//by: Sven Erik Holmes, Executive Vice Chair, Legal and Compliance, KPMG LLP

The current economic environment brings to the foreground the critical linkage between ethics, compliance and business success. Due to the intense pressure to enhance operational performance, organizations that believed they were “in compliance” may suddenly find themselves mired in regulatory or legal problems. These problems may arise from lax internal controls and oversight, or from conscious risk-taking that is well outside of reasonable business judgment.

How can organizations make sure that this does not happen?

Of course, policies and controls are the first defense against lapses in behavior or judgment. As a starting point, every organization should put in place an ethics and compliance program that ensures comprehensive reporting, clear accountability and full and effective oversight by the top decision makers. But to make the program truly effective—to maintain compliance, no matter how stressful the economic environment—it is even more important to develop a culture that is fully committed to ethics and compliance.

In 2005, KPMG set a course to build a model ethics and compliance program. The goal was to go beyond mere legal compliance, and establish an ethical business culture where every individual feels a personal responsibility for the ethical environment of our firm. Through this work, KPMG has identified principles and practices that we believe are essential to success:

Tone at the Top…and at the Middle

An ethical culture, it is often said, starts with “tone at the top” —with the CEO and top leaders setting the ethical standard for others in the organization to follow. And, the commitment of senior leadership is unquestionably essential to any successful ethics and compliance program. But equally important is “tone in the middle,” the influence of mid-level managers and supervisors who serve as the day-to-day role models for the majority of the organization.

The Strength of an Ethics and Compliance Program Is Measured by How an Organization Responds to Reports of Misconduct That Invariably Arise.

For example, KPMG learned from internal focus groups that our third- and fourth-year associates are just as important as top management in setting the ethical tone and delivering ethics and compliance messages through the organization. More importantly, most of these relatively junior employees were not aware that they played this critical role. In response, KPMG focused more of its training and support on enabling its mid-level associates to be more effective role models and resources on ethics and compliance issues. This enables the individuals most relevant to the daily work life of our employees to take greater ownership in contributing to the ethical environment.

Organize the Business to Support the Program

The right organizational structure and tools must be in place to create an ethical culture that will drive an effective ethics and compliance program. This starts with a governance structure that gives the program both independence and stature within the organization.

Independence is critical to guard against potential conflicts and to ensure that issues are treated objectively. This requires a governance structure that separates ethics and compliance components from the operational components of the organization. KPMG achieved this by separating both the compliance function and the risk management function from operations, with each reporting directly to the CEO.

It is equally important that ethics and compliance have the commitment of the highest levels of the organization. The stature of the program in this regard means more than just its place on the organizational hierarchy; it means having people in ethics and compliance roles who engender the highest levels of respect and confidence by virtue of their standing, experience and knowledge.

The Code of Conduct

A key element of any ethics and compliance program is the code of conduct, which sets forth the organization’s core values, ethical standards and expectations. Because of a code’s critical role, it needs to be clear and relevant to every person in the organization.

There are different ways to approach developing the content of the code. KPMG formed a content advisory panel consisting of advisors from different functions across the firm to help design an effective code. The guiding principle, which resulted in a revised code, was to make the document practical and to clearly demonstrate how our values apply in the everyday work environment.

Maximize Training Opportunities

Instilling an ethical culture requires more than periodic training efforts. There are innumerable “touch points” that every organization has where it connects with its employees. Touch points can range from orientation to company-wide meetings, and from technical training to employee letters and publications. It is useful for an organization to map out all of its touch points and consider whether they can serve as opportunities to train employees about the code of conduct or to reinforce ethics and compliance messages. Embedding ethics and compliance messages or training into these interactions helps to bring the code of conduct to life and makes the organization’s commitment to ethics and integrity an integral part of each employee’s work.

KPMG includes in its touch points the recruiting and interview process, where every interview is used to communicate the our values, ethical commitments and the professionalism expected should the candidate join KPMG. Additionally, every new hire is required to complete a series of training modules within her or his first months at the firm. KPMG also has found technical training to be an exceptional platform for delivering ethics and compliance messages; the training is persistent, extending anywhere from 20 to 100 hours each year, and it allows ethical issues to be presented in the context of the practical work situations actually faced by professionals every day.

Responding to Issues

The strength of an ethics and compliance program is measured in large part on how an organization responds to the reports of possible misconduct that invariably arise. There are three fundamental components for ensuring a successful response to ethics and compliance matters:
Identification: Provide multiple channels of communication for raising ethical issues and eliminate the fear of retaliation for those reporting issues.
Investigation: Ensure the consistent, fair and thorough investigation of reports.
Remediation: For substantiated reports, implement both specific and general remedial measures to mitigate the possibility of any recurrence of the behavior.

At KPMG, the primary channel of communication for raising ethics and compliance issues is an individual’s immediate supervisors and local office leadership. If the individual sees any potential conflict, she or he is encouraged to contact the Office of General Counsel, the Ethics and Compliance Group or Human Resources. It is also critical to provide an anonymous channel—and for these instances, KPMG provides both a hotline maintained by an outside vendor, and an ombudsman, who is responsible for investigating all alleged serious violations of professional standards.

Central to an ethical culture is that individuals who report issues do not experience a real or perceived threat of retaliation. KPMG’s program includes protocols to monitor for retaliatory behavior, including career tracking and regular communications with known reporters to inform them of our non-retaliation policy.

Additionally, the credibility of an ethics and compliance program requires that reports are investigated and remediated consistently. KPMG uses a software system to collect and track reports. Once a report is entered into the system, it is investigated and resolved in accordance with detailed written protocols. Information on the progress of investigations and general statistics are provided to firm leadership at set intervals, so that the adequacy of investigations and remedial measures can be assessed and trends can be identified and addressed.

Measuring Success

Although it can be challenging to measure the effectiveness of ethics and compliance programs, surveys of an organization’s personnel can be a good indicator of how well the program is doing. One of the tools KPMG has used is an integrity survey, which was first administered nationally to over 4,000 prescreened working adults to compile comprehensive national benchmark data. The results from the most recent survey of KPMG personnel show that 92 percent of respondents believe that our leaders serve as positive role models—that’s 27 percentage points higher than the national benchmark. Ninety-three percent of survey participants, twenty-eight percent higher than the national average, believe that KPMG leadership sets the right “tone at the top” on the importance of ethics and integrity.

Despite the achievements made to date, KPMG understands that a model ethics and compliance program includes a constant reevaluation and refinement of the program’s key components; it is a continuous process that requires an ongoing commitment to meet the high standards that KPMG has set for itself and its personnel.

If you would like a copy of the whitepaper, “The Road to a Model Ethics and Compliance Program,” or further information about KPMG’s ethics and compliance program, please contact Kathy Fitzgerald, Executive Director of Corporate Communications, at (201) 307-8395 or kmfitzgerald@kpmg.com.