Webinar: Data Driven Compliance – Speak Up Culture and Faster Investigations

Transcript for Data Driven Compliance – Speak Up Culture and Faster Investigations

Aly McDevitt: Hello and welcome to today’s webcast brought to you by Compliance Week and ComplianceLine. I’m Aly McDevitt with Compliance Week and I’ll be your host. Today’s webcast is data-driven compliance, pick-up culture, and faster investigations.

Before we hear from our presenters, let me review the agenda. We are scheduled to go for one hour. After the presentation, we will have a question-and-answer session. Your questions will be kept confidential and anonymous so please don’t be shy. You can ask your questions at any time using the Ask a Question function on the left-hand side of your screen, and I’ll post them to our guests at the end of their presentation. After the Q&A, I’ll wrap up the webcast.

This webcast will also offer CPE credit for all attendees. Please be sure you are using either Google Chrome or Firefox as your internet browser and you have disabled your pop-up blockers in order to ensure access to the exam. Once I’ve signed off and the webcast is completely over, the final examination will be presented automatically in a separate window. If you have trouble viewing the CPE test or receiving the CPE certificate, please send an email to webcasts@complianceweek.com. Once again, to ensure receipt of your CPE credit, please be sure you are using Google Chrome or Firefox as your internet browser. If you’ve missed anything, I’ll repeat these instructions at the end of the webcast so stay tuned.

A few other administrative details. At any time during the presentation, listeners can download the slides from the drop-down menu on the left-hand side of your screen. There you will also find the feedback form for the webcast. We welcome your thoughts as we are always looking to improve your experience. If you wish to increase the slide size, you can also hit the view slide full-screen button at the top right of your screen. And lastly, a Help button is located in the upper right-hand corner of your screen for assistance.

I’d like to welcome today’s speakers. It’s my pleasure to introduce Giovanni Gallo. As Co-CEO and Chief Development Officer of ComplianceLine, Giovanni lives his passion for seeing people thrive in the workplace. He helps develop ComplianceLine’s workforce and solutions, which enable compliance professionals to be more effective in their jobs, so they can successfully protect their teams and meaningfully serve their mission.

We also have Nick Gallo, Chief Servant, and Co-CEO ComplianceLine. He has worked with and analyzed hundreds of organizations over his career in advisory services, private equity, and compliance and has seen first-hand the transformative impact compliance and culture can have on generating sustainably superior results. Giovanni, Nick, it’s great to have you both with us. And with that, I will turn it over to Giovanni to get us started.

Giovanni Gallo: Glad to be here. Thank you so much, Aly. Thanks for bringing us into this webinar today. Hello, everybody and welcome. Hey, Nick, welcome to the webinar today.

Nick Gallo: Hey, thanks for having us, guys. Glad to be here.

Giovanni: So, I just wanna go briefly over this agenda. I won’t read it all. But we’re gonna walk through a series of different things today. The first section of this presentation is gonna be about benchmarking. From what we can tell our research in the market is pretty much every compliance leader is hungry to get a sense of what other people are doing, what’s working well for their peers and figure out how they can move their program forward from just kind of doing enough to doing a great job. And we’re gonna be talking about our methodology, the number of reports you get, what to do if things are too low, and so forth.

And then also obviously, last year was a very volatile year. We, you know, try as much as we can to not stay in 2020 but we gotta learn from it and we’re gonna talk about how things changed from last year. And then we’re gonna go into talking a little bit about issue performance. And we’re gonna talk about how the way that you address your issues that come in through your hotline and your web forms and in your office, how that performance can impact not just the risks that you manage, but the culture of your entire organization.

And we’re gonna talk through what we’re seeing as the evolution of compliance and ethics and ultimately talk about this concept of compliance 3.0 which we see, you know, people really around the world talking about. This is where companies are going and this is where best in class companies are performing at this compliance 3.0 level. That’s just a quick preview. Let’s jump into it and see what we got here. So, Nick, tell us a little bit about why benchmarking is important. I think everyone’s on the call today because they care about it. But let’s set the table here a little bit.

Nick: Yeah, thank you. So benchmarking is just kind of a critical function to see where you’re at relative to other folks. Obviously, there are certain nuances with your own business, certain constraints with your workforce or the market that you’re in. That makes, you know, direct sort of apples-to-apples comparisons against benchmarks difficult. But what benchmarking can do is it can give you some insights into how you’re performing over time, seeing at a high level how your metrics are stacking up against your peers. And ultimately, figure out some areas for improvement to really move the needle.

What we talk about a lot with benchmarking is your best benchmark really is yourself. Obviously, comparing to broad industry, you know, benchmarks like this, you know, like what we’re going through today is a critical function. But benchmarking to yourself is the only way to really know if you’re in that continuous improvement mode, and you’re making consistent marginal improvements on, you know, a handful of given metrics.

So, many times we get so kind of bogged down with all the data that we’re bombarded with. Benchmarking, effective benchmarking can become kind of difficult. So, what we try to have our clients do or how we try to advise folks on this topic, is to take this Pareto approach. So, a Pareto approach is really kind of that 80-20 rule. So, 20% of your issues are gonna generate 80%. This is a rule of thumb, a general heuristic, but 20% of your issues are going to generate 80% of your problems. So, it makes the most sense to focus your efforts there.

So, when we’re talking about divergences, from one year to the other, we wanna have some kind of a story to at least anecdotally be able to point to why something moved. And if we don’t have that story, we need to do some research on it to develop that story and that framework. And then to the extent we wanna make improvements, we’re gonna apply again that that Pareto approach. What is going to give us the biggest bang for our buck? Our buck, in this case, being our efforts. What’s gonna move the needle the most?

And the other important piece of benchmarking is it can really help you make your case, to the extent that you kind of takes a baseline measurement. You then can go and perform some activities to improve that measurement. And you can circle back to that later and presumably, if those efforts are effective, you’re gonna see those metrics move in the right direction. This helps provide an added layer of you know, logos or an added layer of logic, whatever, in your internal persuasion to make your case for a new tool for the efficacy of your process, for the new budget that you got last year. This benchmarking, again, whether internal or external, can help give you some pillars to build the structure that ends up being your broader argument for more influence within your organization.

