Com­pli­ance: guide­lines for compliant corporate behavior

Law-abiding and ethically correct conduct should be only natural in companies. However, recent incidents have proven that this is not the case. On the contrary, com­pli­ance remains a constant topic of dispute. After all, companies do not just operate for them­selves; their business ac­tiv­i­ties affect numerous interest groups. Not only cor­po­ra­tions, but also SMEs are therefore under pressure to define what these values are and adhere to them. In view of the complex discourse, the first question that arises is: What exactly does com­pli­ance mean?

The term "com­pli­ance", which is fre­quent­ly used in business ad­min­is­tra­tion and law, orig­i­nat­ed in the US financial system, but is now used in prac­ti­cal­ly all in­dus­tries and economic sectors. It’s basically about companies and their employees complying with the rules. In the past, this primarily meant complying with laws.

Today, however, the concept of com­pli­ance has long been much more broadly defined: In addition to main­tain­ing legality, the concept now also includes rec­og­niz­ing standards and guide­lines customary in the industry. Even more important, however, is com­mit­ting to its own set of values, with which a company imposes strict ethical rules on its internal and external conduct.

But why is com­pli­ance so important? What is behind the concept of com­pli­ance and what are the goals of a company that is committed to it?

From a purely business point of view, a com­mit­ment to com­pli­ance has primarily strategic mo­ti­va­tions: Just like normal citizens, companies that are so-called legal entities must comply with existing national and in­ter­na­tion­al laws. In October 2006, the U.S. Small Business Ad­min­is­tra­tion re-launched Business.USA.gov, which provides a single point of access to gov­ern­ment services and in­for­ma­tion to help companies adhere to gov­ern­ment reg­u­la­tions.

If efforts are not made to comply with these reg­u­la­tions, those involved run the risk of being punished with sanctions such as fines, profit skimming, or even im­pris­on­ment. In addition, there are internal and external con­se­quences and costs that may be incurred by the offending company, such as personnel con­se­quences or claims for damages by customers and business partners. However, these sanctions are not limited to a single company, but can affect the entire parent company of the group. In cases like this, insurance does not offer any pro­tec­tion.

The main objective of com­pli­ance is therefore to avoid or quickly identify criminal behavior and to react ap­pro­pri­ate­ly to it in order to minimize any economic risk that might result. Although de­lib­er­ate breaches of rules cannot be prevented in this way, the existence of com­pli­ance measures can, however, lead to a reduction in the liability of managers. However, whether an internal control system is taken into account to reduce penalties always depends on the in­di­vid­ual case.

A well-known example of a com­pli­ance violation is the emissions scandal that has pre­oc­cu­pied the media, industry and politics since September 2015: Volk­swa­gen admitted that it had been using an illegal shutdown system in its diesel vehicles to ma­nip­u­late nitrogen oxide levels and thus cir­cum­vent ap­plic­a­ble emission standards - a de­lib­er­ate breach of the law ordered by man­age­ment. This pro­gram­ming software was used in about eleven million cars worldwide, 600,000 of which were in the United States. Since then, the company has been the focus of con­tin­u­ous public attention: company CEO Martin Win­terko­rn resigned from his position, possibly facing 25 years of in­car­cer­a­tion. Politi­cians are focusing more on vehicle man­u­fac­tur­ers; the au­to­mo­tive industry con­se­quent­ly sees itself in a serious crisis; numerous criminal and civil in­ves­ti­ga­tions are underway.

Volk­swa­gen announced plans in April 2016 to spend around $18 billion rec­ti­fy­ing the emissions issues as well as refitting all the affected vehicles after they’d been recalled. In total the whole scandal cost the company around $29 billion.

An expanding public discourse on corporate social re­spon­si­bil­i­ty has led to an ethical component being added to the concept of com­pli­ance. Stake­hold­ers - i.e. relevant interest groups such as customers, employees and residents in the vicinity of factory fa­cil­i­ties - expect companies not only to comply with rules for the sake of the company, but also to adhere to industry-standard virtues and moral values. Companies should therefore not appear merely as economic figures, but above all as corporate citizens in the sense of corporate social re­spon­si­bil­i­ty.

