More Notes on Retaliation Against CCOs

Not long ago I moderated a webinar on retaliation specifically against compliance officers, and two weeks later, I’m still not sure how I feel about it. Yes, it was great to hear all the advice that compliance professionals shared about how to withstand retaliation — but yikes, retaliation against compliance officers is so, so prevalent.

Indeed, the most striking part of the discussion was just the sheer universality of the experience. We had nearly 1,000 attendees, and everyone who spoke up said that they had suffered retaliation at some point in their careers. At one point I polled the audience on whether retaliation against compliance officers was “common” or “not common.” Then I watched the chat box fill up with people correcting me that choices should have been “common” or “very common.” 

I don’t doubt that feedback at all, as depressing as it may be, but it brings us to an important and fundamental question: Why on earth would senior managers even do this? 

Like, if you’re a CEO or general counsel who doesn’t want to confront tough ethical issues, why bother hiring a compliance officer in the first place? What do you think the person with “ethics and compliance” in the job description is there to do? 

Webinar participants had lots to say about that. Many said management teams see themselves as “above” compliance; that the executive team knows what’s best for the business and what good ethical conduct is, and don’t need someone further down the org chart telling them they’re wrong. Compliance teams are more an administrative function, meant to assure that the rest of the company obeys policy and behaves properly. 

I’d also say behavior like that is a sign of an immature or insecure leadership team. Leaders in that weak mold will see issues as management versus the compliance officer, rather than management and the compliance officer versus the problem. 

If you see your senior leadership behave that way — thin-skinned, defensive, prone to personalizing a problem — consider how long you want to stay employed there. 

Preventive Measures to Take

Our webinar debated steps compliance officers could take to prepare their senior management teams for confrontations like these. For example, you could try a rehearsal or a table-top exercise of how you would bring a matter to senior management, so that senior management would have a sense of how that situation might feel when it happens for real.

This idea does have its limits. It’s easy for people to behave ethically when they know they’re only going through a drill; doing so when that might cost you money, reputation, or your job is something else entirely. Lots of us are not nearly as brave as we’d like to believe when we’re put to a true test.

That said, I still like the idea of “misconduct drills.” If nothing else, you can get other senior executives to understand the procedures you’ll follow when reporting a compliance violation. You could even document those procedures in writing. Invite as many participants as possible, from board directors to internal auditors to outside counsel. Then when a real matter does arise, and suddenly senior management goes wobbly on doing the right thing, at least you’ll be able to say, “We’re following the same procedure we talked about and practiced before. What’s changed?”

Well, the consequences changed, from imaginary to real. And by making that painfully obvious, you might nudge reluctant leaders to follow through on the ethical behavior they promised before. People don’t like being cowards. They don’t like acknowledging their own hypocrisy. So if you rehearse misconduct crises and let them build up those muscles of ethical commitment, they might be more likely to flex those muscles rather than turn against you.

Separately, one compliance professional recounted a story of misconduct by the client of her former employer. The client had submitted suspicious documentation that would have brought significant product liability risk to her employer. She therefore tried to raise the issue with the client’s compliance team — except, the client didn’t have one. All she found was a general email address to submit misconduct questions, so that’s where she sent her query. 

Which went directly to the client company’s board of directors. 

The board received her complaint and hired outside counsel to investigate. That outside counsel then called her with the client’s executives on the line, blasting her for going over the client’s head.

It’s fascinating to think that another company’s immature compliance structures could come after you, but that is what happened here. Ultimately the effort failed; the compliance officer’s own management team supported her fully, which is good to hear. The compliance officer herself got a taste of what retaliation actually feels like, which I suppose is training we all need. 

What Retaliation Looks Like

We also talked about what retaliation against compliance officers actually looks like, since it can take many forms. Compliance officers might struggle to distinguish between true retaliation and the merely mundane crazy things that happen in corporate life all the time. People retaliating against you will want to create that confusion, to give themselves plausible deniability while undermining your confidence. They’ll gaslight you.

Several people cited the “Four Ds of Retaliation” as defined by the great Ellen Hunt:

• Deny the allegation
• Demask the whistleblower, if he or she is anonymous
• Discredit the whistleblower
• Dismiss the person, either by demoting or firing them

Listeners also added a fifth D: defund, the compliance officer’s budget.

Perhaps the best insight came from a listener who said retaliation is a process, not an event. The aggrieved executive doesn’t say, “I retaliate against you,” do the thing, and then declare the matter closed. Retaliation might start with a series of small slights to probe your reaction, and then escalate if you refuse to back down.

And yes, we talked about the emotional pain of suffering retaliation too. You feel betrayed (and I think that’s even more the case for compliance officers than other employees because you were hired to raise concerns). You feel lonely. You worry about your financial stability and perhaps even your identity, if you love your job and what you do and suddenly you can’t because you’ve been fired. 

Retaliation is a tremendously deflating experience, as you see the uglier,disappointing side of human nature. So it’s OK to cry in your car or talk to a therapist — or, yes, even quit. 

We all need to remember that even corporate compliance is just a job. As Nick Gallo said on the webinar, nobody includes where they worked on their tombstone. 

(If you have stories of retaliation you wish to share confidentially, you can email me at [email protected] or send me an encrypted message on Signal at RadicalCompliance.16.)