Strengthening Ethics through Better Process Management

Applying process management tools can help a company to strengthen its ability to meet high standards of conduct and demonstrate this commitment to stakeholders.

As companies face greater regulations and other duties and espouse higher standard of conduct, and as stakeholders increasingly hold companies to them, they need more effective ways to demonstrate their commitment.  Process management methodologies and tools offer a systematic means of providing this assurance while also helping to manage the risks that might otherwise thwart a company’s best intentions.  In doing so, process management techniques should be adapted to fit the uniqueness of the ethics and compliance domain.

Challenges with Managing Ethics & Compliance

ethics-process-managementCompany leaders continue to grapple with a number of challenges regarding ethics and compliance (referenced throughout this article as “E&C”) that undermine a company’s ability to truly demonstrate its commitment to achieving the high standards that it espouses.

A principal difficulty facing companies is that many leaders miss the distinction between individual and organizational integrity.  They assume that because the company hires good people, ‘ethics will manage itself’ as employees unerringly make responsible decisions. This perspective avoids the fact that organizations are complex social systems where employees are subject to peer expectations, supervisors’ authority, performance incentives, pressure from customers and additional stakeholders and many other dynamics.

Thus, leaders also need to focus on organizational integrity – how systems managed by good people ensure responsible decisions.

In addition, many leaders place emphasis on setting high standards of conduct and less on how the company will meet these high standards. Some companies write impressive codes of conduct addressing ethics commitments on dozens of topics.  But these codes may say little about how the company intends to achieve these standards or whether the company can or will provide assurance that it has met them. This lack of ‘full-cycle accountability’ often reflects the little that management has considered how it ensures adherence to its standards.

Instead, leaders may hope that employees will rise to the occasion and, when the worst occurs, trusts that employees will always raise instances of suspected misconduct, such as through a whistleblower hotline.

If these are not enough challenges, today regulators and other company stakeholders are more aggressively pushing companies to demonstrate, or at least provide a reasonable assurance, that they can achieve and are meeting their lofty standards of conduct.  These external watchers are holding companies to their commitments.  We see this in the increased regulatory standards regarding compliance systems and boom of corporate responsibility reports posted on company web sites.

In short, stakeholders are holding companies to their many commitments, and many of them do not have effective means to systematically meet them.  Slip-ups provide ripe opportunity for regulators, NGOs, unions and other groups to call out these companies for their ‘lack of integrity’ – for these corporate failures justifiably can be seen as a lack of organizational integrity.

One definition of integrity is an organism’s wholeness, the integration of its parts as one holistic system.  We expect an individual who makes a promise to not just espouse good intentions but also to take reasonable efforts to keep that promise. Such is the same with an organization – it should have a practical way to meet the promises it makes. Yet too often we hear stories of a company’s sales people who make commitments that its service staff has no realistic way of achieving.  Or of R&D staff that designs a product that cannot be manufactured within budgetary constraints and quality standards.

This issue also is true with E&C – a company’s ability to stand behind the standards of conduct it espouses through the design and functioning of effective processes to reasonably achieve adherence to these standards.

The Process Management Solution

A central solution to these challenges lies in effective process management, both of a company’s E&C core activities and in the way E&C figures into a company’s other business activities.  Process management involves the means by which a company can provide reasonable assurance that an activity will meet its objectives by methodical development, management and improvement of the way the activity is carried out.

Where E&C breakdowns may lead to severe regulatory fines and other sanctions, loss of customer loyalty and business, decreased employee morale and a company’s reputational damage, the stakes could not be higher to ensure that E&C processes work.

Process management is especially relevant to E&C management for three reasons:

  • Pervasiveness. E&C issues figure into all business activities. Ethics and compliance issues pervade all aspects of a company’s operations.
  • Interdependency. By nature, E&C is interdependent – it typically involves employees throughout a company, and often may include other external constituents. This adds to its complexity and, therefore, difficulty in ensuring achievement of E&C objectives.
  • Need for metrics. An oft-voiced concern about E&C management is how to ‘prove a negative’, or how to demonstrate that an E&C program is effective simply because the company has not been criminally charged. Process management applied to E&C activities helps to assure leaders and other stakeholders of effective E&C management. An added benefit includes garnering buy-in from company staff regarding the importance of E&C objectives because E&C activities are held to the same high standard as other business processes.

