Compliance & Ethics
PROFESSIONAL
Vol. 8 / No. 5
10-‐11 / 2011
TOP STORIES INSIDE
8
The seven biggest
mistakes companies
make that erode ethical
culture and destroy
reputation
20
Culture and values:
Driving innovation in
ethics and compliance
24
Understanding the
compliance risks of
deemed exports
34
The “why” of
misbehavior: Recent
advances in behavioral
business ethics
42
In the Spotlight: Alex
Brigham, executive
Director of the
Ethisphere Institute
Meet Paul Fiorelli
Co-‐Director of the Cintas Institute for
Business Ethics at Xavier University
Society of Corporate Compliance and Ethics
This article, published in Compliance & Ethics Professional, appears here with permission from the Society of Corporate Compliance & Ethics. Call SCCE at +1 952 277-4977 or 888/277-4977 with all reprint requests.
FEATURE INTERVIEW
Meet Paul Fiorelli
Co-‐Director of the Cintas Institute for Business
Ethics at Xavier University
An interview by Adam Turteltaub
AT: You had an interesting
introduction to the hands-on
world of compliance—straight
into the US Sentencing Commission. How did that come about?
PF: I began teaching legal
studies in business in 1983 and
starting researching and writing
about white-collar crime. I was
tenured in 1988, just after the Federal Sentencing Guidelines [FSG]
were passed, and I wrote a few law
reviews about them. My real interest in compliance and ethics took
off after the Chapter 8 Guidelines
were passed in 1991, and much of
my research since then has dealt
with these issues. To further my
research, I applied to be a Supreme
Court Fellow, with the hopes of
working at the US Sentencing
Commission. I was selected to
work at the Commission from
1998-1999. During my Fellowship
year, my boss and mentor, Paula
Desio, encouraged me to pursue
my interest in Chapter 8.
AT: It must have been a fascinating introduction. What did
you find most surprising about the
Commission’s work?
PF: People
joke about things
being
“good
enough for government work.”
I found that
this could not
be further from
the truth. My
friends and colleagues at the
Sentencing Commission, especially Paula, were
hard working and dedicated
to Sentencing Reform. I was a
little surprised that even though
Chapter 8 almost single handedly created our current corporate
ethics and compliance industry,
it seems to be a small part of the
Sentencing Commission’s mission.
Various Commissioners have been
passionate about Chapter 8, but
overall the Commission is, rightfully so, focused on Congressional
mandates.
AT: You stayed involved with
the Commission and became a
member of the Ad Hoc Advisory
Group, which had a profound
impact on the FSG. Looking back
at the changes you recommended,
14 COMPLIANCE & ETHICS PROFESSIONAL OCT/NOV 2011
and that were ultimately made,
have you been pleased with how
compliance programs have evolved
as a result?
PF: I’ve been very interested in
the evolution of ethics and compliance programs. Chapter 8 has had
a significant impact on corporate
America, and how organizations
view ethics and compliance. Before
Chapter 8 became law, there were
pockets of industries concerned
with this question. The defense
industry is a great example of a
sector that took a leadership role
in wrestling with what an effective compliance program should
look like. The Defense Industry
Initiative provided a framework
for Chapter 8. Also organizations
like the Ethics Resource Center,
888 277 4977 +1 952 933 4977
www.corporatecompliance.org
the Ethics and Compliance Officer Association, the Health Care
Compliance Association, and certainly the Society of Corporate
Compliance and Ethics have all
played pivotal roles in advancing
best practices within our industry. I was very pleased to be a part
of the Ad Hoc Advisory Group,
because we were able to take a
very good program (Chapter 8),
and make recommendations that
could make it better.
AT: Are there any areas of
disappointment?
PF: I wish the ethics and
compliance communities could
get more information from the
Department of Justice [DOJ]
about how important an effective
ethics and compliance program
is for Non-Prosecution Agreements or Deferred Prosecution
Agreements. I won’t get into the
specifics, but I once attended
a panel discussion in which an
Assistant US Attorney told the
group that the DOJ recommended
that a large organization receive a
significant criminal fine reduction.
Even though the company made
a mistake, it cooperated with the
investigation, accepted responsibility, and was considered to have
an effective compliance program.
The Assistant US Attorney even
mentioned they had a press release
to this effect. I was eager to see
this and asked if I could have a
copy of the press release, thinking
this was exactly the kind of material the ethics and compliance
www.corporatecompliance.org
communities could use to confirm
the importance of their programs.