Giovanni: Yeah, so we’re about to get into it. But ultimately, as we talk about this benchmarking, we hope that it helps you understand where you are in your own journey, where you stand in comparison to your peers, helps you figure out where you can focus especially in that Pareto sense of where your gains and where improvement is gonna be most fruitful for you.

And ultimately, I think this is one that people overlook a little bit. I’m so glad that you talked about it so well, Nick, is we can make our case for budget, for attention from executives, for being in strategic conversations across the organization in this compliance 3.0 type of approach. We can make our case better when we have these data at hand. So, let’s jump into it.

So, we wanted to set the stage a little bit here. We’re gonna go quickly over these next two slides. But there are over 130,000 reports in our 2020 dataset. So, there’s really a lot of, you know…this is not a sample set of, you know, 4 companies and 400 reports. There’s really a huge swath of reports across 1,100 organizations and, you know, this is across over 100 countries of reports coming through all of the different channels.

So, we’re gonna be talking about hotlines, specifically, we’re gonna be talking about the whole mix of everything through the office, through online and stuff like that. But I just wanna encourage everyone and let you know that these numbers are based on really a mountain of data, that, you know, as our data analysts have gone through it, have a high level of statistical significance and reliability to draw conclusions from.

As Nick mentioned earlier, you’re always your best benchmark, and you wanna compare where you are against these. And then you always wanna ask the question why, right, because, like, everyone can’t be average. Everyone’s in different industries and going through different phases, but this is what the data are built on.

And then you know, this is the place that Nick and I come from. We work at ComplianceLine. I’m sure, you know, most everybody on the call knows about us. We’ve been around for over 20 years. But these top four yellow boxes, you know, we hit our mobile app, our hotline, our web forms, and our case management system where people input cases when someone sits across the desk for them, or reports something in the office. These are the areas of our business that we have visibility and that drive this whole benchmarking report. So now let’s get into the data. You ready, Nick?

Nick: Let’s do it.

Giovanni: All right, so this is the big one, right. This is kind of, a lot of times, the first thing that people look at. And this is something that, you know, really drives a lot…is related to a lot of the other data points in the full benchmark report. In our ComplianceLine benchmark report, we have really over 10 different robust data points that we work through. But this one, average reports per 100 employees is gonna tell you a lot in and of itself. It has a lot of statistical significance in it.

So, you’ll see here that within the ComplianceLine dataset, our average across the different companies in the dataset was around 4.3 reports per 100 employees. So, if you have 1,000 employees, that’s 43 reports. You can scale this up and down and you’ll see that there’s some divergence across the different size of companies but you can kind of see the range there. And in this report, we try to be as transparent as possible and, you know, kind of help you get a robust view of the universe of compliance. On this traditional comparison kind of what for a long time has been the only information out there on compliance benchmarking, that average was around 1.2, 1.3. So, Nick, talk to us about what we read in these data here and how this changed from last year to this year.

Nick: Yeah, there’s a couple of interesting things here. So, we saw a slight increase last year. Last year, we were at about 4.01 and this year, I think we settled out at about 4.1. So that increase was really attributable to COVID, the COVID impact last year. And then feeding into a lot of the, you know, social challenges that we were having across the country with the election and everything else.

So, what we find is kind of interesting, it’s whatever is kind of part of the general sort of conversation in the country, that stuff is coming through the hotline. And as COVID kicked off…you know, just think back to where we were a year ago. There was so much uncertainty, there weren’t policies in place. We were trying to adjust to this new normal, protocols and so forth weren’t updated, everyone was just trying to kinda keep their head above water. That created a lot of uncertainty across the workforces in these samples. And there was just an uptick of calls about PPE, about COVID, about, you know, do I need to come into work or this person feels sick and so forth.

As the year, you know, moved on, and we got more used to the work-from-home scenario, and things sort of settled down on the COVID front, like I said, we saw an uptick in more sort of harassment, you know, racial type calls later on in the year. So that was just broadly an interesting thing. This is generally pretty stable, you know, moving from 4 to 4.1, or the traditional comparison moving from, I think it was 1.4, down to 1.3. These are relatively stable.

But I think the big opportunity here is the fact that there are a ton of more reportable things out there that are coming through the hotline. So, you know, we have kind of top-performing companies in this metric who are getting 8 calls per 100. Those people have a much more credible program. There is a lower rate of anonymity with people who have those higher reporting rates generally. And, you know, just think inside your own organization. What percent of people have something that they could report if they knew, you know, that it was on them to report? They understood well, you know, the purpose of the hotline, they understood that process and the subsequent investigation, and they believed in the safety of that. The point is, it’s way more than four. So, there are orders of magnitude improvements that most organizations can make to get this rate higher.

But, you know, one other interesting thing is that you see a general decline across organization size. And what we’ve attributed this to, as we kind of double-clicked on this information and dove into some of the constituent companies in these various buckets, is that generally as an organization gets larger, they have a lot more, you know, “compliance” stuff in place. Their policies are more dialed in, what someone needs to do is more well established. The places that folks need to go to get questions answered, whether that’s on an intranet or some other kind of piece of collateral, in many cases, those are more well established. So, we generally see that decline a bit.

So, it’s unclear. I mean, it’s kind of a mix, but it’s kind of unclear the extent to which, you know, people are just lost in the larger organizations and they don’t have that same ownership for their role or for the organization’s purpose or the strong force being potentially, you know, more of those questions that people are calling the hotline to get answered are available in other places.

In any case, you know, across the board, this average is not indicative of what sort of best in class is. So, there’s, again, a lot of opportunity within your own organization. The question you should be asking yourself is, how can I get more reports, how can I get people to speak up more and get them more acclimated with this process because we always say, humans are much better sensors than some piece of technology somewhere. Everybody has a three-pound nuclear reactor between their ears. And if we can actualize those people in our workforce to be those sensors, then we can really start to crowdsource risk management. So, this continues to be a metric that has a ton of opportunity for improvement, regardless of where you’re at.