Process management helps to address many challenges with business activities that companies encounter when these activities are not developed systematically.  These include:

  • Impracticality. A business activity may turn out to be impractical.  Perhaps it is developed exclusively to address a new law’s requirements but not to effectively function with other business activities. Or maybe the business activity does not include any way to determine its effectiveness, so employees discount it because they see no benefit to it.
  • Costs. Business activities may be more expensive in cost, labor and other resources than they need to be had they been carefully planned. This is a typical trap for companies that face severe regulatory sanctions that end up throwing money without regard at a solution to please regulators.  Often, a better solution is available that is more effective and involves fewer resources.
  • Layering. Many companies simply add on E&C steps to existing processes without considering how the changes will affect the core activity. Usually, the new E&C additions slow down the activity or make it less effective and so increase employees’ disdain for compliance because of the extra work and less efficiency.
  • Mismatch. New compliance activities often are instituted with little regard for the level of related risk and complexity of the underlying business activity. Perhaps management sees a certain solution as a common industry practice or acquires it from a service provider and so assumes it should work. In fact, the compliance solution needs to fit the business activity’s risk profile and other characteristics and needs.
  • Breakage. Commonly, new compliance processes become ineffective when related processes change, the organization undergoes restructuring or simply employees move on.  The compliance activity is not designed to respond to the changes that are increasingly common in companies.

The benefits that process management can provide to an E&C program parallel those it offers to any business activity. These benefits include:

  • Processes that provide assurance of working. Leadership can count on the process to effectively function and be largely error free. It does not constantly need to look over its shoulder to ensure that the process still exists. This is a distinction between project management and process management. For instance, a company may project manage employees’ annual acknowledgement of the code of conduct. But unless this activity is an ongoing process, one cannot provide assurance that it will be completed in consecutive years.
  • Processes that demonstrate effectiveness. Obviously, an activity designed to achieve specific metrics provides greater assurance that it will meet them. While an early-stage process may begin with simple metrics, such as those to demonstrate that the activity was completed or that employees value it, nonetheless, this sets the stage for even more effective metrics.
  • Processes that handle exceptions and deviations. No process can be designed to address all eventualities.  Still, a process can be developed to handle reasonably anticipated exceptions, deviations and other anomalies. For instance, a process can developed to function when key employees take vacation or sick leave, whether it cares for legitimate policy exceptions or whether it signals improper deviations. A good process plans for these eventualities.
  • Processes that correct errors and improve. Effective process management cares for errors that occur – it corrects these errors and then improves to mitigate future errors.
  • Processes that evolve. Leadership can count on the business activity to modify and improve based on changing conditions to the business or external environment.

The Basics of Process Management

process-managementFor years theorists and practitioners have expounded on process management: its value, the principles that make it work and the steps involved in developing or enhancing a process. This has led to numerous approaches for which processes can be developed, managed and improved.  Some basic principles for process management include the following:

  • A process should be focused on creating value for its customers, whether they are purchasers of an end product or internal employees who are served by a process’s outcome.
  • Process development should engage with those constituents who are likely to be involved in the process or are closely affected by it to ensure that the process’s design does not miss key needs.
  • To be managed, a process must measured.  Metrics are central to process management.
  • A process is interdependent in that it typically relates to or is integrated in other processes, so it should be designed to work with these processes.
  • All processes can be improved upon and so continuous improvement is an expectation of process management.

While many models exist for process management, typical elements include a) planning, b) performing, monitoring and measuring, and c) improving the process.

Planning

First, a process must be carefully planned. It is important to include all relevant stakeholders in process planning; this includes functions that will have a role in managing the process, those that benefit from the process (‘the customers’) and others who will supply materials, information or other resources to the process.  Also important is identifying the process’s owner – who is responsible for ensuring that the process works. Too many companies develop a process that soon breaks down because no one is accountable for it.

Staff must determine the process’s objectives, resources and constraints before developing a process workflow. It is critical to identify not just what staff considers as the most important objective but all of them. At the same time, staff should identify needed and available resources and any relevant constraints, such as time and available staff.  An important step may be to identify the metrics that measure the process’s success. Metrics may include the following:

  • The activity’s completion, such as acknowledgment by all employees their duties regarding a company’s code of conduct.
  • The activity’s effectiveness on employees; for instance, whether employees can identify conflicts of interest after completing conflict of interest training.
  • The activity’s impact, such as whether a company’s customers perceive more accurate and honest sales literature or employees indicate greater fairness in promotion decisions.