What is con­sid­ered socially re­spon­si­ble is, to a certain extent, pre-defined by generally accepted reg­u­la­to­ry bodies and codes. In many cases, es­pe­cial­ly in sensitive in­dus­tries such as energy and chemicals, the company is expected to follow its own set of values that proac­tive­ly and directly address potential conflicts of interest with in­di­vid­ual stake­hold­ers. A company whose business ac­tiv­i­ties have eco­log­i­cal im­pli­ca­tions must therefore also com­mu­ni­cate its en­vi­ron­men­tal and sus­tain­abil­i­ty standards well and face up to criticism. This has a positive effect on their cred­i­bil­i­ty and business re­la­tion­ships.

Even if an en­tre­pre­neur is in­ter­est­ed in com­pli­ance as a matter of principle, com­mit­ting them­selves to corporate social re­spon­si­bil­i­ty also makes sense from a purely economic point of view. Apart from penalties, vi­o­la­tions of rules can also have a number of non-financial con­se­quences. This par­tic­u­lar­ly refers to the loss of rep­u­ta­tion and trust among business partners and customers. Even if the ac­cu­sa­tions later turn out to be false, the rep­u­ta­tion­al damage can be enormous.

In the case of proven ma­nip­u­la­tion by Volk­swa­gen, a simple apology by the executive board was not enough to appease the public dis­plea­sure that followed the rev­e­la­tions. The fact that the diesel vehicles sold between 2008 and 2015 could be re­spon­si­ble for around 1,200 premature deaths due to air pollution, according to an MIT study, poured ad­di­tion­al oil into the fire of criticism. The scandal thus once again sparked the long-term dis­cus­sion about the traffic policies, which is now putting the au­to­mo­tive industry under ad­di­tion­al pressure to act.

A com­pli­ance man­age­ment system (CMS) is needed to implement and enforce com­pli­ance within the company. This system ensures com­pli­ance with all guide­lines and enables rule vi­o­la­tions to be quickly detected. The aim of this CMS is to implement and maintain a trans­par­ent, un­am­bigu­ous, and clearly un­der­stand­able com­pli­ance culture.

Due to the variety of topics and areas of interest that the concept of com­pli­ance can affect, however, de­vel­op­ing a CMS is not an easy un­der­tak­ing. Even medium-sized companies often lack the necessary know-how for a project like this. Depending on the industry, company size, and type as well as the or­ga­ni­za­tion­al structure, there will be in­di­vid­ual re­quire­ments for the im­ple­men­ta­tion, so therefore there is no generally ap­plic­a­ble procedure. Nev­er­the­less, the following is a rough ex­pla­na­tion of the most important steps.

Every CMS starts with company man­age­ment com­mit­ting to com­pli­ance and defining a term that is in­di­vid­u­al­ly tailored to the company. This is the only way to ensure that all those re­spon­si­ble pull together and avoid mis­un­der­stand­ings about the nature and scope of the project. How serious the man­age­ment team is about this com­mit­ment can already be seen from how much personnel capacity and budget they are prepared to spare. An effective com­pli­ance team should consist of experts from all de­part­ments of a company (e.g. personnel man­age­ment, financial ad­min­is­tra­tion, legal de­part­ment). Only in this way is it possible to identify and cover all con­ceiv­able areas of interest and risk in the company.

Ad­di­tion­al external expertise can be obtained from lawyers, tax con­sul­tants, and man­age­ment con­sul­tants. It is also legally necessary and advisable to involve the works council in all decision-making processes. For example, it needs to be decided whether existing em­ploy­ment contracts or operating agree­ments need to be changed. A realistic timetable and a clearly defined dis­tri­b­u­tion of roles (including a competent team leader) can help to keep costs man­age­able and achieve a timely result.

The team’s main task is to carry out an analysis of the current situation. It could be that the company already has (at least rudi­men­ta­ry) com­pli­ance struc­tures, in the form of "unwritten rules" that apply among employees. On the basis of this pre-eval­u­a­tion, the target state is then defined: Which measures and mech­a­nisms must be sup­ple­ment­ed, modified, or com­plete­ly recreated in order to do justice to the company’s com­pli­ance concept? It is worth­while iden­ti­fy­ing the civil society in­ter­faces that the company has to deal with in its day-to-day business.