Unfortunately, when I received the
press release, instead of focusing on
the fine reductions because of the
company’s compliance programs,
it stated how the DOJ had punished another corporate felon, with
a huge criminal fine—another
notch in the belt. I thought, what
a missed opportunity. Now I
understand the DOJ isn’t in the
business of being a publicist for
corporations that have had problems, but a clear indication that
organizations with effective ethics
and compliance programs will be
treated better than those without
these programs would have helped
our community immensely.
AT: The last round of changes
to the FSG provided new incentives for compliance and ethics
officers to have a direct reporting
relationship to the board. What do
you think of the change?
PF: The Ad Hoc Advisory
Group looked at the position of
the chief ethics and compliance
officer [CECO], during our study
from 2002 to 2003. We noticed
that the CECO occupied different
positions within different organizations. At some companies, the
CECO had “a seat at the table.”
She/he was an important part of
the decision-making process. At
other organizations, we were not
sure whether the CECO was being
taken seriously. We recommended
the Sentencing Commission
change the definition of an
888 277 4977 +1 952 933 4977
effective program to prevent and
detect violations to now include
a compliance or ethics officer
who did have appropriate authority, access to senior management
and the board, and resources to
carry out their mission. The 2010
amendment takes this one step
further, but it deals with a different
question. With the amendments,
companies can still be considered
to have an effective ethics and
compliance program, even if a
senior manager was involved in a
violation, if the CECO had direct
access to the board. I think this is
a logical extension of what the Ad
Hoc Advisory Group had hoped
for, back in 2004.
AT: One of the consequences
of the change and some recent
settlements is that we are seeing
a push to move Compliance and
Ethics out of the General Counsel’s office. Many believe that the
GC’s obligation to defend the
company potentially creates a
conflict of interest when managing compliance. What’s your take
on this issue?
PF: Overall, I’m not sure
I agree with it. Many CECOs
I know report directly to the
company’s GC, oftentimes with
excellent results. When the GC
and CECO work as partners,
there can be some excellent synergies. One tension can arise when
it may appear that the GC and the
CECO have different ideas about
how much information should be
CONTINUED ON PAGE
16
OCT/NOV 2011 COMPLIANCE & ETHICS PROFESSIONAL 15
Meet Paul Fiorelli, Co-‐Director of the Cintas Institute for Business Ethics at Xavier University
FROM PAGE
CONTINUED
15
transmitted to boards. CECOs
may want to err on the side of full
disclosure and transparency, while
GCs may not believe every potential issue needs to be brought to
the board’s attention.
AT: But how do you work
around that potential conflict if
the GC is the CECO’s boss?
PF: That’s a little tougher, but
regardless of where the CECO is
housed or to whom she/he reports,
there’s always a potential conflict.
The question becomes: What
does the CECO do when she/he
encounters this type of conflict?
Let’s assume the CECO was a
co-equal to the GC and reported
directly to the CEO, along with
the Audit Committee. If the CEO
disagrees with the CECO, how
is this different from the CECO
reporting to the GC, having the
GC report to the CEO, and then
having the CEO disagree? How
strongly do you disagree with the
CEO’s or the GC’s position? If you
are passionate about the issue, you
will use your position and political
capital to escalate it to the board.
AT: Your interaction with
the compliance and ethics community is an unusual one. You’re
not a consultant and haven’t been
a compliance or ethics officer.
Instead you teach and spend a lot
of time with the community. Tell
us a bit about your work.
PF: I’ve been very fortunate to have such a close working
relationship with the Ethics and
Compliance communities. I like
working with groups like SCCE,
HCCA, ERC Fellows Program,
ECOA [Ethics and Compliance
Officer Association], DII [Defense
Industry Initiative], PLI [Practicing
Law Institute] and the Conference
Board. I also enjoy working with
companies and associations, either
giving keynote addresses, or helping
develop their ethics training. As an
academic, these collaborations allow
me to test my theories with practitioners. I try to bring these “battle
tested” theories into the classroom,
and hope they make me a better,
more applied professor. There’s
nothing I enjoy more than hearing
a student say that something we
discussed in class last week helped
them in business this week.
AT: Invariably, discussions
about compliance and ethics turn
to a discussion about the attitudes
of students and what is being
taught in schools, particularly in
business schools. How has the
teaching of ethics and compliance
evolved as a whole, and how do
you personally address the issue of
ethics in your teaching?
PF: I teach required courses,
business law and values, in our
undergraduate, graduate, and
Executive MBA programs at
Xavier University. We are a Catholic Jesuit university, and I’ve
always been very pleased with how
receptive students are to discussing ethics. I try to weave ethics
into as many lectures as possible.