Next, staff then designs the process.  This step typically involves such tools as process mapping and written procedures development. During the process design, the development team should be tested the process to ensure that it works, including stress testing to ensure it functions under challenging situations. It should review test results for actual or potential problems, errors or variations and respond to these outcomes in any tweaking of the process. Variations may include changes in employee vacations, unexpected leaves and other changes. Once staff has developed a reasonably sound process, the process should be documented (such as through process maps and procedures); this includes determining how to record process monitoring and outcome data.

Performing, Monitoring and Measuring

After the process is planned, including tested and documented, it is ready to be implemented. Prior to implementation, relevant staff must be trained to the process and their role in it. Training can be as simple as distributing the procedures to relevant staff for a simple process or more complex, such as a workshop on the process.

After training, the company is ready to implement the process. At this stage one challenge is ensuring that during the transition from an old or ad hoc to the new process any workflow or activities are not missed.  For instance, when adopting a new employee conflict of interest vetting process, management should ensure the process does not overlook any new employees during the changeover.

As the new process gets underway, management should carefully monitor it, especially for any weaknesses. Unanticipated variations, exceptions or discrepancies should be identified and triaged as soon as possible. As time allows, the problem’s root cause should be identified, assessed and corrected.  Responsible staff should collect required data on process performance and outcomes for archiving so that the company can demonstrate the process’s existence and effectiveness.

In addition, monitoring also should involve changes in the organization or external environment that may affect the process.  Periodically, management should evaluate the process’s weaknesses and organizational and external changes to determine whether they indicate a need for changes to the process itself.

Improving

Finally, process management involves improving ineffective or damaged processes or increasing a process’s overall effectiveness. For instance, a process may begin to deliver substandard outcomes, encounter unanticipated problems or become impacted by external changes. Weak or broken processes can lead to employees’ distrust, as employees find themselves held to achieving certain goals which are not realistic to attain.

The process management methodology needs to care for these eventualities and effectively respond to catch possible failures and improve them. Data from monitoring activities helps indicate a broken process and needs improvement. For instance, a misconduct reporting process that indicates fewer reports of misconduct should be assessed to determine the reason for the fall off. Perhaps a problem exists with communicating about the reporting channel, or a weakness may exist in how reports are being handled.

Even well performing processes may not keep pace with the changing environment.  Take, for instance, an E&C education program. If over time employees indicate that they are not as well trained to meet their job duties, the process owner should look for the reason. It could simply be that the training needs to be updated with the E&C program’s changes, such as an updated code of conduct. So, all processes need to adjust for external changes so that they remain relevant and effective.

Applying Process Management to E&C Activities

In applying process management to E&C-specific activities, the process owner should ensure that the E&C objectives show real business value. A limited objective when first distributing the code of conduct is to ensure that employees receive it; more valuable could be to ensure that they understand the code’s contents, know how to use the code and are comfortable applying its standards to business activities. Identifying greater value of E&C activities creates interest and trust in these processes and also helps to mitigate complaints about added, ineffective bureaucracy.

When using process management to integrate E&C objectives into other business activities, additional considerations may apply. First, it is important to ensure that E&C objectives add value to the business activity itself. Effective sales communications may be modified to effective, responsible sales communications. Hiring successful agents may be changed to hiring successful, conflict-free agents. Incorporating such an objective helps mitigate the risks of later problems which could significantly slow business or damage certain relationships. Again, doing so also helps to ward off complaints of added bureaucracy.

Second, it is important to not simply layer E&C activities on top of the existing process but rather look at the process as a whole and consider how to effectively include E&C activities that make sense for the process. Using the prior example, it may be convenient to add a legal review of the sales literature prior to its final publication, but this step likely slows up the sales literature’s development, especially if the legal review identifies a significant problem.  Better yet may be to include legal staff with others in the literature’s initial scoping to ensure that its development proceeds smoothly while addressing certain E&C risks.

A Process Culture

process management ethics complianceA company may design an effective E&C process, only to see it fall apart as numerous exceptions or discrepancies arise.  Or the company allows it to languish unchanged as the business around it changes, rendering it ineffective.  Any well-constructed process faces risks if the company’s culture is not committed to process management. Process management must be core to an organization’s beliefs and an ongoing commitment.  Central elements of a process management culture include:

  • Leadership commitment to process management. Commitment starts here; if leadership does not care, there is little chance that most employees will.
  • Employee education about how to design and maintain effective processes and then improve them.  If a company is really committed to effective process management, it wants to ensure that all employees have at least some familiarity with it and that those responsible for processes can develop, maintain and improve them.
  • The tools and other resources for process management, including technologies. These tools can be as simple as software for process mapping and procedures authorship or more complex, such as workflow applications.
  • Consistent application of the company’s process management methodology across all businesses, functions and geographies. The more that process management is ingrained in a company’s operating environment, the greater the expectation for employees to adopt and follow it and the better it becomes part of the employee evaluation and recognition systems.

Effective process management works best with a strong incentives system. When a company’s incentive system is effectively designed and managed, this can raise the quality of its process management efforts (and visa versa). Employees who recognize that their efforts are being properly evaluated and recognized are more likely to demonstrate greater trust in the role of process management. It becomes an easy win – follow the process and receive proper recognition for doing so; improve the process and win greater accolades. At the least, E&C processes should align with a company’s incentive system.

Incentive include a variety of ways in which employees’ performance is recognized, not only monetarily. It can include base compensation, variable compensation, promotion opportunities, other job opportunities (such as greater responsibilities or experience with certain assignments), formal recognition programs (such as awards) and even informal recognition that is consistently applied.  Whatever the incentive structure, a company is likely to garner employees’ greater commitment process management when incentives are fairly and effectively applied.

Summary

Strong, ongoing E&C success is not happenstance; it is the culmination of efforts to systematically conduct a company’s E&C and other business activities in a managed way.  Effective process management helps to ensure the ongoing effectiveness of E&C objectives in any business activity because it raises management of E&C activities to the same high standard as those of a company’s core activities, commensurate with objectives that show value, metrics that show results and improvements that sustain the processes.

Such an approach to E&C management invites the trust of employees and other stakeholders because it more strongly links objectives to results and impact, and it provides leadership with a lens with which to identify problems early on, raising the chances of early correction.

About the Author

Jason Lunday

Jason Lunday is principal consultant with The Ethical ElementTM, a professional services firm based in Washington, DC. Jason has worked in the ethics and compliance field for over twenty years, both inside companies and as a consultant to them.  His work has involved supporting corporate values initiatives, developing and revising codes of conduct and related policies, conducting organizational risk, culture and program assessments, developing and delivering live training, building monitoring systems and auditing compliance systems and activities. He has worked in or consulted with companies in a broad range of industries, including banking and insurance, manufacturing, industrial and consumer products, utilities and energy, healthcare and telecommunications. Noteworthy experience includes:

  • Held significant roles in corporate culture and ethics and compliance risk assessments and ethics and compliance program evaluations for companies in financial services, telecommunications, healthcare, life sciences and industrial manufacturing and involving document review, executive interviews, employee focus group and enterprise surveys.
  • Led development and of a consulting practice’s service line focused on written codes of conduct development and revision, and managed all client engagements.
  • Co-managed development and delivery of the corporate trust division of a large financial institution’s initial ethics and compliance global training initiative involving training needs assessment, program development and delivery of over 100 classroom workshops.
  • Developed a corporate ethics and compliance self-monitoring program designed to increase business line compliance responsibility and oversight and minimize corporate compliance work processes while ensuring adherence to the company’s ethics and compliance standards.
Jason’s past experience includes director of ethics and compliance at Premier, Inc., consultant in Arthur Andersen’s Ethics and Responsible Business Practices Consulting group, compliance analyst at Goldman, Sachs & Co., senior consultant in the Ethics Resource Center’s Advisory Services group and knowledge leader at LRN Corp. In addition, he has authored/co-authored numerous articles and papers on business ethics issues. Jason holds an MBA from the University of Virginia’s Darden Graduate Business School, with a focus in business ethics and organizational behavior, a BA also from the University of Virginia and additional business coursework at the New York Institute of Finance. Jason can be contacted via email at: jason.lunday [at] ethicalelement [dot] com. Follow the link to view Jason's Code of Conduct featured column on CCI.