Culture & Compliance Chronicles: Effective Remediation

The latest installment of Ropes & Gray’s podcast series, Culture & Compliance Chronicles, explores company culture in times of crisis. In the final part of a three-part discussion, litigation & enforcement attorney Amanda Raad talks with three partners at EY—Maryam Hussain, Melissa Myatt and Katharina Weghmann—all of whom study decision-making in the corporate context. In this episode, the group explores what effective remediation looks like and how it all ties back to the root cause of the issue. They also circle back to how companies can create a culture of compliance and the role ethics plays in this, especially for companies that use data analytics to measure culture.

Transcript:

Amanda Raad (Ropes & Gray): Hello, and welcome back to Culture & Compliance Chronicles, a podcast series focused on the behavioral sciences approach to risk management. I’m Amanda Raad, a litigation & enforcement partner and co-chair of Ropes & Gray's anti-corruption and international risk practice. In the final part of this three-part discussion, I’m once again joined by Maryam Hussain, Melissa Myatt and Katharina Weghmann, who are all partners at EY. In this installment, we’ll be focusing on remediation, which in a way, ties together the various points we have been discussing throughout this three-part series. Melissa, we have spent a lot of time saying that it's important to understand root cause as well when we're thinking about how to address any potential issue or how to look at any potential issue. Can you give some thought to, again, reminding us why that's important and then also what are some of the best ways to make sure that we are really understanding what the root cause may be?

Melissa Myatt (EY): We spoke earlier about how with a better understanding of root cause, you can better target your remediation. You can maybe design your remediation to be something that's more impactful across people that isn't introducing a whole series of new controls or simply the consequences for the individuals involved. My views on root cause are relatively simple – I think the simpler you keep it, the easier it is. I've seen a lot of organizations tie themselves up in knots trying to create categories and classifications. And really whenever something goes wrong, it's not just about identifying the issue and the finding, but that basis of root cause. For me, it's as simple as: it happened because somebody made a choice or somebody made a mistake. And fundamentally, the difference for me is: who should be accountable for the fix? If it was a mistake, I think that's where you can then go and look at your training, your controls, your processes – and if it was a choice, you go straight to leadership. People make choices because of instructions from their managers, peer pressure from their teams, expectations around their roles and the metrics against which they're measured. If you can really home in on one of those, you can then focus where you drive your remediation. And that would be, at its simplest level, I think if people could focus on that, that's where you can help start to think more broadly about where culture plays a part in remediation.

Maryam Hussain (EY): We just completed an investigation recently for a large organization that acts as an outsourcer for other organizations, to provide services to clients of organizations. And the investigation was around the fact that their people have been misreporting the standard of service delivery, so they were doing that in order not to incur penalty charges under the contract. But when you looked at the root cause, the reality was the leadership was signing up to contracts, which was completely at odds with the capacity of these individuals to deliver. So when they were sitting there and they had the choice to either tell the truth to their clients and say, "We haven't hit the targets," or go to their leadership and say, "You signed us up to something that we can't deliver," what they ended up doing was to manipulate the numbers. So there's a choice to put ourselves in the shoes of the people that made the choice, and look at the facts and understand the why – otherwise, the same thing will happen again.

Amanda Raad: I completely agree with that and I think it is important to find a way to think about this in a simple term so that we can action it, but I think sometimes the danger is we stop short of where we should. So we come to understand the facts sufficiently to say that this person made a decision that is problematic and we make the determination that it was on purpose, that it wasn't a mistake, it was a conscious decision that they made. But then we stop, and we start immediately trying to, by ourselves, figure out how to fix it and make sure the person can't or doesn't make that mistake, or that choice again. And as you just illustrated, there can be a whole host of reasons sitting behind why that person made that choice. We really should be trying to understand that and asking directly why they made the choice, looking at other patterns, looking at other similar choices that are being made across the organization, to understand what else might be driving it because, as you say, you just replace one person with another person who makes the same decision.

Melissa Myatt: For me, choice is very simple: you choose to do something because you're too lazy to do the right thing or doing something in the right way, you're afraid so you feel pressured and that you have to do it, or you're being fraudulent and taking advantage or manipulating something. And each of those fundamentally go back to the culture of the team and the organization you're working in, that drove you to make that choice. But I totally agree with you – people do stop short on this root cause analysis often times.