I also teach two graduate business
electives dedicated to ethics: (1)
16 COMPLIANCE & ETHICS PROFESSIONAL OCT/NOV 2011
Business Ethics Through Film,
and (2) International Ethics in
London. In my Business Ethics
Through Film course, we watch
full-length movies (including Wall
Street, Glengarry Glen Ross, Enron:
The Smartest Guys in the Room,
Inside Job, Syriana, The Informant,
and many others) to discuss questions dealing with greed, hubris,
loyalty, pride, corruption, and
stewardship. In my International
Ethics in London course, grad students come to London over spring
break and we have ethics briefings
with companies including AIG,
BP, British Telecom, Dunnhumby,
and non-governmental organizations, such as Privacy International
and Transparency International.
AT: You just led a group of
undergraduate students to the
United Kingdom on a trip. Did
they get any insights into the complexities of a global compliance
and ethics program?
PF: Yes, but not always in the
traditional sense. In addition to
learning about the FCPA [Foreign
Corrupt Practices Act] and employment discrimination laws, we
viewed ethics through many lenses.
We attended Les Miserable, and I
asked students to discuss strict
legal compliance versus aspirational goals by comparing the two
main characters – Inspector Javier
and Jean Valjean. Javier represents
a formalistic approach, similar to
Immanuel Kant. Valjean represents
the quality of redemption and the
possibility of forgiveness. We also
888 277 4977 +1 952 933 4977
www.corporatecompliance.org
went to the British Museum and
discussed the controversy surrounding the Elgin Marbles from
the Parthenon, and whether they
should be returned to Greece.
AT: I understand you met with
the compliance team from BP. That
must have been fascinating. What
can you share about the meeting?
PF: First off, the Ethics and
Compliance community has been
very generous with their time
when they host my students. This
has been repeatedly demonstrated
by my colleagues at BP, Tom
McCormick and Tim Langton.
Both Tom and Tim are senior
ethics officials at BP, and have
given exceptional ethics briefings
to my undergraduate and graduate
students pre-, during, and postGulf oil spill. Since the spill, my
students have come into the meeting expecting to dislike BP, but
they have walked away with a different impression of the company.
Both Tim and Tom have been
exceptionally candid about BP,
mistakes made, and lessons learned.
The company is humble, and realizes the importance of listening to
everyone, even “the quietest voice
in the room.” I really like that concept, because human nature tells
us we address the concerns of the
“squeaky wheel,” but oftentimes it
is these quiet voices that can be the
eyes, ears, and sometimes the conscience of an organization.
AT: Do you have any predictions about the future of ethics
and compliance?
www.corporatecompliance.org
PF: The Federal Sentencing
Guidelines for Organizations have
had a tremendous impact on the
ethics and compliance communities. Most large organizations
now understand the importance
of having a helpline (including
whistleblower protection), a code
of ethics, training, good internal
controls, monitoring, and process
reviews. These are all parts of the
seven minimum requirements of
an effective ethics and compliance program. Organizations
need to do more than just check
the box. Hotline – check. Code of
ethics – check. Internal controls –
check. While the seven minimum
requirements are important, I
don’t think they should be viewed
as “the finish line,” but I do think
they make an excellent starting
point.
I think in addition to these
seven minimum requirements,
we need to focus on an organization’s corporate culture. Does an
organization publically scold bad
behavior, while at the same time
incentivizing and rewarding it privately? Do they merely check the
boxes about these requirements, or
do they live their values? I think
companies need to define their culture, then hire and promote those
who fit into the culture. Only then
will the organization truly realize
the “value” of “values.” U
Editor’s note: This inter-‐
view was conducted by
Adam Turteltaub, Vice
888 277 4977 +1 952 933 4977
President of Membership
Development for SCCE. Paul
Fiorelli can be contacted by
e-‐mail at fiorelli@xavier.edu
and Adam can be contacted
at adam.turteltaub@corpo-‐
ratecompliance.org.
BE SURE TO GET YOUR
CCEP CEUS
Complete the Compliance &
Ethics Professional quiz related
to the articles below:
The seven biggest mistakes
companies make that erode
ethical culture and destroy
reputation—By Eric Feldman,
page 8
The human factor in compliance: Strategies for
reducing human error—By
Mary-James (Jami) Young,
page 28
The “why” of misbehavior:
Recent advances in
behavioral business ethics—
By James Meacham, page 34
CEU Credit Procedure
Visit corporatecompliance.org/quiz.
Select a quiz, fill in your contact
information, and answer the questions. The online quiz is self-scoring
and you will see your results almost
immediately. Or, you may FAX
or MAIL the completed quiz to
CCB at SCCE. Questions? Please
call CCB at +1 952 933 4977 or
888 277 4977.
Please note that credit will be
given only for quizzes received
before the expiration date indicated on the quiz.
OCT/NOV 2011 COMPLIANCE & ETHICS PROFESSIONAL 17