Wirecard and speaking up

As a follower of Compliance Week’s Martin Woods I often find his materials raise excellent questions.  His piece “James Fries, compliance come out winners in Wirecard scandal” touches on one of the truly difficult questions in the compliance field, how do we get people to speak up.  

Wirecard appears to be a story of big-time, deliberate fraud. This is not one of those subtle stories where everyone intended to do the right thing but gradually shifted off course.  When James Freis was brought in, first to be the compliance officer but then to become CEO, it was becoming apparent that something was amiss.  To his credit he grabbed hold of the situation and moved it in the right direction.  Notably, he observed that “Many others should have seen indications here that were, frankly, not plausible and not tolerable.”  Well, when the top people are directly involved, how willing will others be to raise concerns?

One of the messages from this story, as from many other stories of organizations engaged in crime and wrongdoing, is the need to have people speak up.  This is no simple task.  Far too often whistleblowers are ignored and suffer retaliation.  

So how do we change this?  In the US, Dodd-Frank offers one example, where the government provides enormous financial rewards for reporting wrongdoing.  It may be controversial, but it certainly appears to work.  The EU, perhaps not willing to go the reward route, is requiring organizations (including governments) to install speak-up systems and protect whistleblowers;  those who suffer retaliation will be provided legal remedies. 

What can companies do?  Studies indicate two reasons people don’t speak up.  One is the expectation nothing will be done.  The other is fear of retaliation.  So what can be done?  One key step is ensuring the chief ethics and compliance officer (CECO), who would have responsibility in this area, is fully empowered and independent.  The CECO should be controlled only by the board, not by management.  The general counsel, CEO, head of marketing, etc., should not be able to fire the CECO.  There should be direct, regular, in-person reporting by the CECO to an independent board committee.  There should even be a strong employment contract for the CECO.  

To prevent retaliation of course the code of conduct should say that is not permitted.  But those are just words. When a manager retaliates or threatens retaliation, there must be strong disciplinary action, and that should be publicized as an example (but shielding the identities).  There should be follow-up with those who blow the whistle to be sure they are being treated fairly.  Companies should consider promoting those with the guts and commitment to raise compliance concerns.  Training for managers should recognize the importance of speaking up, and what happens to those who retaliate.  Exit interviews should ask about any instances of retaliation.  Surveys should measure how safe employees feel in raising concerns.

It also needs to be clear that speaking up gets results.  Those who report concerns deserve regular feedback on the results of speaking up.  And there need to be published stories within the company explaining how the speak-up system works, and recounting examples of how calls and reports resulted in real action:  processes being changed, wrongdoing being corrected, and higher-ups being disciplined for wrongdoing.  

Getting people to speak up is and will remain a challenge.  Wirecard is another good example of why this is so important, and why we need to work at making it safer and easier for people to speak up.  I believe it is extremely rare for wrongdoing to go completely unnoticed by others. There are almost always witnesses and helpers.  If we want to improve in this area we have to work harder at this and replace rhetoric with actions.  Thanks to James Fries for taking action in Wirecard, but we need a system that works before those disasters happen.  As a follower of Compliance Week’s Martin Woods I often find his materials raise excellent questions.  His piece “James Fries, compliance come out winners in Wirecard scandal” touches on one of the truly difficult questions in the compliance field, how do we get people to speak up.  

Wirecard appears to be a story of big-time, deliberate fraud. This is not one of those subtle stories where everyone intended to do the right thing but gradually shifted off course.  When James Freis was brought in, first to be the compliance officer but then to become CEO, it was becoming apparent that something was amiss.  To his credit he grabbed hold of the situation and moved it in the right direction.  Notably, he observed that “Many others should have seen indications here that were, frankly, not plausible and not tolerable.”  Well, when the top people are directly involved, how willing will others be to raise concerns?

One of the messages from this story, as from many other stories of organizations engaged in crime and wrongdoing, is the need to have people speak up.  This is no simple task.  Far too often whistleblowers are ignored and suffer retaliation.  

So how do we change this?  In the US, Dodd-Frank offers one example, where the government provides enormous financial rewards for reporting wrongdoing.  It may be controversial, but it certainly appears to work.  The EU, perhaps not willing to go the reward route, is requiring organizations (including governments) to install speak-up systems and protect whistleblowers;  those who suffer retaliation will be provided legal remedies. 

What can companies do?  Studies indicate two reasons people don’t speak up.  One is the expectation nothing will be done.  The other is fear of retaliation.  So what can be done?  One key step is ensuring the chief ethics and compliance officer (CECO), who would have responsibility in this area, is fully empowered and independent.  The CECO should be controlled only by the board, not by management.  The general counsel, CEO, head of marketing, etc., should not be able to fire the CECO.  There should be direct, regular, in-person reporting by the CECO to an independent board committee.  There should even be a strong employment contract for the CECO.  

To prevent retaliation of course the code of conduct should say that is not permitted.  But those are just words. When a manager retaliates or threatens retaliation, there must be strong disciplinary action, and that should be publicized as an example (but shielding the identities).  There should be follow-up with those who blow the whistle to be sure they are being treated fairly.  Companies should consider promoting those with the guts and commitment to raise compliance concerns.  Training for managers should recognize the importance of speaking up, and what happens to those who retaliate.  Exit interviews should ask about any instances of retaliation.  Surveys should measure how safe employees feel in raising concerns.

It also needs to be clear that speaking up gets results.  Those who report concerns deserve regular feedback on the results of speaking up.  And there need to be published stories within the company explaining how the speak-up system works, and recounting examples of how calls and reports resulted in real action:  processes being changed, wrongdoing being corrected, and higher-ups being disciplined for wrongdoing.  

Getting people to speak up is and will remain a challenge.  Wirecard is another good example of why this is so important, and why we need to work at making it safer and easier for people to speak up.  I believe it is extremely rare for wrongdoing to go completely unnoticed by others. There are almost always witnesses and helpers.  If we want to improve in this area we have to work harder at this and replace rhetoric with actions.  Thanks to James Fries for taking action in Wirecard, but we need a system that works before those disasters happen.