Giovanni: Yeah, Nick, I’m so glad that you brought that up, because it’s an important frame for us, especially if you’re a leader in your organization, especially if you wanna see your compliance team perform better. I think a lot of people may be asking this question that, you know, we intentionally put at the top here, are you getting enough reports. And, you know, if you’re not, you wanna be asking that question and try to get to enough. But really the area of excellence, the area of people looking at the compliance team, as a leader, as a strategic contributor to the direction and the culture of the company is, am I getting the right reports, can I get more of them.

And it’s a slight difference in frame, but when you’re doing that, you’re not just saying, “Hey, is this okay? Am I gonna get in trouble for not getting enough reports?” That’s very much…you know, we’ll get to this later, but at compliance 1.0, I’m just gonna do what the law requires of me. But, you know, I think it was so interesting last year. Nick, you and I were watching this closely as the months ticked by and we wondered, “Hey, there’s all this displacement, people are working from home, people are more stressed, you know, COVID’s running rampant.” And we wondered if the reporting rate would just fall off a cliff.

And I think it’s really interesting that it didn’t. At least, you know, among our client base, we saw that people who have a strong compliance program, who are prepared for contingencies, who have already built that psychological safety and that trust with their employees, they were not only…you know, kind of held the line, but we saw across these, you know, over 100,000 reports, the averages go up over time of people getting more reports.

And I think it speaks to this type of fully actualized, this type of effective compliance program that is there for all employees, not just the executives, that people turn to the compliance team for these new issues, these new questions asking for help with this, notifying the compliance and ethics team of risks and danger and things like that.

So, I was really encouraged to see…you know, I think it speaks to the professionalism and the expertise of all the compliance leaders across this profession, that we were ready for this as much as we could be. And people turn to compliance teams to, you know, keep reporting in this rather than, you know, things falling off because you couldn’t walk in and see someone face-to-face and report something.

Nick: Yeah, that’s a great point. Real quick. I don’t know if we talked about this earlier but we want this to be a very conversational presentation. So, if you have questions along the way, please dump those into the chat and we’ll handle them as we go. We got a couple of good ones that popped up just now.

So, someone asked, “Are we going to get a copy of this benchmark report?” The answer is only if you ask nicely. No, I’m kidding. Of course, we’ll send this around afterwards. And we have a series of mini webinars where we’re going through this with folks giving them an opportunity to put in their numbers and, you know, brainstorming ways to improve. Absolutely, this will be available.

And then we got another question from John. Hey, John. Why is ComplianceLine’s average so much higher than the “traditional” comparison? That’s a great question. So, my short answer is, I don’t know, but I have a couple of ideas based on people who have come over to us from the traditional comparison, and how they’ve seen their rate move.

So, there’s a couple of things which I think we’ll get into a little bit later. But, you know, we don’t use call queues. So, you know, our abandonment rate is, you know, well under 1% where kind of an average inbound abandonment rate is somewhere around the 10% to 12% range. And we’ve gotten reports from folks who came over of upwards of 15% to 20%. So that in itself could give you a 25%. You know, if you’re subject to a 20%, it’s straight algebra. If you’re subject to a 25% or 20% abandonment rate, your reporting rate could be upwards of 25% higher. So that’s one factor.

Another factor is I think our call experience is a little bit different. We can gather and borrow…as ethics and compliance professionals, we can gather a lot from, you know, consumer goods, or consumer reports, so to speak. You know, when you go to a restaurant and you have a bad experience, you’re likely…you know, based on studies, you’re likely to tell between 16 and 21 people. That same thing is happening when somebody has a “dining” experience on your hotline. So, you know, to the extent that we answer calls immediately, we don’t put people in call queues or race them off the phone. We tend to get higher relative reviews on that process.

And the third factor is kind of twofold. One is that I think we have an oversampling of more highly regulated industries. We have a relatively higher…from what we understand, we have a relatively higher concentration of healthcare in our sample as opposed to the general sample, or the traditional comparison which has a much more sort of general pool across the economy. And the way some of our clients utilize their lines in creative ways also, which we’ll talk about some more later on in the presentation, all kinda feed into that. So, there’s a couple of factors at play. It’s unclear right now, the reason why, you know…what the strong force is, and it’s probably gonna be a confluence of those factors.

Giovanni: Yeah, I would just highlight that there’s definitely some selection bias in here. I think that there are companies that wanna do this right and they join, you know…they have us join their team and help support them. But also, it’s part of how we at ComplianceLine…it’s really in our DNA since our founding in the 1990s to really try to figure out how to do this right. And I think that people are realizing that you don’t have to spend three and four times as much to get three and four times as many reports. Three and four times as much visibility into your organization, as much risk management. It really can be just a small tweak in how you do things. And we’re gonna get into that in the next slide.

But ultimately, you know, comparing it to that traditional comparison, it’s not doing four times as much work to do it, it’s just doing the work right. And it’s taking an eye toward this of we care about employees, we care about supporting compliance leaders, and giving them what they need so that they can do their job well. And ultimately, if we do that, everyone can take care of their people well and we’ll all be successful together.

So, we’re gonna get into some of this. You know, I wanted to pause before getting to this slide because this is not all talking about why ComplianceLine is different from that traditional comparison. But we wanted to kind of interpret some of those things in a way that can give you in the audience some sense of what you can be doing, whether you’re with us or not to be doing this.

So, I’ll take the first one here, Nick. I think this one is obvious but I also think that there’s a lot of room to grow for compliance leaders in awareness and communication. To Nick’s point earlier, you know, if you’re at, you know, 0.8 reports per 100 employees, or even 1.5, you know, you don’t just have 20% growth that you can get. You can get two, three, four times more than that. And I think our awareness in communication can be two and four and five times better. But I think that takes us taking a step back and realizing that not just our workforce is different. Really, the entire industrial system, our entire economy is different.

