Compliance Programs, Big and Small

The Ethics & Compliance Initiative published a report late last week comparing compliance programs at large, medium, and small enterprises. Let’s look at those findings, since too often we in Best Practices Land talk about compliance programs as if they were a standard-issue thing — which, of course, is totally not the case. 

Most interesting to me is that mid-sized companies, defined as 500 to 1,000 employees, seem to be caught in a squeeze. According to ECI’s report, employees at those enterprises are more likely to feel pressure to commit misconduct than their friends at small or large enterprises; more likely to observe misconduct; and more likely to suffer retaliation when they speak up. 

On the bright side, employees at medium enterprises are also more likely to report observed misconduct, and more likely to report incidents of retaliation. Indeed, ECI found that employees at medium enterprises almost always report retaliation they suffer. Compliance officers should welcome that, even if the retaliation itself might leave you banging your head against the wall. 

ECI’s findings come from an online survey of more than 5,000 people ECI conducted in the summer of 2020; which ECI researchers then analyzed and published on March 31. Yes, the data is a bit dated, especially given all the feuding about vaccination and mask mandates that happened in 2021 — but when you look at the findings altogether, they do make a certain sense. They suggest that smaller and larger companies each have certain natural strengths that help achieve the goals of a highly ethical organization. Compliance officers can then keep those ideas in mind as you assess your own organization’s ethical weak spots and decide where to make compliance program improvements. 

Pressure, Misconduct, and Size

First, 52 percent of employees at medium enterprises said they felt pressure to commit misconduct. That was far higher than reported at enterprises small (30 percent) or large (24 percent).

Why would that be? ECI notes that pressure to commit misconduct tends to increase during periods of organizational change — and mid-sized enterprises are prime candidates for such change. They’re often in corporate adolescence, growing large enough that there are tough financial goals to meet, mergers to consider, IPOs to prepare for, and so forth. At the same time, plenty of medium enterprises haven’t yet developed the mature internal controls and processes that large companies take for granted.

Smaller companies often have more flexibility, such as if they’re still owned by a founder or are years away from those gauzy dreams of cashing out via IPO or acquisition. At the other end, large enterprises are more likely to have those growth pains behind them. They’re also more likely to have bureaucracy that acts as an insulating layer, plus internal controls that can thwart whatever misconduct some errant manager might want to attempt. 

ECI also found that employees at medium-sized enterprises are much more likely to have observed unethical behavior: 71 percent, versus 54 percent at small companies and 55 percent at large ones. 

Why? I would posit that employees at small enterprises might not be as quick to call something misconduct; they might not be trained to see it (especially financial misconduct), or might have closer personal bonds with coworkers where they won’t believe a friend is doing something wrong. At large companies, you really might just not see the misconduct, because teams are so specific and atomized. (That’s all the more true now, with so many people working remotely.)

Mid-sized companies, on the other hand — they’re in a certain sweet spot. You still interact with many people from many parts of the enterprise, and the business is sophisticated enough that many types of misconduct might happen. Although it’s interesting to see that favoritism and management lying to employees are among the most observed misconduct regardless of company size.

Higher Reporting Rates

Another interesting point: employees at medium enterprises were most likely to report “every” or “some” incidents of misconduct they saw, but large enterprises were least likely to do the same — and by a fairly substantial margin, too. 

Why? I’m hard-pressed to believe that it’s because employees at large enterprises don’t know how to report misconduct; compliance and HR teams at large enterprises run all sorts of campaigns to promote awareness of internal reporting hotlines and to encourage employees to speak up.

My fear is that employees at large enterprises simply care less about reporting misconduct; that they see their employers as vast, impersonal corporate constructs, and there’s not much point in reporting misconduct when speaking up won’t change anything. That’s a terrible attitude to have, but we’d be fools not to consider it. 

Putting These Insights to Use

My advice would be to ponder the ECI’s findings and use them to help you decide where to make improvements with your own compliance program. 

It’s clear that the more mature your program is, the better your compliance performance will be. It’s also clear that all mature programs have the same fundamental traits: a dedicated compliance team, annual training, written standards, an ethics hotline, and so forth. 

All organizations do not, however, need to introduce all those elements in the same sequence. Depending on your industry, geographic operations, and corporate size, different measures might deliver more or less improvement. For example, training and written standards might be more helpful at smaller organizations than a formal hotline. 

At larger companies, however, a hotline and case management systems (to resolve cases quickly) might demonstrate that management takes internal reports seriously. That’s a more difficult message to convey at larger companies (see vast, impersonal corporate constructs, above; and lower rates of internal reporting), compared to smaller ones where the founders still know people’s names. 

Anyway, food for thought from ECI. Let me whether it tastes right to you.