Corporate culture:

The second ingredient in a

world-class ethics and
compliance program
 A culture of ethics and compliance is at the core of a strong risk management program
In a business environment where reputational threats lurk around every corner, a strong culture of ethics and compliance
is the foundation of a robust risk management program. The lessons learned related to scandals and organizational crises
that trace back to the early 2000s make one thing clear: without an ethical and compliant culture, organizations will
always be at risk.

As a fundamental component of an effective ethics and compliance program, culture is now referenced by the
U.S. Federal Sentencing Guidelines, which include expectations for organizations to promote an “organizational
culture that encourages ethical conduct” and “compliance with the law.” Furthermore, the Organisation for Economic
Co-operation and Development’s (OECD’s) Convention on Combating Bribery of Foreign Public Officials in International
Business Transactions refers to the importance of a strong culture of organizational ethics. More and more, culture is
moving from a lofty, “squishy” concept to something that should be defined, measured, and improved (see figure 1).

Continuous Governance and

Improvement Leadership

Risk
Third-party Assessments
Compliance and Due
Diligence

Culture of
Ethics and Standards,
Testing and Compliance Policies, and
Monitoring
Procedures

Case Management Training and

and Investigations Communications
Employee
Reporting

Figure 1: Culture is the foundation

The Deloitte Ethics and Compliance Framework recognizes that an ethical culture is the core element of an organization’s
ethics and compliance program. If the culture of the organization does not support principled performance, then all of the
people, processes, and technologies that are put in place to mitigate ethics and compliance risks cannot be effective.

2
Culture has always been important to how organizations • Consistency of messaging: Operational directives
operate. So why is it getting so much attention lately? One and business imperatives align with the messages from
reason is that regulators have come to the realization that leadership related to ethics and compliance.
without a culture of integrity, organizations are likely to view • Middle managers who carry the banner: Front-line
their ethics and compliance programs as a set of check- and mid-level supervisors turn principles into practice.
the-box activities, or even worse, as a roadblock to achieving They often use the power of stories and symbols to
their business objectives. In fact, organizations responsible promote ethical behaviors.
for some of the most egregious acts of malfeasance have • Comfort speaking up: Employees across the
had quite impressive, formalized ethics and compliance organization are comfortable coming forward with legal,
guidelines. The problem was that either leadership or a compliance, and ethics questions and concerns without
group of influential insiders operated outside of those fear of retaliation.
guidelines. • Accountability: Senior leaders hold themselves and
those reporting to them accountable for complying with
What is “culture”? the law and organizational policy, as well as adhering to
Culture is one of the biggest determinants of how shared values or organizational values.
employees behave. Strong cultures have two common • The hire-to-retire life cycle: The organization recruits
elements: there is a high level of agreement about what is and screens employees based on character, as well
valued, and a high level of intensity with regard to those as competence. The on-boarding process steeps new
values. Of course, not all cultures encourage good or ethical employees in organizational values, and mentoring also
behaviors. When it comes to developing world-class ethics reflects those values. Employees are well-treated when
and compliance programs, the starting point is a positive they leave or retire, creating colleagues for life.
culture of integrity. • Incentives and rewards: The organization rewards and
promotes people based, in part, on their adherence to
Given the regulatory focus on fostering an ethical culture, ethical values. It is not only clear that good behavior
many organizations are conducting assessments leveraging is rewarded, but that bad behavior (such as achieving
internal and/or external resources to review their overall results regardless of method) can have negative
programs to ensure both ethics and compliance are consequences.
addressed. • Procedural justice: Internal matters are adjudicated
equitably at all levels of the organization. Employees
The balance of this article will provide practical guidance for may not always agree with decisions, but they will
leaders to consider in creating a culture of integrity. accept them if they believe a process has been fairly
administered.
Grounding a culture in integrity
A culture of integrity is generally characterized by: Organizations with strong positive cultures create trusting
relationships with stakeholders. In our experience, those
• Organizational values: A set of clear values that, among
relationships become reciprocal; that is, stakeholders trust
other things, emphasizes the organization’s commitment
the organization and the brand. This creates employee,
to legal and regulatory compliance, integrity, and
customer, and supplier loyalty. A strong culture helps to build
business ethics.
positive relationships with regulators and it helps attract
• Tone at the top1: Executive leadership and senior As used in this document,
long-term investors. Ultimately, a culture of integrity is “Deloitte” means Deloitte LLP
managers across the organization encourage employees
reflected in superior, long-term performance. and its subsidiaries. Please see
and business partners to behave legally and ethically, and
www.deloitte.com/us/about for
in accordance with compliance and policy requirements. a detailed description of the legal
structure of Deloitte LLP and its
subsidiaries. Certain services may
not be available to attest clients
1
For more information on tone at the top, see the first article in our series: www.deloitte.com/us/toneatthetop under the rules and regulations
of public accounting.

