Compliance Archives | Bryan E. Hopkins

I am getting ready for retirement. It will happen in a month. It really hasn’t hit me yet- but I know I will soon no longer have an office to go to everyday or an office in which to store things. In fact , looking around my office I realize I have files, books and even documents going back 40 years…spanning my career. In essence, clutter.

I am in the process of decluttering my house. My wife and I decided this time around (we have moved six or seven times in the course of our marriage) to do our best to throw out clutter. To go minimalistic if we can. What is clutter you might ask? I think it is stuff that is no longer relevant. Stuff that won’t be used or appreciated. Stuff that will take up space but that we really no longer need in our daily lives. Take clothes for instance. Many of us buy clothes because they are on sale. They are so cheap we have to buy them. We use them once, put them in a closet and then never wear them again. The clothes are irrelevant. We don’t wear them. In fact- we don’t even look at them. They get buried amongst other clothes or pushed into the back of the closet or clothes chest…never to see the light of day. They have become stuff or clutter.

I’ve read from several retirement experts that you should start going through your stuff a good 1-2 years before you retire. It may take that long to get rid of the clutter that has built up in your home. But what about your office? Have you considered that most of the books in your office might be obsolete? Your old documents may be irrelevant. You may have packed your office over time with clutter. Even though you are not up for retirement it still might be worthwhile to take a good look at your office. How many name cards to you have of people you will never call or email? Cards tend to build up over time, especially if you go to networking events. I’ve found over the last few years that most networking events only result in a few good contacts. But the name cards pile up.

Thinking about clutter, I think many organizations allow clutter to build up as well. How many corporate processes, compliance or risk management processes clutter up the organization that have become obsolete or irrelevant? How many documents are in the corporate database that are never used? What about data? Does IT know where all the data is and whether the data is relevant? Are there procedures in place to remove data that has become irrelevant? Maybe it is time your organization declutter itself. Look at your corporate subscriptions to third party reports, memberships, newsletters and magazines. Are they cluttering up your organization? Do you really need a membership to an organization that has become irrelevant to your business? Has your business model changed? If so, many of your processes and documents may indeed be clutter. Time to review your risk management processes.

I am going to continue to review my files. Some I will keep but most are no longer relevant now I am retiring. In fact, looking at most of my old files, books and other belongings I realize they were always just stuff. Time to declutter my office.

It’s my day off. Though I am retiring soon I am taking a few days off here and there to take care of personal business before I depart the workplace. Of course they now have more work for me to do prior to my leaving. Well today they have to find someone else. I am always amazed that when I take a day off I am hit with work requests and when I am in the office…not so much. Ha-ha!

Having the day off also allows me to look around and contemplate my surroundings. I am not distracted and can be more present or mindful. I think it’s a good idea for those in the workplace to take a day off now and then and just look around. Everyone should ask questions and consider their current environment.

I am looking at Itaewon while sipping a cup of coffee. Yes..I am at a coffee shop in the Itaewon district of Seoul. Things are changing fast. Covid has really cause havoc. Many shops are closed. The bars and restaurants catering to the expat community are slowly closing or scaling back. The neighborhood known for its international focus is changing. It’s becoming more of a younger Korean focused area. I see buildings going up with no tenants and expat bars and shops closing. Times are changing.

Change happens in all of our lives. The old neighborhood may not be what it was. The city itself may be changing. And of course the country. We all have to ask ourselves if we are willing to change as well. For me of course, retirement will bring change. A change in my surroundings a change in lifestyle and a change in my perspective on life. I think everyone should realize that change is really constant. Embrace change or suffer the consequences. People get to caught up in the regular day to day tasks that they have that they don’t look around and notice how their environment is really changing.

For those in the workplace, take a look around. What changes do you see happening? Are you ready for change or not? Are you taking steps to stay relevant in today’s ultra-fast changing world? Are your skills still relevant or do they need upgrading? Like it or not, AI, VR and the blockchain will change how we work as well as what jobs and services are still relevant. If you run a company, are your products and services still relevant or do you need to change your product mix or even your business model? What about your internal compliance processes or your risk management processes? The forces causing change in today’s society will not stop. So it is up to everyone to understand change and adapt.

The only thing constant in life besides death and taxes happens to be change.

