Global Enforcement Outlook: conduct risk and corporate culture in and beyond the pandemic

As we have noted elsewhere in our Global Enforcement Outlook series, we expect to see rising enforcement activity over the next year, as companies and authorities emerge from the pandemic. At the same time, many workplaces have changed dramatically during the pandemic, due in part to the extended periods of remote work.  These converging trends are likely to raise questions about corporate culture and compliance as we all return to a physical workplace.

Here we look at some of the changes brought about by the pandemic that may place pressure on corporate culture, how enforcement agencies view the issue, and some steps companies can take to (re-)focus efforts on culture and conduct in an effective way, both to address risk and develop a thriving workplace.

The factors underlying poor conduct 

Individual conduct is at the heart of many compliance risks companies face, including potential financial crime, interpersonal misconduct, data breaches and ESG-related violations within their operations or supply chains. However, corporate crises or incidents of misconduct are likely to occur more often if there are broader, underlying cultural issues that enable or encourage an attitude of non-compliance or poor decision-making. Understanding how the pandemic may contribute to these risks is an important first step in addressing them.

Sustained home working has had an impact on a large portion of the corporate workforce.  Newly hired employees may not have had the chance to experience the company’s cultural and ethical expectations. Systems and controls, designed with a view to work taking place on the companies’ premises, might not be as robust in an entirely remote or hybrid environment. Cyber threats and the risk of data leaks, for example, may be more pronounced. Economic uncertainty and challenges in doing business in the current climate, for example given the pressures on supply chains, may taint individual decision-making.

Efforts to support a ‘speak-up’ culture within companies may also have been hampered by long periods of remote working. For some, not seeing trusted colleagues face to face on a regular basis, in whom they can confide, could create a psychological barrier to reporting concerns. Despite the increased focus on whistleblowing, our 2020 whistleblowing survey showed a global decline in the extent to which employees spoke up and in employees’ confidence in internal whistleblowing systems and senior management support. The survey results suggest that there may be complaints that have not been aired and that workplaces may benefit from encouraging more speaking up (and potentially rethinking their whistleblowing arrangements in light of changes to the working environment). Failing to address this could increase the risk that companies may be unaware of nascent issues and therefore unable to address them.

Enforcement agencies putting company culture under the microscope

There are various examples of prosecutors and regulators focusing on corporate culture, and many shareholders cite issues with company culture when bringing derivative and other claims against companies and their boards. Understanding these external factors can be helpful in driving senior management engagement.

For example, in a virtual keynote address on significant corporate enforcement policy changes in November 2021, the US Deputy Attorney General Lisa O. Monaco made clear that ‘corporate culture matters, [and a] corporate culture that fails to hold individuals accountable, or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results.’  Private plaintiffs are also increasingly focusing on cultural deficits. In the US, a number of shareholder derivative lawsuits have been filed in state and federal courts around the country seeking to hold directors and C-suite officers accountable for alleged failures to promote diversity, gender equity, and a robust corporate culture that targets wrongdoing in all forms.

Prosecutors in many European jurisdictions will also look at corporate culture when considering whether to pursue enforcement action against a company. Similarly in the UK, the FCA published guidance on remote and hybrid working in October 2021, which also focuses on culture as a way of promoting good corporate conduct. The importance of culture as a risk management tool and a driver of good conduct (and good customer outcomes) has been underlined by the FCA for several years.  This, in turn, means that there is significant focus on the efforts made by management to foster a strong compliance culture.

Steps to promote a good compliance culture 

Against this backdrop, companies may benefit from assessing their approach to building a culture of compliance and evaluating whether a refresh is warranted.  For example, companies may wish to:

1. Provide (renewed) compliance trainings (in person and/or online). After a long period where attention may have been focused in other areas, many employees may need a refresher on some of the basics. For example, as people return to industry conferences, they may welcome a reminder on myriad subjects, including expectations around appropriate workplace interpersonal conduct, a reminder of guidelines regarding gifts and entertainment and a refresher of anti-bribery and corruption policies, and how to ensure conversations stay on the right side of competition laws.
2. Find additional opportunities, beyond training, to regularly communicate expectations to employees.  For example, could managers be encouraged to find opportunities to discuss ethics and compliance as part of ‘business as usual’ activities (similar to how some industries, like construction or manufacturing, have ‘health and safety’ moments within team meetings)?
3. Review whistleblowing procedures. Over the coming year, many more EU member states will implement the 2019 EU Directive on the protection of reporting persons (having already missed the December 2021 deadline for doing so). This may create some challenges for global companies. For example, some global businesses may face potential operational challenges and conflicting views on what exactly the Directive means for their existing whistleblowing systems and obligations under other (non-EU) rules, such as the US Sarbanes-Oxley regime. Many businesses are planning to or have already updated the relevant policies and systems to comply with the main provisions of the Directive. This creates an opportunity to promote a speak-up culture, including at the highest levels.
4. Consider what insights on culture may be drawn from available data. Sometimes an accumulation of smaller incidents or ‘near misses’ can indicate a wider issue with culture. As a first step, companies may want to consider what data is already available that might allow them to start spotting patterns if viewed holistically – for example, information emerging from exit interviews, whistleblowing channels and HR-related complaints. 
5. As people return more regularly to their offices, there is an opportunity to work together — ensuring a diversity of views can help spot issues and support ethical decision-making. Efforts by legal and compliance teams to engage with business and other functions, whether that is in person or online, will help establish a thriving corporate culture as many businesses return to the office.

These steps will help companies develop strong corporate cultures as many of us return to the office for the first time in a real way since the pandemic began, or learn to adapt to longer-term hybrid working.  While much is in flux, it is a good time to remind employees of key policies and to address compliance risks. In addition, compliance and legal personnel should continue to follow best practices when reviewing global conduct risks, including taking steps to maximize privilege protections and avoid infringing data privacy and other protections in global matters.