You know, people talk about us living in an awareness economy, an attention economy, where everyone’s always fighting for the attention of you, right. It’s why your phone’s buzzing. It’s why you get those ads about those Facebook games. It’s why your manager is trying to get you to pay attention to this thing so that, you know, we can all work on this together.

And I think compliance leaders can take some serious steps to do some things right. So, communicate more frequently, right, figure out how to get your message in front of people realizing that, you know, not everyone cares about these regulations and these risks as much as you do. Someone might care about their marketing conversion rates, or their safety on the manufacturing floor, or whatever it is.

So, get in front of people more frequently. I think you can do that by having more interesting communication. So, make it come to life a little bit by, you know, localizing it, by, you know, speaking the language of your employee base, by having fresh, you know…whether it’s videos or messages or pictures or examples and stories, that awareness in communication, you can do it more frequently and do it more effectively.

And ultimately, I think a big piece of this, Nick, is that reaching across the aisle and building alliances with other departments within the organization so that they see that the efforts of compliance are to support their support of our company’s mission. We’re not trying to work against them. We’re not the office of no. I think none of us see ourselves that way. But building some relationships is gonna build awareness within that division underneath that manager to help us get our communication in front of more people. Nick, you feel free to add to that or jump to quality of engagement.

Nick: Yeah, no, nothing to add there. I think, you know, these next two are big ones. So, quality of the engagement is, you know, what I referred to earlier, or at least partially, what I referred to earlier. That was around what does the engagement feel like. Does it feel like a chop shop when somebody is, you know, overcoming their anxiety and picking up the phone to call? Does it feel like they’re getting rushed off the phone or are they met with empathy, dignity, and respect to be treated like a human being, and so forth?

And then, you know, on that follow-up piece is, are you answering those things quickly, right, are you reporting back to the organization. And we’re gonna come down to that some more. We’re gonna talk about that follow-up piece and how important that is. But following up quickly, it lets people know that, “Hey, I’m taking your issue seriously.”

And that follow-up can come in a number of different ways. It can come through communication back to your intake center, it can come through policy changes, it can come through to the extent that somebody is notified, or has been identified. It can come from a direct message to them to let them know that, “Hey, thank you for speaking up about this issue. We’re doing X, Y, and Z to, you know, handle it and adjudicate it and so forth.” And then Gio, talk to us about the top, middle, and bottom, this last one on the report volume slide.

Giovanni: Yeah, before I get into that, I just wanna highlight, you know, we’re talking about data here, we’re talking about data-driven compliance. One thing on that quality of engagement that you can double-click on is to figure out what the abandonment rate is for people who either go to your webform and fall out in the middle of it or it’s a lot easier to get it from your…hopefully it’s a third-party provider for your hotline and figure out what your abandonment rate is. That’s a data point that you can use to very clearly see, you know, very objectively how that engagement is working out, and you can index that. We get into that in the full report. Obviously, we can’t go too deep into it now.

So, the last piece about this report volume kind of gets to building those relationships and how we as a compliance team and in ethics division can really build alliances and help other people in the organization understand why we make their job better and easier and safer.

So, I think a lot of times people are talking about tone at the top. And it’s very important, right. You want your CEO to be backing your initiatives, you want the board to care about the governance things that, you know, you’re pushing. But I think that there’s a lot of room to be gained. It takes a different approach and it’s, you know, more of a one-to-many relationship than to get that mood at the middle right. You know, get some middle managers on the same page with you of, “Hey, if your team can finish this training, if your team understands these policies, then, you know, you’re not gonna have to kind of do a stutter step and start to sing over or whatever it might be.”

That mood at the middle can really have a much more profound effect. You know, they say for that tone at the top that a whisper from the top is a scream or a yell at the bottom. A lot of people listen to the CEO when the CEO speaks up, but also, a lot of people hear much more frequent messages from their manager and those middle managers. And you can, you know, build that support within it. And then ultimately, you have, you know, a limited set. But you have a set of opportunities to speak directly, you know, if you have a traditional orientation of your org chart to that kind of bottom frontline employee and get them to understand that, “Hey, even if your manager hasn’t gotten on board, you can be on board with an ethical workplace. And you can be part of speaking up and being brave,” or whatever message you wanna send there.

So, you know, these are some things that you can do that are within your control to evaluate and hopefully improve. Do that awareness and communication, make sure the way that people are interacting with your hotline, with your webform, with your team are high quality, that your follow-up is good and that you’re getting support and building support wherever you can get it at the top of the organization, at the middle and at the bottom.

Nick: Great question here from John. Hey, John, thanks for engaging. So, the reporting outside the U.S. is typically lower than in the U.S. Correct. Does ComplianceLine have a lower percentage of clients outside of the U.S.?

So great question. We may or may not, I don’t know. Looking at the traditional comparison, from our understanding, about 80% of those numbers are coming from North America with the remaining 20% spread across the rest of the world. Ours is closer to that 90%. But I’m just saying on quick arithmetic, if you assumed all the international calls were at 0 per 100, that would only move the traditional comparison from kind of that 1.3 up to about 1.625. So that doesn’t appear to be the strong force, though it is a factor. So that’s a great catch. Good job, John. You brought your brain today.

Giovanni: Yeah, so there’s a difference there but it’s not driving the difference in reporting rate. We’re working on a follow-up that’ll probably be out in third quarter for an international benchmarks, you know, addendum or survey. So, you know, we see…we have a material amount of international coverage and we see people wanting to get that deeper comparison of, “Yeah, I have a bunch of people in the U.S. and they’re in Europe and Africa and stuff like that.” So, we’re working towards that. We hear that question and we’re working on it for you all.

So, one other question here. Listen, I love this interaction. Thank you, guys, for throwing these questions in. We’re here today not just to hear ourselves speak. You know, we hear ourselves speak all day, right. We wanna be useful and helpful to you also.

Nick: Speak to yourself.

Giovanni: We wanna be useful to you so please throw these questions in. I agree that support for management is key to a successful compliance program. What are some alternatives if you do not have this management support? And, you know, I think that that’s the right question to be asking and, you know, I would maybe just tweak it a little bit and it would be, how can you build that management support. You know, I think a lot of us are, you know…and maybe the entire profession is dealing with, “We don’t have the support and the buy-in and the interest across the [crosstalk 00:30:33] employee population that we’d like to have.”