3
 Facing up to the challenges Communicating culture can be especially challenging when
More and more organizations are choosing to create crossing borders. It is important that everyone understands
additional structure around their ethics program. This the expected behaviors of the organization and the
can include the appointment of a Chief Ethics Officer (or principles against which decisions will be made. Values need
expanding the Chief Compliance Officer’s role to include to be articulated in a manner that transcends nationality—
specific responsibility for the ethics program), enhancing for example, the concepts of honesty and trustworthiness
the code of conduct and related controls and procedures, are universally acknowledged. Nevertheless, it is important
and improving accountability for ethical behavior through to recognize that cultural differences will influence how
training and performance assessments. These actions are a messages are heard and interpreted, and adjustments may
great start toward the creation of a strong culture and will need to be made in training, employee onboarding, and
benefit the broader efforts around risk management and performance reviews.
compliance.
Extending cultural values to mergers and
Establishing a strong culture of integrity is not a discrete acquisitions (M&A)
project with a beginning and an end, nor is it always smooth Cultural fit is one of the biggest stumbling blocks in
sailing. Despite best efforts, many organizations may run up integrating a merged or acquired organization; in fact, it
against a number of obstacles. is one reason such transactions fail, despite the potential
business benefits. This is why executives may want to
Defining the culture conduct a cultural “audit” as part of the due diligence
Most leaders believe they understand and can define process. If the target company's values diverge significantly
their organization’s culture. However, often there is a gap from those of the buyer, this could be a red flag. A well-
between management’s perception of the culture and developed integration plan will ensure both entities
how the rest of the organization views it. It is a mistake understand and reinforce desired values. From day one,
for leaders to assume they always have their finger on the management needs to let new employees know that
pulse of the organization’s culture. To get a more accurate they are welcome. At the same time, leaders need to
picture, organizations can set up listening posts, such as communicate how the organization expects them to behave
cultural assessments using employee surveys and outside and how they can expect to be treated in return.
observers. It is especially helpful to offer avenues, such as
focus groups, run by third parties, for employees to provide Handling the naysayers
open-ended responses that truly reflect their perceptions of Nothing will damage culture more than the malcontents.
the organization. When people get in the way of supporting the culture,
they can cause roadblocks and undermine the efforts of
Instilling culture and values throughout the the organization. They must be identified, counseled, and
organization offered the opportunity to conform to expected behavior,
While executive leadership may work hard to establish a or they should be separated from the organization. Training
culture of integrity at headquarters, something often gets programs focusing on ethics and compliance are one way to
lost in translation as one moves farther away from the communicate values to individuals who may need additional
central office. This is why attention to culture needs to be reinforcement. As a next step, performance reviews should
active and continuous, especially in large organizations with be structured to include an evaluation of an individual’s
distant outposts. Values—with ethics and integrity at their results and should reflect how those results were achieved.
core—must be clearly and consistently communicated. Some organizations even make adhering to values part of
Messaging needs to be explicit and repeated, so that it the goal-planning process by setting objectives that are tied
becomes embedded in how work gets done. to specific cultural elements.

4
Battling values fatigue
While ongoing communication is essential, organizations Reinforcing culture and values
should avoid delivering exactly the same message again
and again. This is because messages can get stale, Create listening posts: Conduct cultural assessments that get at the core of how
causing employees to ignore the underlying values and people behave and what they think.
principles. Communicating values is much like a marketing
campaign—it needs to capture people’s attention and Maintain a healthy mood in the middle: Much hinges on middle management’s
use different content, formats, and communication ability to translate tone at the top into the policies and practices that drive
channels to remain fresh. One way to achieve this level everyday behavior.
of interest is through the power of stories. Stories cannot
only make values concrete, they connect people to those Keep it interesting: Find new and innovative ways to communicate cultural values and
values in ways other forms of communication cannot. reward values-based behavior. Encourage storytelling to bring values to life.