Of all the risks facing companies in today’s business world, reputational risk is one of the most serious. Reputational risk can not only damage a company’s brand, but can even lead to the demise of the company. It is of primary importance to executives, in-house counsel and risk managers in many multinational companies and is seen as one of the top risks a company may face. In fact, in Aon’s 2019 t Global Risk Management Survey, it is one of the top risks that are of concern to companies. Deloitte surveyed companies as well and found out that the majority of companies it surveyed rated reputational risk as more important than strategic risk. Many of those surveyed acknowledged they had suffered a brand risk or reputational risk event that resulted in a loss of brand value or a loss of earnings.

Damages caused by reputational or brand risk events are not tied to just domestic related issues. Approximately half of the executives that Kroll polled for its recent Global Fraud Report opined that their companies are at risk of vendor, supplier, or procurement fraud tied to overseas expansion. Many of those surveyed felt their companies were highly or moderately vulnerable to corruption and bribery risks which can of course lead to reputational risk or loss of brand as well as FCPA investigations and fines. According to the respondents in the Kroll Global Fraud Report, ethics and integrity (or lack thereof) was the major cause of reputational risk.

The reputational risk caused by supply chain issues can escalate out of control unless properly managed. Loss of brand value can happen quickly if a fraudulent event becomes public or if a bribery scandal is publicized in the media. Just look at the some of the crisis that happened over the last decade. Many people have been affected (some have died) because of the crises or mega-crises that have happened. Many of them also included reputational risks as well. Examples include:

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

As you can see from the examples above, there are numerous kinds of crises that a company should be prepared to handle, especially in an international context. Among them are financial crises, natural disasters including pandemics, product failures, workplace violence, cyber-attack, or hacking, and, of course, terrorism. However, most if not all have resulted in serious reputational crisis which also led to legal risk.

It is undisputable that a major crisis can pose serious threats to a company, and, therefore, the crisis must be managed. Crises can result in (a) government fines, (b) loss of retailer confidence, (c) loss of investor confidence, (d) loss of employee confidence, and (e) massive litigation, including class actions. In other words, the end of the company! Crises also result in reputational risks or damage to the company’s brand which may have a greater effect on the company’s bottom line than the damage caused by the original crisis itself.

The problem facing any risk manager or in-house counsel is that the media in today’s society has become very anti-business. As this anti-business culture of attack has gotten worse over the last twenty years, a crisis can no longer be handled by a simple PR or marketing statement. A full-fledged crisis management operation must be put in place. Damage control is now a very serious matter for any potential crisis, no matter how small. Today, more and more companies have to consider issues that negatively affect the company’s brand and how best to counteract them.

Key considerations when considering potential brand or reputational risk caused by ethical or fraudulent behavior within the company or within the company’s supply chain:

-Compliance- does the Company have a compliance program and is it up to date?
-Compliance- does the Compliance program and code of conduct promote an ethical culture within the company?
-Supply Chain- has the Company’s vendors involved in the supply chain been vetted? Do they follow the Company’s code of conduct? Do they have compliance programs?
-Are there sound corporate governance and control processes in place?

Major considerations for handling brand risk once a crisis has started includes:

-Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
-Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
-Have the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
-Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
-Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?

Companies must realize that there are many risks associated with doing business internationally as well as domestically. Brand or reputational risk is very serious and can lead to the loss of money or even the destruction of a company unless the right steps to mitigate or prevent brand risk are in place. So when considering what risks should be addressed on a regular basis, remember reputational risk should be of primary importance.

Before a crisis breaks out, it’s always a good idea for the company’s risk manager or the risk management department (RMD) if one exists to review his or her role, or in case of the RMD, its role within an organization. In today’s environment, including COVID 19 virus issues, it is very important. A risk management department may have multiple reporting lines within an organization or may report to one department head. Are those reporting lines clear? If not, it is time to clarify them.

In order to understand the risk management department’s area of responsibility within an organization, I think it best to for the head of risk management to work with his supervisor in drafting corporate guidelines covering the risk management’s area or responsibility which can then be disseminated throughout the organization. No only should the RM or RMD’s are of responsibility be covered but each individual within the RMD should have his or her position and are of responsibility described in detail as well. It’s best to have everything outlined before the RMD has to contend with a crisis, especially a pandemic.

Areas of responsibility should include the purpose and policy of the RMD in the organization, the functions and execution points of the RMD (who does what, when, how, reporting lines, etc.) as well as a detailed outline of the procedures and processes of the RMD. Procedures and processes can include:

-conducting risk assessments of the organizations’ divisions and departments
-developing solutions for the various risk management issues
-coordination with various departments to assist with compliance issues
-oversee loss control concerns
-develop training for the organization’s employees covering various risk related areas of concern such as product safety, etc.