So, I think you wanna really be thinking about how can I make a step forward here. And I think that, you know, a few things come to mind. I think you wanna start talking to your full compliance team about this being an important thing. Just like we were talking about earlier that it doesn’t take four times the budget to get four times the reporting rate, it doesn’t take four times as much time, but it does take some consistent effort, right.

You know, it does take maybe telling your team, “Hey, if you have some friends in other divisions, you know, let’s get their perspective on this. Maybe, you know, ask them in an informal survey.” You know, I think reaching out to people for a coffee chat, it could be a virtual coffee chat if you want. But just saying, “Hey, I’m in compliance. There are times that I make decisions that affect your team. And I never wanna make that from an island, I never wanna be kind of throwing stones across the river at you. Help me understand what’s important to you, let me see if I can do something for you.”

So, I think reaching out and building those personal relationships is gonna help to humanize what we’re doing. And then people might say, “Okay, you know, I always…” You know, I was talking to somebody and they were like, “Yeah, before I post anything on LinkedIn, I gotta put it through compliance so I just don’t even do it at all.” And I encourage them, “Hey, why don’t you have the conversation?” They’re probably gonna be reasonable and say, “Hey, here are our concerns, you know, here’s what you can do and here’s what you have to check with us on.” And I think that personal relationships can be a big thing. And, you know, Nick talks a lot about utilizing your compliance assets and tools in ways that are gonna benefit other departments. Tell us a little bit about the idea lines and stuff like that, Nick.

Nick: Yeah, maybe let’s jump to the next slide. I think that’ll feed into it well. So, you know, ECI came out with a great report earlier this year. And this report showed that 70…this is a true number. 79% of people who reported or spoke up felt retaliation. So that is a massive number, that’s a massive problem. That increased from, I believe, 44% in 2017 or 2018. So that almost doubled. So, at some level, that’s going on in your organization.

So, there’s a massive opportunity for us to get folks to engage in this process so that they can become more comfortable with the process so that when something actually happens, then they can, you know, know to pick up the phone or know to go to whoever and report it. So, we’ve seen some folks start to get a little bit creative with the assets that they have in place, to Gio’s point. And what we’re talking about is creating an ideation line or gratitude line.

And these are some things…you know, you have all these people in your organization. They all have ideas. They all have things that they’re thankful for. They’re all seeing behaviors that may or may not be in line with the values of the organization, or the mission that your organization is pursuing. We wanna get those people activated to be speaking up about things. So, we utilize these gratitude lines to, you know, give a compliment to somebody. It may sound silly, but it’s really smart and there’s a lot of behavioral science behind it. Or an ideation line, you know, perhaps you’re in a factory setting, or a manufacturing setting. There are a ton of people who have been working on that shop room floor, who have great ideas about how to improve things.

So, you know, some ideas have been to have a campaign that rolls out an ideation line, rolls out that gratitude line. And, you know, a commensurate push from all the managers in these various different areas in these different departments in your organization to get people to engage with that process, to pick up the phone and talk about something positive. So that, again, when there’s something negative that pops up, they’re going to, you know, engage in that and speak up as well.

So again, you know, we’re gonna get to this compliance 3.0 thing, but it’s about being more strategic with our efforts. It’s about working smarter, not harder, to create those points of leverage to make our system, to make our department, to make our efforts have a bigger impact in our broader organization.

So those are a couple of unique ways folks have done that. But again, think about HR. Like, you should be buddies with HR. You’re both many times viewed as cost centers in your organization. You both struggle to get the buy-in from different departments. You both often feel like you’re pushing a string up the hill. Well, reach out to those folks. And again, utilize your assets that are in place for a DNI push. Perhaps there’s a DNI push that HR is trying to do. Well, great. Push that out and let them utilize this framework that you already have in place, this intake channel to provide something to them that leads to some reciprocity and some of that internal persuasion that can ultimately increase your power and influence within your organization.

But, you know, big picture. If you’re not willing to do that, or it seems too kind of radical, here are some basic things that you can do if your rates are too low to improve them. So, cross-reference other benchmarks. Great, you’re here now, you’re doing that. Look at historically where…you know, within your own numbers, was there a point in time when your metric was higher than it is now? What has changed since then? Has there been a changing of the guard? Has the culture deteriorated? Have we as managers taken our eye off the ball in terms of the, you know, working environment that we’re trying to create for folks?

Look at other reporting channels, see where people are reporting. And put concerted efforts, especially in the context of the new normal, this new work-from-home, you know, environment that we’re in. Re-look at what your strategy is to drive reporting. Is it more frequent interactions? Is it more frequent newsletters?

Something we like to say is…you know, to that question that came in earlier, if you don’t…you know, if you can’t get the support of the colonel, the CEO, well, then you get the support of all the generals. Go to those folks and talk about the retaliation issue. Go to somebody in manufacturing. Go to somebody in marketing and talk about, “Hey, there’s potentially a retaliation, a fear of retaliation issue here. What can we do to address that together?” And get them to pepper their own correspondence with this, you know, the similar harmony from the song that you’re singing.

Dig into issues on quality. So how long are your cases staying open? Are you closing those quick enough? Are you reporting back to folks whether directly or indirectly that something is being done about this thing that they spoke up about? Are you peppering your monthly newsletters or have you gotten the ear of the CEO and gotten him to pepper in anecdotal stories of compliance violations or making a hero out of somebody who’s raised their hand and spoken up?

If those are behaviors that you want other folks to emulate, you have to, you know…a culture is just what you celebrate and what you reject, right. So, if you want people to emulate that type of behavior, then start to celebrate those behaviors. And it’s just, it’s like magic, you start to see more and more people follow that lead.

