenge in this space is that there’s no perfect solution. There’s no perfect answer. But the best way that organisations that are dealing with a complex global environment can address these issues is to spend as much time on a proactive basis to develop policies and procedures — internally, and with the help of external experts — to make sure that they’ve built out a framework that is resilient, and most importantly flexible, to address issues that are raised, whether it’s through the hotline or through some other communication means.

Vollmer: And I suspect that that same procedure or the same workflows also apply to anything that comes out through data, be that internally, fraud, or be that down the supply chain?

Jama: Absolutely. So, when you have an effective fraud management protocol, that protocol is going to be relying on technology-enhanced procedures so that you can get data insights to be able to make assessments as to what is going on. Is there an outlier here? Is there a consistent theme that we can analyse and be able to identify trends that are problematic and that allows the organisation to get some line of sight so that they can make some good decisions to be able to address those issues and then to further strengthen their culture? So that is also part of that process. You can’t monitor what you can’t measure. And so we often talk with folks about figuring out the best way to be able to build a framework that has a data foundation that allows one to reasonably measure that, and most importantly have a contemporaneous, documented process, that if for some reason there are issues that are raised at some point by a regulator or some other party, you are able to demonstrate that you have spent a considerable amount of time and effort and resource to make sure that you’ve built out controls and a governance structure that fits within your cultural vision statement and you have insights to be able to share with other stakeholders, most critically the board, and other key members of senior management, so they have a clear understanding of the risks and the controls and how effective they are.

Vollmer: Sure. You were talking about the board and executive management. What are their roles, and when should they get involved in order to promote an ethical culture?

Jama: The board, and also members of the C-suite, in my view, play a fundamental role in promoting an ethical culture within an organisation. And what I mean by that is, in terms of their involvement, it should be at the very start. It has to be consistent, persistent, involved on an ongoing basis, where there is a tone — and I can’t express this strongly enough — a tone at the top where when executives falter or stray from the values set forth in an organisation, or anybody downstream, and there are other lapses of judgement, that those areas, those issues, are followed up throughout the organisation, and that there is an effort for executives to really continuously monitor reports of actions that are against the values of the organisation. And when situations arise that threaten to undermine the public, and importantly, the organisation’s own employees’ trust and the values held by the organisation, executives should step in and take swift action to address and rectify the situation, provide assurances that the values held by the organisation haven’t changed, and, more importantly, they’re going to continue to be focused on and serve as a guiding light for the organisation, despite the circumstance. “And here are the things we’re doing to address and correct the situation.”

Now, taking a step back, many employees — and statistics have shown this — have from their perspective, a very strong view and positive view about their own individual company and their experiences, and that’s borne in part by the actions that have been taken by their own company to address issues.

Vollmer: If this is all working correctly, if you set it up, if you’re doing what you’re supposed to be doing, if everybody in the company is doing what he or she is supposed to be doing, everybody is putting the best foot forward, when something goes wrong, it shouldn’t be a situation where board members and executives are surprised, as in, “We didn’t know this was going on.” Am I thinking correctly? Because if you have transparency, if you stay on it, these things should be apparent, and you should be able to take care of them and fix them before they blow out of proportion, right?

Jama: Yes. And I think your point is a very good one. And I think what I’ve been trying to describe is really that an organisational journey where folks are driving towards a state where they’re focused on really an integrity agenda within the organisation. And so to point out, for example, where you have situations where board members say generally they had no idea that this was going on, that they’re very surprised or shocked, it really, from my perspective, is an indication of much work that needs to be done to be able to make sure that there is a clear communication and line of sight. What was the root cause? Was the internal process flawed? Were issues raised appropriately? So that one can say and focus on, was it a failure of governance? Was it a failure of controls? Was it more importantly a failure of culture? And did we have the right data-based insights to be able to identify those issues?

And so, I think you’re thinking about it correctly. When you see and hear of major, major corporate scandals, and you analyse sort of retrospectively what went wrong, right? Along the way, just like in every sort of challenge or issue, decisions are made on an individual basis, through a framework — sometimes there is one, sometimes the framework is not adequate, sometimes there is one that there isn’t really one, right? And then part of the analysis of saying, “Well, how can we stop and make sure that this doesn’t happen again?” from our perspective is really one of a cultural question of, “Have you really thought about everything from an integrity lens in your process?” And a number of times the response is, “You know what? We thought we did, but we didn’t, and we need to revisit that,” and then that becomes a ground-up approach of building up a foundational perspective that allows organisations to say, “You know what? We’ve identified the critical fault lines here. We now have a better understanding of being able to monitor and assist internally. And we’re going to have a better sense of being able to keep our fingers on the pulse of illegal and unethical conduct.”

And so whenever I read stories as you are alluding to, where board members raised the issue of, “Well, we didn’t know,” my immediate reaction to that is, well, that’s a situation where, from an organisational perspective, that’s a conversation to have on a holistic basis of saying, “Obviously we’ve had some issues in terms of — from a root cause analysis that resulted in you expressing that view. How do we go about that through an enterprise-wide process with all of the stakeholders involved to make sure that that is not indeed the case?”

Vollmer: In other words, there’s a lot more wrong with this whole set-up than people doing wrong, right?

Jama: In that sense, the perspective of — I think it’s the challenge, right?

Vollmer: Right.

Jama: It’s the challenge of what’s on a piece of paper and then saying, “OK, we’ve got this wonderful process on a piece of paper, and we have intentions.” Right? So, the paper reflects an intention on the part of the organisation. But then, how do we reduce the gap from the intentions and the organisational behaviour that you’re referring to, right? So how do we take — we have missions and value statements, right? We have folks that are focused on a code of conduct. Every organisation has policies, and they promote standards. And then there’s communication. 

Vollmer: Right.

Jama: But then how do we translate that into actual behaviour? How do we focus on principles, behavioural standards, unwritten norms that really guide employee behaviour? And then how do we go about and get verifiable data about employee behaviour and the organisational culture and put metrics around that? 

Vollmer: Right.

Jama: That’s, from our perspective, our focus of our practice is really reducing those gaps between intentions and organisational behaviour. I would say that most organisations have intentions, as we define it, through some documented process. Where things fall short is the actual behaviour. And how do we mitigate that and reduce that gap?

Vollmer: Exactly.

Jama: And that’s what we focus on nearly every day with organisations.