Besides managing risk, risk managers must also have a knack for good stakeholder management. In fact, in order to provide effective leadership in today’s corporate world, risk managers and those who have a risk management function, must understand the significance of good stakeholder management. Considering the high employee and investor turnover rates it is no wonder that risk managers must take the lead in providing risk management information to various stakeholders not only from a compliance perspective but from a profit/loss perspective as well.
Who are the various stakeholders that a risk manager must concern himself or herself with? Of course the more sophisticated a company, the more stakeholders there might be. Nonetheless, the main stakeholders of any company or organization usually include:

1. Employees
2. Upper Management including the Board
3. Customers
4. Suppliers
5. Regulators
6. Investors
7. Business partners; and
8. Credit Analysts

The first step in leadership for any risk manager when looking at stakeholders is to ask the hard questions such as: (I) Are you prepared to handle risk events relating to your stakeholders or not? (ii) In a crisis management event, such as a pandemic, are you ready to address your customers? (iii) In case of litigation, do you have the right information to communicate to your regulators? , and (iv) What are the risk management process to use in case you have major employment related issues?
Providing effective risk management leadership requires the risk manager to understand what his or her role within the organization is as well as who the major stakeholders really are and what risk management reporting processes actually exist or should exist.

Once a risk manager can answer the questions, the manager as well as the RMD itself is ready to provide effective risk management leadership.

Of all the risks facing companies in today’s business world, reputational risk is one of the most serious. Reputational risk can not only damage a company’s brand, but can even lead to the demise of the company. It is of primary importance to executives, in-house counsel and risk managers in many multinational companies and is seen as one of the top risks a company may face. In fact, in Aon’s recent Global Risk Management Survey, it is one of the top ten risks that are of concern to companies. Deloitte surveyed companies as well and found out that the majority of companies it surveyed rated reputational risk as more important than strategic risk. Many of those surveyed acknowledged they had suffered a brand risk or reputational risk event that resulted in a loss of brand value or a loss of earnings.

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

When considering brand risk issues during a crisis ask the following questions:
• Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
• Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
• Has the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
• Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
• Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?

The other day I had lunch with a friend who was lamenting the fact his company’s sales team continued to ink deals without any regard for risk. When he asked them why they continued to do so, the reply was “that’s the way we have always done things.” Unfortunately, many companies continue to plod along doing business without regards to risk. In fact, many companies fail to look at operational risk which can lead to disaster down the road. In order for a company to succeed it not only has to a sustainable business model but it has to constantly review its risk processes. After all, what happens when the current business model does not work anymore? What happens when the risks outweigh the benefits of continued standard corporate operations? Maybe it’s time to re-examine your risk management processes. Do they really work?

When talking to your staff or to other departments, how often have you heard the phrase “That the way we have always done things.” Just because corporate processes have been done one way doesn’t mean that the best way or even in todays’ fast changing world- the right way. Even after 2008 many companies continued to use the failed metrics that got them into trouble in the first place. Even the credit markets haven’t changed as much as you would think after 2008. Why?

I truly believe that once processes are created in a corporate or bureaucratic environment, it is as if the processes have been set in stone. They are very hard to change. Even if the world around the company has changed. It is human nature to accept what has been done in the past. Few people want to “rock the boat” even if the proverbial boat is actually sinking. Companies get into real trouble because of this. What happens if the company’s business model actually is out of date or its business plan is no longer viable? Just because it worked in the past doesn’t mean it will work in the future.

I therefore caution everyone not to blindly accept the current risk management processes in place. Risk managers as well as in house counsel and other managers should be challenging risk management metrics on a regular basis. Counsel should be auditing departments on a regular basis. Does that compliance program really work? Maybe it did 5 years ago. But what about today?
Remember, if local or national laws have changed maybe the current processes are out of date. If the products that your company manufactures or the services it provides have changed maybe the internal processes surrounding the review of those products and services are out of date. What about the current social environment? When reviewing your current product liability review processes have you factored in the new risks created by the Internet of all Things? These risks are real. Are you ready for them? Does your current business model still work or is it outdated? What about data privacy laws?

It is a fundamental truth that all things change. Of course, some things change faster than others. Regardless, don’t rely on your old or standard risk management processes to continue to provide the same level of comfort they did in the past. Continue to review and to modify them if necessary. And don’t think that just because “that's the way things are done” your company should continue to operate as usual.