And then finally, listen to your population. So, to the extent that somebody has reported and identified themselves, take a sample of those folks, reach out to them, and have a quick conversation about what worked, what didn’t work and try to get into the mind of the person who has spoken up so you can get some clues on how to get other people to do it. Many times, there’s a personality type cut against an environmental factor and some sort of item that catalyzed this whole sort of process. And so, once you have a few of those conversations, you’re gonna probably get…again, back to that Pareto thing. You’re probably gonna get a couple of things that you can work on that are really gonna move the needle.

Giovanni: Yeah, thanks a lot, Nick. Listen, there’s a bunch here that you can do. And it’s really part of what we try to do to make the world a better workplace at ComplianceLine is give you all actionable things that you can work on. So that benchmark report that you’ll all have access to, for each of these issues, has a guide of, you know, what you can do if you’re above or below it, how to diagnose, you know, whether that’s good or bad, and what to feel about it.

So, you know, I hope that’s useful for you all. And if it is, and you have questions, feel free to get in touch with us on LinkedIn, or get in touch with us directly at work. We’d love to answer questions about how to kinda troubleshoot this. Because really, you know, we want what you want, we want your employees to be taken care of, we want your compliance program to be a center for excellence within the company.

So, there are two other big data points that we wanna talk about here. And we’ll try to hit them quickly for the sake of time here. But, you know, one important one is this one, your reporting channels. So, this is indexed to reporting channels per 100 employees, because it’s such a big deal, right. You know, if a third of your reports are coming online, but that’s only 0.3 reports per 100, well, that’s very different from, you know, 0.4 reports per 100 coming in, and it’s a smaller proportion.

So, we think it’s important to look at it this way, not just the split across these channels, but really the split among the issues that you get. And as you’ll see here, there’s broad stability across the years on total issues received really in both datasets. But the big change, really, the big highlight for me is from 2019 in the middle to 2020 on the right. There was this big drop in that gray area. That’s the in-office and in-person reporting.

So, I think a lot of us would have anticipated that, right. A lot of people were dealing with work-from-home things. Even if people were in office, they were maybe less inclined to sit across the table from somebody and report something. So that was maybe less surprising to me. What was more surprising to me is that that volume didn’t just go away. People didn’t just stop reporting at it. At least in our dataset, that volume moved over to the hotline. And, you know, you can see some of it moved into online reporting. For us, that’s using our mobile app, using a variety of web forms that we have, or using texting via your mobile phone.

That went up a little bit, but most of that volume went to the hotline, which to me, Nick, speaks to the fact that there are some things that people want a human interaction with. They don’t wanna just dump information. Listen, everyone has a mobile phone. You have to be making that stuff available because you don’t wanna miss out on this 0.36 or these 0.44 reports per 100 employees by not having that available at all. But it was so interesting that people decided instead of talking to somebody in person in the office, I’m gonna go to hotline instead of, you know, that all going to online. Anything else you wanna highlight here, Nick, before we go to the next slide?

Nick: Yeah, I mean, I think this is not that unique. I mean, I think at a high level, it might seem unique and counterintuitive when we’re like, “Oh, well, we’re more digitally native now. And people, they don’t wanna talk to anybody in these new generations and so forth.” Yeah, perhaps, yeah. But I think we’ve seen the same thing, like, on Amazon. Like, think back five years ago. If you had an order issue on Amazon, you had to spend 30 minutes trying to find a phone number.

Now you can find those immediately, they pick up the phone immediately. And they’ve understood that again, for some things, you just wanna talk to somebody to get your questions answered. And so, we’re seeing that in other pockets in our economy. So, you know, I think, again, at first blush, it’s kind of surprising. But then when you kind of dig into it and kind of triangulate across some of these other things, you can see it’s not really that uncommon. Particularly in the context of COVID when, like, people just had so many questions. They had nested questions that were a function of the last answer they got.

So, for certain things, this [inaudible 00:41:29] channel is super important. But I think if we move to the next one, if we move to the next slide, I think it helps to…you know, so many of these metrics, like, you can’t look at them in isolation. These are, you know, different dimensions of the same shape. So, you have to look at them in concert with some of these other metrics.

And you can see here. So how did things change last year? As we move to the next slide, you’re gonna see kind of what I’m talking about. But maybe I’ll just jump ahead at this point. So, we saw a lot fewer in office, we saw more reports, we saw a lot fewer in office. Well, what does that mean? Well, that means that less reports are coming in through the office. Great. See? I brought my brain today too.

Less reports are coming through the office. So, if substantiation rates are correlated within office reports, meaning it’s easier to substantiate something that’s happening that’s reported in office, then we should see a commensurate drop in substantiation rates, perhaps due to this factor, and that is, in fact, what we saw on the next slide. But, before we get into that, sorry to jump ahead, G.

Giovanni: Yeah, go ahead.

Nick: Let’s talk about this slide because I love a great Venn diagram, especially when there’s three circles to it. So, what did we see? We saw a lower in-office. That’s what we just kinda talked about. We saw steady online, and we saw it balanced to the hotline. So again, just to kind of reiterate, our big drivers were work-from-home, you know. People couldn’t walk into a manager’s office and report something. The COVID concerns which, you know, we’ve all lived through and there was a lot of chaos from that. And then all those social issues, the social challenges that we were seeing throughout the year with the protests and all that kinda stuff leading up to the election. All those things were kind of top of mind that kind of contributed, the confluence of those factors contributed to, as drivers to, you know, what we saw from a reporting channel perspective last year.

Giovanni: Yeah, let me just hit…you know, we have a little over 10 minutes left. Let me hit two of these questions that came up briefly. And I’d be happy to take follow-up offline from anyone. One of the questions is what issue type or category is the most reported in our dataset?

So, it’s a great question. It’s one…you know, it’s maybe data point four in our dataset, but we break that out. And for us, the biggest one is HR and the second biggest one, correct me if I’m wrong, Nick, but it’s business quality. So those HR issues are something about a manager or staffing or, you know, a question about policies and things like that. And, you know, there are other categories that we track for, you know, info security and safety. And, you know, that safety would be questions about infection and stuff like that.

