[Editor’s Note: This is the tenth post in an ongoing series on Codes of Conduct by Jason Lunday. Follow this link to view all of Mr. Lunday’s articles in his Codes of Conduct featured column series.]
Applying process management tools can help a company to strengthen its ability to meet high standards of conduct and demonstrate this commitment to stakeholders.
As companies face greater regulations and other duties and espouse higher standard of conduct, and as stakeholders increasingly hold companies to them, they need more effective ways to demonstrate their commitment. Process management methodologies and tools offer a systematic means of providing this assurance while also helping to manage the risks that might otherwise thwart a company’s best intentions. In doing so, process management techniques should be adapted to fit the uniqueness of the ethics and compliance domain.
Company leaders continue to grapple with a number of challenges regarding ethics and compliance (referenced throughout this article as “E&C”) that undermine a company’s ability to truly demonstrate its commitment to achieving the high standards that it espouses. A principal difficulty facing companies is that many leaders miss the distinction between individual and organizational integrity. They assume that because the company hires good people, ‘ethics will manage itself’ as employees unerringly make responsible decisions. This perspective avoids the fact that organizations are complex social systems where employees are subject to peer expectations, supervisors’ authority, performance incentives, pressure from customers and additional stakeholders and many other dynamics. Thus, leaders also need to focus on organizational integrity – how systems managed by good people ensure responsible decisions.
In addition, many leaders place emphasis on setting high standards of conduct and less on how the company will meet these high standards. Some companies write impressive codes of conduct addressing ethics commitments on dozens of topics. But these codes may say little about how the company intends to achieve these standards or whether the company can or will provide assurance that it has met them. This lack of ‘full-cycle accountability’ often reflects the little that management has considered how it ensures adherence to its standards. Instead, leaders may hope that employees will rise to the occasion and, when the worst occurs, trusts that employees will always raise instances of suspected misconduct, such as through a whistleblower hotline.
If these are not enough challenges, today regulators and other company stakeholders are more aggressively pushing companies to demonstrate, or at least provide a reasonable assurance, that they can achieve and are meeting their lofty standards of conduct. These external watchers are holding companies to their commitments. We see this in the increased regulatory standards regarding compliance systems and boom of corporate responsibility reports posted on company web sites.
In short, stakeholders are holding companies to their many commitments, and many of them do not have effective means to systematically meet them. Slip-ups provide ripe opportunity for regulators, NGOs, unions and other groups to call out these companies for their ‘lack of integrity’ – for these corporate failures justifiably can be seen as a lack of organizational integrity. One definition of integrity is an organism’s wholeness, the integration of its parts as one holistic system. We expect an individual who makes a promise to not just espouse good intentions but also to take reasonable efforts to keep that promise. Such is the same with an organization – it should have a practical way to meet the promises it makes. Yet too often we hear stories of a company’s sales people who make commitments that its service staff has no realistic way of achieving. Or of R&D staff that designs a product that cannot be manufactured within budgetary constraints and quality standards. This issue also is true with E&C – a company’s ability to stand behind the standards of conduct it espouses through the design and functioning of effective processes to reasonably achieve adherence to these standards.
A central solution to these challenges lies in effective process management, both of a company’s E&C core activities and in the way E&C figures into a company’s other business activities. Process management involves the means by which a company can provide reasonable assurance that an activity will meet its objectives by methodical development, management and improvement of the way the activity is carried out. Where E&C breakdowns may lead to severe regulatory fines and other sanctions, loss of customer loyalty and business, decreased employee morale and a company’s reputational damage, the stakes could not be higher to ensure that E&C processes work.
Process management is especially relevant to E&C management for three reasons:
Process management helps to address many challenges with business activities that companies encounter when these activities are not developed systematically. These include:
The benefits that process management can provide to an E&C program parallel those it offers to any business activity. These benefits include:
For years theorists and practitioners have expounded on process management: its value, the principles that make it work and the steps involved in developing or enhancing a process. This has led to numerous approaches for which processes can be developed, managed and improved. Some basic principles for process management include the following:
While many models exist for process management, typical elements include a) planning, b) performing, monitoring and measuring, and c) improving the process.
Planning: First, a process must be carefully planned. It is important to include all relevant stakeholders in process planning; this includes functions that will have a role in managing the process, those that benefit from the process (‘the customers’) and others who will supply materials, information or other resources to the process. Also important is identifying the process’s owner – who is responsible for ensuring that the process works. Too many companies develop a process that soon breaks down because no one is accountable for it.
Staff must determine the process’s objectives, resources and constraints before developing a process workflow. It is critical to identify not just what staff considers as the most important objective but all of them. At the same time, staff should identify needed and available resources and any relevant constraints, such as time and available staff. An important step may be to identify the metrics that measure the process’s success. Metrics may include the following:
Next, staff then designs the process. This step typically involves such tools as process mapping and written procedures development. During the process design, the development team should be tested the process to ensure that it works, including stress testing to ensure it functions under challenging situations. It should review test results for actual or potential problems, errors or variations and respond to these outcomes in any tweaking of the process. Variations may include changes in employee vacations, unexpected leaves and other changes. Once staff has developed a reasonably sound process, the process should be documented (such as through process maps and procedures); this includes determining how to record process monitoring and outcome data.
Performing, Monitoring and Measuring: After the process is planned, including tested and documented, it is ready to be implemented. Prior to implementation, relevant staff must be trained to the process and their role in it. Training can be as simple as distributing the procedures to relevant staff for a simple process or more complex, such as a workshop on the process.
