As compliance professionals, most of us are very proud of the accomplishments of our programs. Nevertheless, we know that there are areas where we can improve – and these improvements may require resources in the form of people or cash. So how can we best make a business case to the “powers that be” for getting additional resources to make needed improvements?
Advocating for Compliance to Get "Board Time"
The solution for most of us is the board report. Whether or not you get your own “compliance” tab in the board report, a page or just a paragraph in the legal or audit tab, the board report can be our best chance to tell our story. Sounds easy, but we all know it is not.
Most of us compete for space and prestige with other functional departments such as legal, finance, operations, sales or others which have a long history of being included in board reports.
Most of us compete for space and prestige with other functional departments such as legal, finance, operations, sales or others which have a long history of being included in board reports. The leaders of these functions have often honed their presentations and their delivery.
Even more importantly, board members and senior management “get it” when these functions present. This may not be the case when it comes to compliance or corporate governance. We are often educating the listeners or readers on elements of an effective compliance program while also trying to deliver the salient high points of program performance and opportunities for improvement.
So what can we do to change this?
Make Your Board Report Count
It is often said that “you can only change what you can measure.” In the increasingly metric-driven business world, this has never been truer. If you can’t show change velocity, correlation, return on investment (ROI), or one of the other metric buzzwords, how can you claim your place at the table with functions that routinely spew out reams of data?
The knee jerk reaction for most of us, at least initially, is to pull and report every piece of data we can get our hands on. This is particularly true with our hotline data because it is readily available and offers many data points: case numbers, closure rates, anonymous reporting percentages, etc. Our hotline data may seem like our chance to show that we are as data driven as the next function – with the pie charts to prove it. But is this the right approach?
For instance if you only have a page in the board report and all you show is hotline data, what is the natural conclusion? Compliance is only about the hotline. While hotlines are a critical element of effective compliance programs, we all know that our programs are much more than the sum of our hotline data.
Data Is The Means, Not The End
The board report is your chance to sell your vision, your strategic plans and your progress toward that vision for the whole compliance program.
Data serves two purposes: show what happened or (more importantly) to show what might be. If the data is reported accurately there is no need to tell the board, “Our hotline reports decreased from 102 per in 1Q2016 to 96 in 1Q2017.” What is important is the “why” or “what next.” The board report is your chance to sell your vision, your strategic plans and your progress toward that vision for the whole compliance program. This means that you have to use your time and your platform wisely. Think about the traditional “elevator speech” approach that we learn in communication classes. You need to be able to use the data as the exclamation point for your message, not as the messenger itself.
If the decrease was expected due to a reduction in force by a corresponding percentage, the decrease in reports should not have been a surprise. However (and more problematically), if the most recent engagement survey suggested the decrease was because employees feel that calling the hotline is a waste of time – or a fear that management would retaliate – then this is the critical message you need to deliver.
In addition to answering the question of “why,” you also need to talk about your plans to make changes in the organization to get to a report volume number that you consider healthy. The board will probably also want to know what this number looks like at peer companies or overall. This is the type of critical data you want to have ready.
Use Data to Demonstrate All Elements of Compliance Program Effectiveness
Other than hotline data, there also needs to be high-level reporting on other key performance indicators (KPIs) that you established (hopefully with board or senior management buy-in). These KPIs should focus around other elements of an effective compliance program:
- Incident Management Reporting
- Ethics & Compliance Training
- Policy & Procedure Management
- Third-Party Risk Management & Due Diligence
Avoid the Data Dump
Don’t use data as a crutch. Dumping every possible data point into your board report does not make your compliance department look better. Data should be used to tee up or support the “why” and “how” of your overall effectiveness.
Tell the board what the data means to you, and how you are using the data to move toward your strategic goals and vision that you created with their assistance. Still feel like you absolutely must share all data you can generate? That’s what an appendix is for.
Remember, the board is looking to you for your guidance, wisdom and experience in how best to mitigate business risk related to ethics and compliance matters. It’s “what you think” coupled with “what you know” that they want to hear. Data alone can never deliver this level of professional partnership.