Why Culture Trumps Compliance

On July 30, the Wall Street Journalreported the following on a recent meeting of the New York Fed:

Thomas Baxter, Executive Vice President and General Counsel of the New York Fed, stressed at the outset of his remarks that he was only speaking for himself, but he pointedly critiqued company culture, saying that if a firm’s values don’t support the rules used to guide employee behavior, the organization ‘is headed for troubled territory.’

Baxter is right on the money. His statement applies not only to banking but also to other types of businesses. NAVEX Global recently released a survey reporting that most compliance officers have shifted to transforming culture as opposed to simply – and it is relatively simple – educating employees on applicable regulations. This is a welcome development. Unfortunately, it’s happening a little too late for organizations like General Motors and the Veterans Administration.

In 2002, I met with the number two aide to one of the nation’s top general counsels. We were discussing how his organization would comply with the newly-enacted Sarbanes Oxley Act, which introduced major changes to the regulation of financial practices and corporate governance requirements.What he told me that day proved to be a common organizational approach.  He said his organization planned to communicate basic standards and document leader and employee receipt. The company’s leaders had concluded getting material out broadly, not whether it had impact, was all that needed to be done.

I thought his employer and others following the same course had made a grievous mistake. And, history has made it clear that they did. Time after time, organizations with supposedly robust compliance mechanisms have proven their systems to be as effective as paper shuffling. They’ve become prey to gross violations that all of their policies, actions, and public commitments promised would never happen.

Compliance initiatives based solely on systems, processes, memos, and other activities – which are largely ignored – tell people what to do; but it’s organizational culture that determines what people actually do. Culture is derived by what people see being done by those they respectand, frankly, may fear. It’s based on how individuals are rewarded or punished when they meet or breach key values. This varies from organization to organization: I know one company that fires anyone who lies on an expense report, no matter how high up the chain they are; another allows employees to cut corners on business deals and deceive clients as long as they meet their financial goals. The reality is people violate rules all the time and either don’t believe they’ll be caught or get into trouble if they are. 

Thus, culture represents the way organizational values are actually lived, not the words by which they are expressed. And, a healthy organizational culture won’t take root by forcing employees to sign documents they’ve barely read and that are ignored by individuals who control their workplace opportunities and futures. Defining clear principles on paper is a first step, but that’s all it is.

To instill ethical behavior, organizations must provide incentives and encourage everyone to not only act properly but also to report violations. And, they need to recognize and, perhaps, reward people when they do. That’s the strategy banks, auto manufacturers, healthcare institutions, government agencies, etc., should follow if they’re serious about making ethical choices, welcoming values, and having daily meaning. It’s much bigger than just handing out compliance-worthy statements and having employees check the box.