Katharina Weghmann (EY): I would like to add to this with one concrete example. We have just looked at a number of investigation reports within one of our clients, to look through a behavioral lens and understand what were some of the social norms that seemed to have been dominating some of those choices or mistakes, like you have just framed. And what was quite interesting is that most of the times, it was a systemic problem and not at all group dynamics or not at all team dynamics, but most of the time, it was a problem of incentivization in a certain way. The goals were clearly set out to increase competition among departments and among functions that ultimately led to an internal competition in that organization to then go down a non-compliant way. And so, I think we need to look at systemic issues that create social norms, who then influence behaviors of individuals. And for this particular client, what the root cause analysis has shown is that we need to create measures that go much beyond the function within this investigation. We looked into HR systems, for example, or we looked into the goal setting. Is there a collective goal for teams, or are there individual goal settings? We looked at incentive structures. And I think that's quite fascinating if you then look at it from a systemic perspective, as opposed to just an individual or on a group level. And just one last anecdote to this. This was an investigation for over a period of time where we could see that the CEO was also quite surprised that nobody ever came to him because we could see that speak-up was cultivated quite a lot and it was also expected that things were brought up to executives, so he was quite surprised. And so what we found out, through this behavioral lens, was that people expected that he would be furious if they would bring it up, although he completely had different expectations. I think it's also quite interesting to see how mid-management expects something completely different of what's set out originally by a top executive, so I think we also need to look into how middle management is probably perpetuating certain patterns that are not necessarily the tone or the actions from the top.

Amanda Raad: I love that story because I think it shows so many important points that we've talked about together, but one of them being that it really revealed that it was the incentives, perhaps, that were really making a big impact on the behavior and the decisions that were being made. So, of course, if that's what's driving the behavior, then changing any policy, remediating against any individual, training all day long isn't really going to move the needle. I think sometimes, especially if you find out that it is compensation or an incentive structure that is really the cause, some people throw their hands up then and say, "Well, that's great but I don't have the authority to change that within my organization. That decision can only be made at the very most senior levels, and presumably it's been made. And so we just have to learn to live with that structure." And I think that's where you get these kinds of problematic feedback loops, where those that are making the most important decisions with compensation and incentive structures may not fully anticipate what impact those will have on people within the organization. And then people within the organization will feel that there's no reason to raise that as a potential remedy because they assume the decision was made intentionally, to set a structure that way, and then you're sitting with your hands tied behind your back. So I think it's just such a great example of really showing that leadership didn't intend that and that there is a way to fix what, ultimately, was the root cause there.

Katharina Weghmann: I just wanted to add one additional layer to this story – I'm happy that it resonates with you because there's one more twist to this whole story. I think what also fascinated us with this investigation, was that we could see that there really was a lack of admitting to top leadership that they were failing. And I think this is a crucial point, that you need to admit when you go down that route, and when we talk about root cause, and when we talk about, "We want to create a culture that is healthy and ethical," that you need to commit to become a learning organization. You need to commit to the fact that you will fail, and you need to commit to the fact that you need each other to learn from mistakes and that it's perfectly natural that you will not reach certain targets. The question is: what path are you going to go down? Are you going down the path of deceiving each other or competing with each other? What type of culture have you created to maybe go down another path where we choose learning, feedback, innovation and trying to accomplish a goal together, even though we have failed five times? So, I think this is really what struck us the most around this – that it's a question of which path do you choose, not just once, but over and over again, and then, of course, like we already touched upon, incentives and the cultures that is being set out is important in that.

Maryam Hussain: To that point on the continuous learning, I think one challenge is, especially for organizations that do have data analytics as part of their monitoring programs, which is increasingly the case, then by definition, the risk indicators that they're looking for are based on what happened in the past.  And the challenge is that in conditions of uncertainty, like now, for example, new threats emerge, which may not have been experienced before and, therefore, not captured in anything that they're monitoring for. So if that risk actually crystallized, your traditional monitoring is not going to catch it.

Melissa Myatt: What I'm loving about some of the data analytics that I'm seeing emerge now across the market is using the analytics to measure and create benchmarks based on your own data. So as the whole environment shifts, as everybody has worked from home, sales forces around the world are now fully virtual and it changes all of the norms and benchmarks. If you're doing anomaly detection, you're doing an anomaly against the new and shifting benchmark, so I think that's where some of the advanced analytics are cool, in terms of how you're not reliant on, like you say, that traditional, historic indicator in a static way.

Maryam Hussain: But then that brings the challenge of allowing the data to talk to you. Where's the line between the level of data you need to capture in relation to individuals' behavior, versus the responsibility not to step over the line and being both compliant with the letter of the law but also the spirit of the law, in terms of the employees’ privacy in relation to their digital footprint. And I think that's an emerging question of the ethics of how this is done, how the data's captured and looked at with good intent in order to provide feedback for the organization, to identify cultural issues and address it, but in a way that is not, in itself, unethical.

