An organisation boasting high ethical standards is found to be cutting corners when it comes to documenting internal controls.
A culture of compliance
Dilemma: You have recently commenced employment with a new organisation. Prior to accepting the position you enquired about the 'culture' of the organisation. You were informed that the organisation pro-moted high ethical standards and conduct supported by policies, procedures, codes, management structures and processes. However, in your first few weeks of employment you realise that although there are strict formal policies and procedures, compliance is not always observed. In particular, you are concerned that documented internal controls are being circumvented, increasing the risk of fraud to the organisation. What should you do?
Often compliance with internal controls is seen as a burden rather than a positive activity, and therefore establish-ing a culture of compliance is not an easy task. The behavioural aspects of an organisation determine whether a culture of compliance exists, an essential factor for achieving effective internal controls. This culture is determined by attitudes and values of individuals and accordingly it is important that the leaders within the organisation display the necessary values of integrity, transparency and fairness, not only in documented policies and procedures, but through their actions. These essential qualities and values need to be reflected throughout the whole organisation and can only be achieved through continual reinforcement of appropriate behaviours.
The most important factors in creating a culture of compliance are management's commitment to high standards of ethical behaviour, attention to compliance issues, and swift response to violations of policy and internal control weaknesses.
Despite the well established relationship between organisational culture and successful risk management, there are many examples of corporate failures due to poor ethical standards. Enron and WorldCom had codes of ethics, and extensive internal controls, but these failed and resulted in unethical conduct.
Companies should be wary of operating in an environment with lax and unquestioning line management, poor adherence to risk management systems and controls, and weaknesses in internal governance procedures. Shortcomings should not be overlooked just because the company is turning a profit.
The importance of excellence in three interacting areas should not be underestimated: governance, culture and risk management controls. It will be interesting to understand whether the recent losses suffered by Societe Generale in France resulted from the problems just mentioned.
If you find yourself in a situation in which you are confronted by apparent breaches in internal control procedures, it is important that you address your concerns to management. Not reporting non-compliance amounts to withholding information by those in authority who are responsible for the management of the organisation and the wellbeing of its employees. In the first instance, a discussion with your immediate manager would be appropriate; hopefully this is part of a well documented regime for reporting such issues. This will also give you a true indication of management's commitment to encouraging a 'culture of compliance'.
Employees do not always have the moral courage to report what they observe for fear of retaliation and skepti-cism that their reporting will have no impact. This behaviour is supported by a recent survey undertaken by the Ethics Resource Center. The 2007 National business survey interviewed approximately 2000 employees in both private and public companies in the US and found that 56 per cent of employees surveyed had personally observed violations of company ethics standards, policy and even the law; yet 42 per cent of those who witnessed the misconduct did not report it. Many justified their actions by arguing that reporting a breach would not bring corrective action.
More disturbing is the finding that the number of companies with a weak ethical culture is as high now as before Enron and the passage of the Sarbanes-Oxley Act of 2002. In addition the number of companies that are successful in incorporating a strong organisation-wide ethical culture into their business has declined since 2005, with only 9 per cent of companies having a strong ethical culture.
These findings underline both the difficulties in achieving a culture of compliance and the need for organisations to embed appropriate values and ethical behaviour through adequately resourced education and training, supported by a management which leads by example.
Dilemma answered by Tiina-Liisa Sexton, CPA Australia's ethics adviser.