But the second biggest one, for us, is business quality, which I think speaks to…when you’re getting this higher reporting rate, you are doing things that get people to speak up about more than just the absolute obvious blatant thing that, you know, you’re getting when you just get a few reports. So that business quality is dependent on what industry that you’re in. But, you know, if you’re in manufacturing, maybe it’s the quality that comes off the line. If you’re in finance, maybe it’s the way that people are treating and qualifying lenders. If you’re in healthcare, it’s the quality of patient care.

But what we find among our clients is that those business quality issues, that’s really how people see them upfront, but it comes into the hotline or it comes into the report that way because they say, “Hey, something’s wrong here.” You know, I mean, the truth is they don’t know exactly that it’s violating this regulation. And they don’t, you know…as much as we would like them to, they don’t trace it back to, you know, this quote within the policy, but they say, “Hey, this isn’t good for our business, I think compliance should know about it.” And I think when you’re running a compliance 3.0 effectiveness space program, you start seeing those quality issues. But to the question, HR issues were the biggest in our sample set.

Nick: Yeah, Andrew, great question. Thanks for bringing that up. The one thing I’ll add to that great rundown, Gio, is just total transparency, full candor. This is the metric that has perhaps the most noise in it just because it is so subjective. And people categorize things differently depending on their organization and their policies and their code and all that kind of stuff.

So, you know, this is a great kinda high-level, you know, benchmark just to kinda see where you fall. But the real insights are gonna come from changes in your own categories, assuming that those are stable from year to year. Changes in your own category, year over year, are gonna give you the best insights as to, you know, where to look for the anecdotes as to why something changed.

Giovanni: Okay, awesome. So, let’s move into this last one. This is the one that I get the most excited about. And yes, I do get excited about all of these. But, you know, this issue performance is…you know, this chart on the right here is showing how long does it take for you to close your issues, for you to finish an investigation and figure out where something goes. This left chart…we’re kind of double-dipping here but that’s your substantiation rate. And we see that these two things together get to kind of the quality of your follow up process, the quality of, you know, your compliance system in not just kind of taking care of risk but also, this is really critical, taking care of making sure that this issue is addressed for the sake of employees.

And what we see is this is really a stark contrast from the traditional benchmark and that’s why we’re so excited to share it with the world, is that we see people when you have good intake, when you have thoughtful elicitation, when you have adaptive interviewing on the front end, that goes into good notifications to your team, the right routing so things aren’t sitting in an inbox unaddressed and ultimately, a good case management system to keep all this stuff in place. We see, you know, very near 80% of issues across this massive dataset getting closed out in under 30 days.

So that’s something that, you know, if you’re not doing that, that might be a big indicator of, “Hey, let’s try to get this metric down. Let’s be data-driven, continuous improvement in this.” And I think you’ll see that as you figure out ways to impact that day’s issues outstanding, this rightmost graph here, you’re gonna see a lot of other things working well. And, you know, you’re gonna start seeing this kind of flow through the loop of your system of people believing and then trusting compliance more. Ultimately, getting more substantiated issues, and this whole machine running more smoothly. Nick, you wanna talk about anything else before we get into the evolution of compliance?

Nick: No, I think you nailed this. The one other thing I guess I’ll add is that, you know, interestingly, our average days to close a case increased two days. It was 23 last year, it got up to 25 this year. But in spite of the work-from-home scenario, which most people found themselves in, the percentage of cases that closed in less than 30 days went up. So, while the average went up a little bit, they were, you know…cases, in general, were process more efficiently, with less…with approximately 80% closing within the first 30 days. So that’s kind of an interesting sort of counterintuitive movement.

Giovanni: Thank you, Nick. So finally, we wanna just, you know…in the context of this, we don’t wanna finish this webinar today without talking about this framework which, you know, we found is a really effective way to benchmark not just your whole program, but even pieces of your program. So, I’ll go over this briefly, Nick, and then I think we can spend some time on the last slide, kind of talking about the nuts and bolts of this.

But compliance 1.0, we kind of think of this as 1990-style compliance. This is before Sarbanes-Oxley was even here, this is before kind of governance, even in public companies was a big thing. And the compliance team, if it was in place, was primarily focused on what is gonna be enforced by the courts. You know, maybe by journalists, you know. There’s about to be an expose so we better do something. But it’s primarily kind of this legal-only focus, and let’s keep the boss out of jail.

And note, as we progress to 2.0 and 3.0, we’re not leaving any of this behind. We’re not failing to do the, you know…meet government regulations. But we’re adding onto the program and we see that as you get into 2.0 and 3.0, your ROI really starts to spike because you’re getting more out of the things that you already have in place.

So, compliance 2.0, we call the efficiency pitfall is, you know, the industry over the past, you know, maybe 15 or 20 years has been saying, “Okay, well maybe a vendor can help with this. Maybe we should have a third-party reporting, you know, whistleblower hotline. Maybe we could get some software and some dashboards so I’m not, you know, manual doing all my own reporting.” And it’s really, you know…ROI decisions are at best, you know, what’s gonna make our team more efficient, and allow us to kinda get more done with less.

That compliance 2.0 mentality, we think is where a lot of programs are at. And, you know, it’s not to disparage anyone. And again, you know, we didn’t make up age of effectiveness. It’s what everyone’s been working towards. But I think it speaks to that frustration when you feel like, “Well, people just view compliance and ethics as a cost center. People view us as a necessary evil instead of what we are, someone who…you know, a team who really makes the whole company better, and makes everything run more smoothly.”

And that place where we wanna get to, we call compliance version 3.0. This is the age of effectiveness. This is not just I care about the boss, not just I care about the boss and what the CFO thinks so I need to be efficient and, you know, spend my money well. But hey, how can I use what I have? How can you use my team, the intelligence, and professionalism that I have to be truly effective for every employee in the organization?

And that means that I don’t only care about the people who are gonna sue us for discrimination, I just don’t want people discriminated against within our workforce. You know, I don’t just care about the fraud that’s gonna get caught. I don’t want us committing fraud, because we all know that when this is running better, the whole company can run more smoothly, and we can, you know, hit more squarely within our mission more quickly. So, Nick, you want anything on this before we move to the next slide?