Melissa Myatt: That's a whole new tweak on both ethics and culture because you have a huge emerging topic around the ethics of how you use data. And it's also heavily influenced by national cultures around privacy and what rights you have to your digital footprint using your employer's assets or creating that footprint on company time. You see some countries in the world trying to use, and some governments around the world, trying to get a hold of that kind of data from companies to monitor and police its own people. You have other countries around the world who have very lax or no privacy regulation. And then you've got Europe, which is very protective of its people's digital footprints.

Maryam Hussain: The reason we're becoming more open to it is that we understand the intent and we understand the broader social good that it will do. Perhaps that's part of the answer for organizations, that the critical importance of being transparent about what you're doing and why you're doing it.

Melissa Myatt: You also have a generation divide here, where the generation entering the workforce now has grown up with a digital footprint, so they have a much different perception of it as well. I think we'll continue to see this change and take shape, but it comes back to: is the use of that information done for good purposes or not, and how clearly transparent is that?

Katharina Weghmann: To that point, Melissa, I think this generational shift is a really interesting topic because when we take it back to culture, I think technology and data analytics can play a tremendously important role in making ethics easy. Jonathan Haidt, one of the leading moral psychologist’s, he always says that we have to make ethics easy, and I think the same is true for organizations. I think the millennials, as well as generation Z, they're expecting to come into an organization where they don't have to read the policy with 200 pages and being referred to paragraph five of page 350. They want to have at their fingertips what they are allowed to do and what not to do. I think we also hold transformation around how do we create cultures of integrity, how do we create compliance, how do we enable the business, by using technology and data analytics in behaviors? I think that's becoming one of the biggest trends that we can see. I think some fascinating work that we have done with General Electric, which we're allowed to speak about publicly because it's been published in the fraud magazine, where we used digital twins as a concept to support high-risk groups in their compliance behavior by making it easy for them in a situation where certain procedures or SOPs are expected – how data analytics and a digital twin and their footprint can help in enabling them in doing their business in a more convenient way. As opposed to having yet another web-based training where maybe the effect is not as good as having real-time compliance at your fingertips. So I think this is something where we see a huge transformation happening and where data can play a tremendously big role in also bringing this alive in the future.

Melissa Myatt: I think the concept of making ethics easy is an interesting one and we could probably have a whole separate debate around it. My initial thought and currently in these times is that ethics is something that the privileged and the rich have the time and luxury to think about. And when you're in a crisis and you're trying to make sure all of your basic needs are met, whether that's personally or for the business, I do wonder then what happens to that concept of ethics in the decision-making and the thinking around when you've got two bad choices ahead of you, where does ethics play into that? I think that would be interesting to see how that plays out through this crisis.

Amanda Raad: I think you're right, that it's a huge challenge. But I think it is so critical to keep our focus on ethics and also on culture and on all the issues that we've been talking about, because it is possible that we have two bad choices that we have to choose between, but there's no doubt we're all going to be judged for whichever choice we make. I've spent a lot of time working with organizations to make sure they find a way to keep driving these agendas forward, even if the way they drive it forward maybe looks slightly different than it might otherwise in a different time.

Katharina Weghmann: Completely agree. And I think, if I may add this, it's not about the perfect decision in ethics – it's about making transparent why you chose path A, B or C. I think this is also getting back to how you're transparent with your investors, how you're transparent with your consumers, how you're transparent with employees. I'm not quite sure if we expect perfection when it comes down to ethics. I think to be an ethical person means you try to be transparent about your intent, you try to be transparent about where you took your decisions from, where you took the data from, what it's based upon, and when it hasn't been the right decision, to be mindful about what the mistakes were and then go back into root cause, like we have said. But I think we would be going down an alarming path if we would expect perfect decisions, if you know what I mean. I think it would be fair to say that we should engage in the discourse and engage in including voices, especially those that are most of the time silent in discussions of ethics, and then be inclusive about different voices to then try to get the best possible outcome, which is maybe not the perfect outcome, but at least a bit more inclusive than we would have intended originally.

Amanda Raad: Thank you to everyone for joining us for this insightful discussion, and a huge thank you to our listeners. We appreciate you tuning into the Culture & Compliance Chronicles podcast series. For more information, please visit our website at www.ropesgray.com. And, of course, if we can help you navigate any of the topics we discussed, please don't hesitate to get in touch. You can also subscribe to the series wherever you regularly listening to podcasts, including on Apple and Spotify. Thanks again for listening.

For additional information about EY, please visit www.ey.com or contact Maryam Hussain at mhussain@uk.ey.com or Katharina Weghmann at katharina.weghmann@de.ey.com.