CEP Magazine (July 2024)
Writing, implementing, and enforcing strong compliance-related policies is critical to any compliance and ethics program. So, why do so many compliance failures occur due to breakdowns in internal controls?
Of course, the answer to this question is complicated. However, one factor appears on a recurring basis: employees skip or take shortcuts on essential compliance steps. This is not (usually) because they have any malicious intentions.
The real reason is likely because we never explained why essential steps are so important.
There is a natural gradual degradation in internal controls over time. It’s natural because people are human, and we all need reminders on occasion. Faced with time pressures and competing demands, it’s amazing how easy it is to rationalize omitting or modifying a procedure, especially when taking such a step doesn’t produce an obvious or immediate side effect. No matter how clear or well-written a policy or procedure is, reinforcement is needed. This comes through on-the-job workplace communication as well as periodic training.
One thing sometimes lacking in communications and training is the explanation of why a particular step is critical. We’d like to think an explanation of why something is required shouldn’t be necessary in itself. But the fact of the matter is that people make decisions based on a variety of factors, and one of them can be a perception of how significant something is.
The why for compliance controls doesn’t have to entail a lengthy history of what led to their creation. In fact, often, the most vital element to explain is where this step fits in with the overall goal of compliance. Seeing the bigger picture sometimes results in the lightbulb moment, when someone realizes how something fits into a larger system and its important goals.
Incorporating the why into compliance training, department meetings, and other communications provides perspective and reminds everyone that there are reasons behind our policies and procedures; these reasons are consistent with the organization’s overall goals and objectives. And if you can’t come up with a why for some policies and procedures, that tells you something else.
[View source.]