High-profile corporate scandals in recent years have seriously eroded public confidence in published financial results.Reliance on the accuracy of financial statements is essential if investors are to own equity or debt instruments of corporations. With the passage of the Sarbanes-Oxley Act in 2002 leading the way, the governance role and function of boards of directors are evolving and expanding for public and private companies, as well as nonprofit organizations.
The widespread pursuit of increased transparency and accountability is adding to the board's traditional responsibility of overseeing the actions of management by expanding activities that establish the proper "tone at the top" to ensure an ethical code of conduct, effective risk management practices and acceptable risk levels throughout the organization.
In short, the onus of guardianship over investors, lenders, suppliers and employees is being placed on the board.
Boards and ethical culture
The United States Sentencing Commission, an independent agency of the judicial branch of the government, strengthened the section of its guidelines regarding crimes by business organizations. The key aspect of the amendment, effective Nov. 1, 2004, was to change the responsibility for overseeing adherence to compliance and ethics programs from management to board members. It's a call for "an organizational culture that encourages ethical conduct and commitment to compliance with the law."
The amendment states that directors must "be knowledgeable about the content and operation of the compliance and ethics program, and shall exercise reasonable oversight with respect to the implementation and effectiveness of the compliance and ethics program."
These guidelines increased the minimum standards for corporate legal compliance and placed directors in the position of monitoring whether a company is doing all it can to meet these new standards.
The guidelines require directors to know what their corporation is doing to prevent crimes in the company. The board, its audit committee or its compliance committee have to monitor that the compliance programs are in place, are working effectively, and are revised and updated for changes in business operations and circumstances. Board members have to review reports from those individuals responsible for the ethics and compliance operations at least annually. Additionally, board members have to receive ongoing training on ethics and compliance.
The USSC amendment expands and clarifies the oversight role of boards. These guidelines apply to all boards for corporations, nonprofits and associations. Individuals invited to join a board need to be aware of this aspect of the oversight function of directors, and evaluate their own ability and willingness to fulfill such responsibilities. The time and effort commitments of board members have now increased significantly, and those willing to serve need to understand this.
Board service
CPAs are frequently asked to serve on boards. Under the American Institute of CPAs Professional Standards - Code of Professional Conduct, rules pertaining to independence, integrity and objectivity, including ethics interpretations, are promulgated to guide practitioners in their professional responsibilities. These rules help CPAs to competently fulfill their board responsibilities. Also, the expertise of CPAs often leads to an appointment to the audit committee, which now has an increased oversight role. In addition to the Code of Professional Conduct, CPAs must also apply the USSC guidelines in their board roles.
To implement expectations of integrity, responsibility and accountability at the individual and corporate level, certain steps have to be taken by boards of directors:
* Setting an ethical tone at the top;
* Promoting strong and effective internal controls;
* Providing ethics and fraud training;
* Implementing a whistleblower policy;
* Establishing a confidential hotline; and,
* Creating a culture of "doing the right thing."
Setting an ethical tone at the top is the first step in creating an organization that operates in a manner that meets requirements and expectations. The behavior of organizational leaders sets the primary example for employees in the organizations. Actions communicate standards of behavior. Slogans and lectures are superficial and ineffective without the consistent demonstration of stated beliefs. The board and top management have to exemplify the principles they wish to instill, and must consistently reinforce these policies in their behavior. Otherwise, the message gets confused and does not reach all levels in the organization.
Promoting strong and effective internal controls is a legal requirement for public companies under Sarbanes-Oxley. In addition to meeting legal requirements, establishing strong internal controls is an integral step in promoting ethical operations. Strong and effective internal controls reinforce the systems in place to ensure that accountability at all levels in the organization is monitored and adhered to. It serves as a means for the board to have confidence in implementing oversight responsibilities.
A formal ethics and fraud training process is necessary to ensure that all employees gain a clear understanding of the company's code of ethics and their specific role in this process. The training should cover ethical and appropriate operations, prevention of corporate fraud, a method for communicating concerns, and details as to what behavior is unacceptable and what the consequences of inappropriate actions will be.
A key element of effective oversight is the establishment of a whistleblower policy. The whistleblower policy builds on the organization's code of ethics and conduct. The policy should include reference to the code, what appropriate operations are, what constitutes inappropriate behavior and what are the means of communicating concerns of possible violations. A whistleblower policy usually includes confidentiality provisions and procedures for handling violations. It should also incorporate provisions to prevent reprisals against individuals reporting violations.
Establishing a confidential hotline for tips provides the means for implementing the whistleblower policy. Hotlines can be administered within the organization or handled by a separate service provider. The existence of the hotline and the number should be communicated to all employees. Employee communication needs to include a description of how tips are handled and what is investigated, and what the expected outcomes are in either substantiated or unsubstantiated improprieties.