It could even be worth­while to hire a com­pli­ance solutions company, which could co­or­di­nate pro­ce­dures and ac­tiv­i­ties according to the current com­pli­ance reg­u­la­tions and re­quire­ments. These companies work together with employees and teach them how to insert com­pli­ance into the internal workplace culture and also come with these benefits:

• Ensuring com­pli­ance with all state and federal laws
• Main­tain­ing a firm ethical standing ground
• Trans­par­ent reporting pro­ce­dures
• Well-defined processes that increase ef­fi­cien­cy
• Reduced potential for lawsuits and other legal problems
• More efficient audit processes

And even more.

There are numerous com­pli­ance policy patterns on the internet, but there is no general re­quire­ment for the content and structure. Instead, it is rec­om­mend­ed to adapt all rules exactly to the in­di­vid­ual needs and cir­cum­stances in the en­ter­prise.

One possible structure could be the following:

1. General rules of conduct
2. Specific issues (e.g. gifts to business partners, behavior towards com­peti­tors, equal treatment of employees)
3. Contact persons and for­mal­i­ties for reporting in­fringe­ments
4. Doc­u­men­ta­tion mech­a­nisms for in­fringe­ments
5. Sanctions (e.g. reminder/caution, transfer, (extra)ordinary ter­mi­na­tion, salary reduction, com­pen­sa­tion, police reports)

Once completed, the com­pli­ance guide­lines must be openly com­mu­ni­cat­ed through­out the company. This is done by means of newslet­ters, pub­li­ca­tions on the intranet, and in­for­ma­tion­al events. Regular training sessions must be held to sensitize all those involved in the company (including con­trac­tu­al partners and suppliers) to the new com­pli­ance culture. It is also essential for all employees to be bound by their em­ploy­ment contracts by means of ap­pro­pri­ate sup­ple­men­tary clauses.

Many companies also decide to place a reduced version of their com­pli­ance policy on their website in the form of a "Code of Conduct" or "Mission Statement". Being so trans­par­ent can strength­en the trust of customers and business partners and attract ap­pli­cants in the context of employer branding. The most important thing, however, is that managers always set a good example and exemplify the com­pli­ance culture both in­ter­nal­ly and ex­ter­nal­ly.

Although the main re­spon­si­bil­i­ty and full liability for com­pli­ance lies with the company man­age­ment, this re­spon­si­bil­i­ty can be given to a single chief com­pli­ance officer, an entire com­pli­ance team, or a com­pli­ance solutions company can take over the work (as mentioned above).

These are then re­spon­si­ble for the following tasks, among others:

• Im­ple­ment­ing the CMS
• Or­ga­niz­ing training courses
• Con­tin­u­ous quality control
• Con­duct­ing employee surveys
• Mon­i­tor­ing leg­isla­tive changes
• Adapting, expending, and further de­vel­op­ing the CMS if necessary
• Doc­u­ment­ing in­fringe­ments
• Regular reporting to man­age­ment

Such a complex task requires competent and assertive personnel, which is why par­tic­u­lar care is required in re­cruit­ing. The com­pli­ance officer does not nec­es­sar­i­ly have to be at the highest man­age­ment level, but should have a direct, con­sis­tent and the shortest possible com­mu­ni­ca­tion con­nec­tion in order to be able to work ef­fec­tive­ly. This is the only way to ensure that com­pli­ance efforts are fruitful in the end.

The benefits and goals of com­pli­ance measures are obvious in light of existing laws and corporate social re­spon­si­bil­i­ty. However, this does little to change the fact that the concept has a rather dubious rep­u­ta­tion in some man­age­ment circles - chal­leng­ing proven practices and therefore hampering business activity.

Many find the main problem to be in the inherent com­plex­i­ty and change­abil­i­ty of the concept of com­pli­ance. Companies, es­pe­cial­ly global players, face a veritable flood of national, in­ter­na­tion­al, and industry-specific rules and pro­hi­bi­tions. In addition, topics are con­stant­ly changing. As a result, com­pre­hen­sive com­pli­ance man­age­ment systems are often only found in large cor­po­ra­tions, while the topic is often of secondary im­por­tance in small and medium-sized companies.

This makes it all the more important (and urgent) to ensure all those re­spon­si­ble in the company comply with the rules and to appoint a trained and ex­pe­ri­enced com­pli­ance officer who is up to the chal­lenges of the job de­scrip­tion.

Click here for important legal dis­claimers.