Nick: Yeah, I think, you know, the biggest symptom of being in compliance 3.0 is that everybody in the organization views ethics and compliance as a strategic adviser. Everybody in the organization…not everybody, but you know what I’m saying. You’re not viewed as this other thing. So that’s the best sort of indicative or the best indication that you’re sort of cresting into this compliance 3.0 space.

If you still feel like you’re fighting for the budget, if you still feel like compliance is an afterthought, it just is a symptom that the effectiveness isn’t where it could and should be. Once we hit that compliance 3.0 piece, it’s not like there’s not gonna be challenges, right. Like, it’s not like, “Oh, it’s all just butterflies and roses and we’re skipping up the mountain together.” It’s really that we have a new set of tools, and we’re able to crowdsource risk management attack problems in a new way because we have engagement.

So, we see higher employee engagement in compliance 3.0 companies, we see higher stock prices, you see lower employee turnover, you see stronger cultures, you see more reports. These are all the tailwinds that end up making a compliance function or an ethics and compliance team that’s in this compliance 3.0 framework, way more effective and have more influence in their organization.

So, we have a couple of minutes left. I really wanna jump to this next slide to really kind of button this whole thing up, and then we’ll pass it back to Aly to wrap up. So, Gio, talk to us a little about how we can use data to create a compliance 3.0 program. Again, utilizing what we have in place. We don’t need to do…we don’t need double the budget. To your point from earlier, G, we don’t need double the budget to ascend from 2.0 to 3.0. It’s really a shift of focus and a little bit of a change of how we’re utilizing our tools. But show us how we can use data to make that happen.

Giovanni: Yeah, thank you. So, you know, I would consider the audience or encouraging the audience to consider this as…look on this slide…you know, you all have access to download these slides. Look on this slide to figure out how you can tie the data that is in this benchmark report to some action items to move more completely into a Compliance 3.0 program.

Again, we didn’t make up this effectiveness thing. We’re all driving toward it, you’re driving toward it too. So, you can use these data to evaluate your maturity. And you might say, “Hey, you know what? I’m doing great on reporting rates, but I gotta get a little bit better on anonymity and substantiation. So let me kind of, you know…that part of my program could use, you know, an upgrade from 2.0 to 3.0.” Use these data to dig in and address your underperformance.

So, you know, like, we like to say here at ComplianceLine that reality is our friend. So, seeing that these numbers are bigger than you’d like or not where you’d like them to be, that just gives you visibility. That’s something you know now that you didn’t know before about, “Hey, you know what? This is part of what’s driving my frustration, this is something I can do to me make things better.” You know, use this to address that underperformance. And you know, back to kinda slide four or something, use that Pareto approach of what is the area or the metric that, if I move that, that’s kind of 20% of the metrics that’s gonna make 80% of the improvements.

So, you use these data to direct your improvement, right, where you’re focusing on that. And ultimately, listen, this is an ongoing challenge, is making the ROI case. You know, we’ve been doing consulting sessions just, you know, with people in our client base and other people in the market on how to make a better pitch for your ROI. Because listen, budgets are tight. We see a bunch of people…there are more hurdles to get over to spend some more money or to increase your budget.

It’s happening in every division, including compliance. But if you can make the case, if you can speak the language of the CFO or of the executives and you can make the ROI case based on these benchmarks and say, “Hey, you know what? Other people are getting this. They’re probably not spending five times as much as we are. We just need to do things a little bit differently.”

And you can make the ROI case. You know, we have a document that walks you through this, but you can kind of build it on that 3.0 framework. “Hey, we’re gonna get some return from avoiding risk.” But that’s not the only thing that compliance does. We’re gonna get some return from driving efficiency. My team doesn’t have to spend six hours a week doing reporting, whatever it is. We got a dashboard.

And then you’re gonna make some return on improving culture. People are engaged, they speak up more, you get this virtual cycle going, you know, there’s not as much turnover in your organization and things like that. So, these are just some ways that you can use these benchmarking data to actually drive a difference in your organization. I think the worst thing that we can do is present this webinar to you, give you this data, and not allow you to take action. If this just leads to some navel-gazing, then, you know, we could’ve been, you know, working some issues or working with our team.

But if this can help you use your intelligence, use your professionalism to really make a change on some high-value, high leverage things within your organization, then this webinar, hopefully, has been time well spent. And you can get on the path to getting more accurate in directing your improvement in increasing the maturity of your compliance program.

Nick: That’s phenomenal. So, Aly is…we’re gonna pass this back to Aly. A couple of questions in the chat that we’ll try to follow up with after the fact. But Aly, we’ll pass it back to you right now.

Aly: Thank you so much. That was great, both of you. You did a fantastic job. And I’m sorry that we ran out of time. So, for our audience members, if you would like a copy of the slides just presented, you can download it from the drop-down menu on the top of your screen. Unfortunately, we do have to skip over the Q&A part of our session but thank you so much to Nick and Gio for taking questions as you went on.

And, again, everyone, our speakers today were Giovanni Gallo and Nick Gallo and I’d like to give a special thanks to ComplianceLine for making this webcast possible. Once again, to obtain your CPE credit for this presentation, please disable your pop-up blockers in order to access the exam. The webcast will close automatically and the final examination will be presented in a separate window. If you have trouble viewing the CPE test or receiving the CPE certificate, please send an email to webcasts@complianceweek.com.

This webcast has been recorded and will be available later today to Compliance Week members on our website under the webcast tab, which also contains a library of additional CPE webcasts. If you’d like to learn more about becoming a member, please contact us at info@complianceweek.com.

Some of you may know the Compliance Week has recently lowered our membership pricing from $11.99 to $3.99 in order to build a larger community of practitioners. As a full member, you get access to tools and resources, discounts to conferences, and full access to our website. For today only, we invite you to use code WEBCAST365 to receive a membership for just one dollar a day. Check out complianceweek.com/membership to learn more. This concludes our webcast. Thank you so much again for joining us and goodbye.