After training, the company is ready to implement the process. At this stage one challenge is ensuring that during the transition from an old or ad hoc to the new process any workflow or activities are not missed. For instance, when adopting a new employee conflict of interest vetting process, management should ensure the process does not overlook any new employees during the changeover.
As the new process gets underway, management should carefully monitor it, especially for any weaknesses. Unanticipated variations, exceptions or discrepancies should be identified and triaged as soon as possible. As time allows, the problem’s root cause should be identified, assessed and corrected. Responsible staff should collect required data on process performance and outcomes for archiving so that the company can demonstrate the process’s existence and effectiveness. In addition, monitoring also should involve changes in the organization or external environment that may affect the process. Periodically, management should evaluate the process’s weaknesses and organizational and external changes to determine whether they indicate a need for changes to the process itself.
Improving: Finally, process management involves improving ineffective or damaged processes or increasing a process’s overall effectiveness. For instance, a process may begin to deliver substandard outcomes, encounter unanticipated problems or become impacted by external changes. Weak or broken processes can lead to employees’ distrust, as employees find themselves held to achieving certain goals which are not realistic to attain. The process management methodology needs to care for these eventualities and effectively respond to catch possible failures and improve them. Data from monitoring activities helps indicate a broken process and needs improvement. For instance, a misconduct reporting process that indicates fewer reports of misconduct should be assessed to determine the reason for the fall off. Perhaps a problem exists with communicating about the reporting channel, or a weakness may exist in how reports are being handled.
Even well performing processes may not keep pace with the changing environment. Take, for instance, an E&C education program. If over time employees indicate that they are not as well trained to meet their job duties, the process owner should look for the reason. It could simply be that the training needs to be updated with the E&C program’s changes, such as an updated code of conduct. So, all processes need to adjust for external changes so that they remain relevant and effective.
In applying process management to E&C-specific activities, the process owner should ensure that the E&C objectives show real business value. A limited objective when first distributing the code of conduct is to ensure that employees receive it; more valuable could be to ensure that they understand the code’s contents, know how to use the code and are comfortable applying its standards to business activities. Identifying greater value of E&C activities creates interest and trust in these processes and also helps to mitigate complaints about added, ineffective bureaucracy.
When using process management to integrate E&C objectives into other business activities, additional considerations may apply. First, it is important to ensure that E&C objectives add value to the business activity itself. Effective sales communications may be modified to effective, responsible sales communications. Hiring successful agents may be changed to hiring successful, conflict-free agents. Incorporating such an objective helps mitigate the risks of later problems which could significantly slow business or damage certain relationships. Again, doing so also helps to ward off complaints of added bureaucracy.
Second, it is important to not simply layer E&C activities on top of the existing process but rather look at the process as a whole and consider how to effectively include E&C activities that make sense for the process. Using the prior example, it may be convenient to add a legal review of the sales literature prior to its final publication, but this step likely slows up the sales literature’s development, especially if the legal review identifies a significant problem. Better yet may be to include legal staff with others in the literature’s initial scoping to ensure that its development proceeds smoothly while addressing certain E&C risks.
A company may design an effective E&C process, only to see it fall apart as numerous exceptions or discrepancies arise. Or the company allows it to languish unchanged as the business around it changes, rendering it ineffective. Any well-constructed process faces risks if the company’s culture is not committed to process management. Process management must be core to an organization’s beliefs and an ongoing commitment. Central elements of a process management culture include:
Effective process management works best with a strong incentives system. When a company’s incentive system is effectively designed and managed, this can raise the quality of its process management efforts (and visa versa). Employees who recognize that their efforts are being properly evaluated and recognized are more likely to demonstrate greater trust in the role of process management. It becomes an easy win – follow the process and receive proper recognition for doing so; improve the process and win greater accolades. At the least, E&C processes should align with a company’s incentive system.
Incentive include a variety of ways in which employees’ performance is recognized, not only monetarily. It can include base compensation, variable compensation, promotion opportunities, other job opportunities (such as greater responsibilities or experience with certain assignments), formal recognition programs (such as awards) and even informal recognition that is consistently applied. Whatever the incentive structure, a company is likely to garner employees’ greater commitment process management when incentives are fairly and effectively applied.
Strong, ongoing E&C success is not happenstance; it is the culmination of efforts to systematically conduct a company’s E&C and other business activities in a managed way. Effective process management helps to ensure the ongoing effectiveness of E&C objectives in any business activity because it raises management of E&C activities to the same high standard as those of a company’s core activities, commensurate with objectives that show value, metrics that show results and improvements that sustain the processes. Such an approach to E&C management invites the trust of employees and other stakeholders because it more strongly links objectives to results and impact, and it provides leadership with a lens with which to identify problems early on, raising the chances of early correction.
Sign up for our free weekly e-newsletter for more GRC articles, job postings, GRC events, white papers & more…..click here
Jason Lunday is principal consultant with The Ethical ElementTM, a professional services firm based in Washington, DC. Jason has worked in the ethics and compliance field for over twenty years, both inside companies and as a consultant to them. His work has involved supporting corporate values initiatives, developing and revising codes of conduct and related policies, conducting organizational risk, culture and program assessments, developing and delivering live training, building monitoring systems and auditing compliance systems and activities. He has worked in or consulted with companies in a broad range of industries, including banking and insurance, manufacturing, industrial and consumer products, utilities and energy, healthcare and telecommunications. Noteworthy experience includes: