No CEO is going to walk into the compliance office and disclose an affair, least of all one with a suspected foreign spy who works at a client. CCI columnist Mary Shirley uses the Nvidia scandal to walk through the CEO risks compliance can’t fully control but shouldn’t ignore.
By now, you’ve likely seen the company-wide apology Nvidia CEO Jensen Huang sent his staff and his family, since made public, for an extramarital affair. A CEO indiscretion like this is almost par for the course, and usually the worst of it is a conflict of interest: the person at the very top involved with a subordinate, or at least someone with less organizational authority.
Huang’s case goes further. His affair partner is a suspected spy, reportedly sent by China, who works at one of Nvidia’s clients. Now it’s a national security problem.
The spy twist makes Nvidia an outlier, but the questions Huang’s case raises about CEO risk are not, and every compliance practitioner should be able to answer them for their own organization.
The undisclosed conflict of interest
In theory, our conflict of interest policy and disclosure process is supposed to vet personal relationships with customers. The problem is, no CEO is going to proactively sit down at their desk and write to compliance to advise that they’re engaging in a romantic liaison with someone who is not their spouse, regardless of the egregiousness of the conflict. In fact, the more egregious the conflict, the less likely the CEO is going to disclose this information to anyone else, particularly professional contacts. So what are compliance departments to do in this situation? Build your robust conflicts program anyway, just don’t rely on it to detect these types of issues.
Possibly the most likely detection control in your arsenal will be your hotline. We saw this play out in color in the 2013 GlaxoSmithKline case in China when a whistleblower sent surreptitiously recorded adult footage of the head of the China business engaging in extramarital activity, accompanied by corruption allegations. Which leads us t o…
Compliance officer retaliation
Investigating the CEO of your organization is not for the faint of heart. In and of itself, it can be a conflict of interest. This individual may be your boss, or perhaps worse, your skip-level boss. Pav Gill knows this kind of risk first hand. He was working at Wirecard when an anonymous fraud allegation came in from a whistleblower. Gill led the investigation as a member of the compliance department and when he reported the identified fraud, he was pressured to the extent that he felt he had to leave the company for his own safety.
Gill has made the astute point that non-retaliation policies and stances should not just cover those who speak up. It should also cover those whose job it is to investigate whistleblower allegations. I like to emphasize that non-retaliation is for those who cooperate with compliance processes, so that includes witnesses, compliance staff and original whistleblowers. Essentially anyone who continues, in good faith, to make their voice heard. Compliance officers should get their managers and boards comfortable with that understanding. Chief compliance officers in particular should be bold about asking for a contract during the hiring process. It’s for your own protection should you find yourself in a situation like this. Additionally, shape your relationship and communication funnels with the board so that you have an established avenue to go through in a worst-case scenario in which you must go over the head of the CEO or other leadership with more authority than you.
Another step the savvy compliance professional can take is to enshrine your right to independently go to external counsel at your discretion into your compliance charter. Bringing in outside counsel to assist with a sensitive investigation elevates it and adds a degree of buffering given an objective third party expert agrees that something is wrong in a situation where you have substantiated a report.
The Incredible Shrinking Compliance Officer
When the mandate grows and the headcount doesn't, we have more options than we think
Read moreDetailsIndependence of investigation
Nvidia’s board of directors is conducting an investigation, and Huang has indicated he will cooperate. However, the average Nvidia board member has served for just under 15 years, which is nearly twice as long as the S&P norm. Two of the directors charged with overseeing the investigation have served alongside Huang since the company was founded 33 years ago.
In this situation, there is a perception challenge regarding directors’independence. The fix is to build independence into your protocols ahead of time: a disciplinary framework that requires, for certain senior roles, that an independent external counsel or outside body lead any investigation. That may very well be what happens in the Nvidia case; I’m sure we’ll learn more in due course.
Additionally, from a governance standpoint, board members should be reviewed on an annual basis and where evaluations indicate that there are ineffective members, they should be replaced. Succession planning for senior staff is an expected part of the board member role. Which brings us to …
Key individual risk
Huang is the epitome of a key individual. He is thought to be largely responsible for the success of Nvidia, which throws a wrench in the works if he were to be terminated as the result of disciplinary action.
Operational risks don’t always fall under compliance, but it is entirely within the realm of reason for compliance officers to include business continuity prompts in risk assessment exercises to nudge them to surface if the board hasn’t done a good job of working on this.
The Nvidia case is an extreme one in that a future CEO’s misconduct is less likely to have the possible spy component to it, but it does raise questions that every compliance officer should spend time considering, because they could theoretically happen in your organization. Take, for example, a potentially well-intentioned but tone-deaf communication from your CEO, which seems to happen with some regularity across industries. The lessons are broadly applicable: There may be some governance risks that we don’t necessarily own or have a great deal of control over in compliance, but there are some steps we can take to better preserve independence and protect ourselves and our organizations.