Addressing leadership flux Play fair: Reward the right behaviors and penalize the wrong ones. Don't play favorites.
When organizations experience rapid turnover of CEOs
and other senior leaders, maintaining a consistent identity Shout it from the rooftops: Leaders tend to undercommunicate values and
and set of values can sometimes be a challenge. Clearly, expectations. In this case, more is better.
selecting the right individuals to lead the organization
is critical. If everyone in the organization lives its values,
then promoting from within is one way to ensure those
values remain intact. But that is not always either practical driven by a sense of purpose and crave a more collaborative
or possible. The board is usually involved in external hiring culture. They are more likely to pursue portfolio careers in
of senior leaders, especially CEOs. They need to pay which they change jobs frequently to seek organizations
particular attention to cultural fit and consider candidates that fit with their values. To create cultures with staying
who are not only competent, but who have the power, organizations must therefore foster an environment
chemistry, character, and moral capability to inspire and that balances a “something for everyone” appeal, with a
win the hearts and minds of all stakeholders. Regardless set of consistent values that all generations will be able to
of the CEO selection, it is important that culture not be embrace.
dependent on a single person or group. A robust ethics
and compliance program—appropriately designed, Conclusion
positioned, and resourced—will survive executive changes An organization is a community of people with common
at the top of the organization. interests and shared values, banded together to achieve a
common goal. When people work together toward these
Appealing to a cross-generational workforce shared goals, success follows. When organizations are torn
Revolving leadership is not the only source of change apart by distractions that are not aligned at the core, failure
that can undermine culture. Employee turnover can follows. Building a culture of integrity not only fortifies the
threaten it as well. Organizations today need to appeal organization against risk, but also builds both employee
to the most multi-generational workforce in history.2 For engagement and strong loyalties with all stakeholders. In
both financial and other reasons, baby boomers are not the long run, a positive culture of integrity is the foundation
retiring the minute they hit age 65. Many are choosing for an effective ethics and compliance program, which,
to remain employed, sometimes postponing promotional when properly embedded into an organization, can
opportunities for younger, Generation X workers. At the create a competitive advantage and serve as a valuable
same time, Millennials entering the workforce are often organizational asset.

2
Global Human Capital Trends 2014: Engaging the 21st-century workforce, Deloitte.
http://dupress.com/wp-content/uploads/2014/04/GlobalHumanCapitalTrends_2014.pdf

5
Contacts
Please contact one of our Enterprise Compliance Services leaders for more information.

Nicole Sandford Keith Darcy Maureen Mohlenkamp

Partner | Deloitte Advisory Independent Senior Advisor to Principal | Deloitte Advisory
National Practice Leader, Deloitte & Touche LLP Deloitte & Touche LLP
Enterprise Compliance Services +1 203 905 2856 +1 212 436 2199
Deloitte & Touche LLP kdarcy@deloitte.com mmohlenkamp@deloitte.com
+1 203 708 4845 Stamford, CT Stamford, CT
nsandford@deloitte.com
Stamford, CT

Brian Clark Laurie Eissler Nolan Haskovec

Partner | Deloitte Advisory Director | Deloitte Advisory Senior Manager | Deloitte Advisory
Deloitte & Touche LLP Deloitte & Touche LLP Deloitte & Touche LLP
+1 816 802 7751 +1 313 396 3321 +1 212 436 2973
bclark@deloitte.com leissler@deloitte.com nhaskovec@deloitte.com
Kansas City, MO Detroit, MI New York, NY

Kevin Lane Thomas Nicolosi Holly Tucker

Principal | Deloitte Advisory Principal | Deloitte Advisory Partner | Deloitte Advisory
Deloitte & Touche LLP Deloitte & Touche LLP Deloitte Financial Advisory Services LLP
+1 214 840 1577 +1 215 405 5564 +1 214 840 7432
kelane@deloitte.com tnicolosi@deloitte.com htucker@deloitte.com
Dallas, TX Philadelphia, PA Dallas, TX

Additionally, feel free to reach out to our team of former compliance officers who are located across the country and experienced in a wide
variety of industries.

Martin Biegelman Rob Biskup Timothy Cercelle

Director | Deloitte Advisory Director | Deloitte Advisory Director | Deloitte Advisory
Deloitte Financial Advisory Services LLP Deloitte Financial Advisory Services LLP Deloitte & Touche LLP
+1 602 631 4621 +1 313 396 3310 +1 216 589 5415
mbiegelman@deloitte.com rbiskup@deloitte.com tcercelle@deloitte.com
Phoenix, AZ Detroit, MI Cleveland, OH
Industry: Technology Industry: Consumer & Industrial Products Industry: Insurance

Michael Fay Howard Friedman George Hanley

Principal | Deloitte Advisory Director | Deloitte Advisory Director | Deloitte Advisory
Deloitte & Touche LLP Deloitte & Touche LLP Deloitte & Touche LLP
+1 617 437 3697 +1 713 982 3065 +1 973 602 4928
mifay@deloitte.com hfriedman@deloitte.com ghanley@deloitte.com
Boston, MA Houston, TX Parsippany, NJ
Industry: Investment Management Industry: Energy & Resources Industry: Insurance

Peter Reynolds Thomas Rollauer

Director | Deloitte Advisory Director | Deloitte Advisory
Deloitte & Touche LLP Executive Director, Deloitte Center for Regulatory Strategies
+1 973 602 4111 Deloitte & Touche LLP
pereynolds@deloitte.com +1 212 436 4802
Parsippany, NJ trollauer@deloitte.com
Industry: Investment Management New York, NY
Industry: Financial Services/Banking & Securities

6 6
7
This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business,
financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice
or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or
taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte shall not be responsible for any loss sustained by any person who relies on this document.

Copyright © 2015 Deloitte Development LLC. All rights reserved.

Member of Deloitte Touche Tohmatsu Limited