Creating a culture of doing the right thing is a long-term process. Morality cannot be legislated, and human behaviors are complex. Implementing the steps outlined above fosters the development of a culture of doing the right thing. Ongoing monitoring is an essential element to prevent sending mixed messages.
Corporate ethics codes
Developing a code of ethics is the start of the process for meeting the requirements of organizational ethics standards. The code of ethics for each organization has to be specific to that entity's needs. There are values and compliance components of ethics codes.
Initial programs tend to be more compliance-oriented, since they were influenced by legal considerations. The evolution of ethics programs, however, is to incorporate more of the values orientation. Incorporating the traditional values of an entity may strengthen support for implementing broader ethics programs at all levels. Organizational beliefs, principles and values serve as the foundation of the programs, and the compliance components ensure operation and staff adherence.
Companies are creating ethics officer positions at the senior executive level. Ethics officers report directly to the board to ensure that board oversight covers all levels of management. They are directly responsible for implementing and monitoring ethics programs. Specific duties may include collection and analysis of data, development and interpretation of ethics policy, development and administration of ethics training and education materials, and oversight of ethics investigations. Some ethics officers are involved in the disciplinary process as well. The benefit of involvement in the disciplinary process is that it may improve consistency of application.
Ethical resurgence
Various surveys indicate that stakeholders and employees are more aware of the role of ethics in business. The list of formerly prominent companies that were damaged and, in some instances, destroyed by unethical activities is fairly long. These occurrences show that unethical corporate behavior has short-term benefit only for the perpetrators, but long-term devastating effects for the company as a whole. Ethical operations, on the other hand, are more likely to strengthen a business by retaining the trust and loyalty of customers, suppliers, employees and investors, all of whom are integral to long-term success.
Companies are revising their ethics codes, making them more detailed regarding conduct with customers, vendors, competitors, employees and investors. Companies are posting their ethics codes on corporate Web sites to create awareness for people outside the organization, not just employees. Businesses are requiring all employees to read, and then sign, the statements. Frequently, signing off is a condition of employment and retention.
Technology plays an increasing role in the monitoring process, as companies find ways to automate activities and flag possible noncompliance. The consequences of conduct not consistent with the rules may be internal review, loss of employment or even external investigation, possibly leading to legal proceedings.
The Ethics Resource Center conducts the National Business Ethics Survey of employees across the for-profit, nonprofit and government sectors in the U.S. In the fourth edition of the survey, from 2005, researchers asked employees about their perceptions of ethics and compliance at work. The data was analyzed based on the framework provided by the Federal Sentencing Guidelines for Organizations, including elements of formal programs, ethical culture, risk and the outcomes expected of an effective program.
Some of the findings were as follows: On a national level, formal programs are on the rise, but positive outcomes have not kept pace. Formal ethics and compliance programs do have an impact, but organizational culture is more influential in determining outcomes. Employees are at risk for misconduct, and where they encounter situations inviting wrongdoing, there is a high likelihood that they will also observe at least one violation taking place.
The finding that outcomes remained unchanged presents a clear challenge to directors and organization leaders for improving performance. Organizational culture develops over time, and changing the ethical aspect of the existing culture will take longer than the time frame covered by the surveys.
The study measured 18 dimensions of ethical culture, and the data show that the actions of leaders and peers significantly influence employee ethics. Employees in organizations with strong ethical cultures and formal programs were 36 percent less likely to observe misconduct than employees in organizations with weak culture and formal programs. Clearly, attention to ethics and compliance has to be supplemented by attention to culture.
Tone at the top
Investment legend Warren Buffett was once asked what he thought were the three key attributes of corporate leaders. His response was, "Integrity, intelligence and energy. Without the first, the other two will kill you." He is a living example of how successful ethical leadership can be. Integrity and, by extension, ethics enable a company to thrive and survive.
To succeed, ethics programs need high-level champions, such as the chairman of the board. A champion promotes the ethics program, ensures that resources and staff are dedicated, and enhances the credibility of the role of ethics in the organization.
A leader's active participation is essential to creating an ethical culture in the organization. Active participation includes demonstrating ethical behaviors, talking with employees and others about the importance of ethics in the organization's success, being willing to address difficult issues, and serving on ethics oversight committees. Ethical leaders understand that their actions and decisions communicate symbolically as well as literally.
Conclusion
Responsibility for ethics oversight at the board level is now established, and it clearly requires a multifaceted approach. The execution involves setting the tone for ethical expectations at the top, making sure that ethics programs are implemented throughout the organization, ensuring that appropriate training and communication is continual, establishing sanctions for misconduct, and administering them according to policies.
Ibolya Balog, CPA, is a senior manager with Parente Randolph LLC and a member of the PICPA Professional Ethics Committee. Reach her at ibalog@parentenet.com. Reprinted with permission from The Pennsylvania CPA Journal.
