David Jacobson's External Insights

Why have a compliance program?

I've always thought that dealing with government regulators is like dealing with anybody else in business: you need to gain their trust.

This article quotes a former director of the Office of Export Enforcement, Bureau of Industry and Security in the United States Department of Commerce on how his officers decide to proceed with an investigation:

When a law enforcement officer looks at a company, one of the first questions he or she asks him or herself will be: "Are these people good guys or bad guys?" Much is at stake for the officer. Initial information about the company's activities helps the officer decide not only how to begin the inquiry but, more importantly, how best to protect the safety of the officer and his or her fellow officers when dealing with the company. ..

If you were a federal agent charged with responsibility for investigating white collar crimes such as export control violations or securities fraud, and felt keenly the need to make a quick and accurate first assessment of whether a company consists of good guys who may have made a technical mistake, or terrorist supporters who wouldn't hesitate to defraud other companies in order to accomplish their mission, and who are completely willing to kill you in the process, what would be your test? On an interpersonal level, your initial "gut reaction" about the truthfulness of the people you meet and interview will tell you a great deal--but only about those individuals, not necessarily about the corporation as a whole. Is there some other information, at the corporate level, that could help you quickly assess the character of the whole organization?

At the initial stage of an investigation the single best indicator of whether a company is law abiding is whether the company has an effective compliance program. "According to available information, only 2 of the 865 corporations sentenced for federal crimes during the last eight years had effective compliance programs. Of the 143 organizations sentenced under Chapter 8 in 2002, not one maintained any type of compliance program whatsoever...

An experienced federal investigator knows that when he or she finds a company operating without an effective compliance program, the odds are in favor of discovering evidence of a crime.

The vast majority of business people have absolutely no desire to commit regulatory crimes. But small- and medium-sized companies must make difficult choices about how to come up with the money needed to insure a reasonable degree of compliance.

So, having a compliance program will not only help avoid committing breaches but may also be the difference in how investigators deal with you.

How to prioritise problems

Although How to Decide What Bugs to Fix When is about software development, it offers some great guidelines generally on prioritizing work.

The author argues that you should regularly perform "bug triage" to keep control of your project. Divide your problems into 3 piles: Must Fix, Might Fix and Won't Fix (or Priority 1, 2 and 3):

1. If a bug is a Must Fix, it must be more important than any bug in Might Fix and Won't Fix.
2. If the bug is a Might Fix, it must be more important than any bug in Won't Fix.
3. If the bug is a Won't Fix, it must be less important than the least important Might Fix bug.

No more than 50% of the bugs should be in Must Fix and if the pile is too big divide it into Must Fix this week, and Must Fix eventually.

Each pile can then be analysed for severity.

The key quote:

" the criteria for prioritizing work should be what is most important to the project and the customer. A team's commitment to serving the project goals over other desires is often the difference between quality and shoddy work."

via Rob Hyndman

Who makes the decisions?

Decision Rights: Who Gives the Green Light? from HBS Working Knowledge  discusses the steps required to ensure that a company decides who is authorized to make what types of decisions.

Putting decision making in the right hands can involve organisational and personal issues.

Do the decision makers have the right information?

Is decision making too centralised?

Is there ambiguity about who makes the decision?

The article concludes: "As a company, we've recognized that good decisions don't just happen... "There is a science to it—a bit of art but a lot of science."

Negotiating as a Team

HBS Working Knowledge article Negotiating as a Team discusses whether team negotiation is more effective than a solo negotiator. Is there really "strength in numbers"?

The key is preparation and agreement on roles.

Brand and image reputation

Following up on yesterday's theme is this article on Reputation from CFO magazine which reports on the results of Aon Australia's Risk Management and Total Cost of Insurable Risk survey.

The survey found that respondents believed that the top 10 corporate risks in Australia were:

1. Brand and image
2. corporate governance
3. regulatory
4. legal
5. systems
6. human resource
7. liquidity
8. physical assets
9. capital structure
10. information management

How would your Board handle a crisis?

Outsiders rarely get to see how a board works together in response to a crisis. Yes, you see how the organisation's spokesman handles the media but not the decision-making processes behind the response.

Responding to a physical disaster (such as an office fire) is different from a brand reputation crisis (involving financial fraud or mismanagement, a major product defect or a significant compliance breach).

A reputation crisis requires a co-ordinated plan drawing on a range of experts: communication, accounting, legal, regulatory and, if appropriate, a subject matter expert (eg health, medical, environmental, engineering etc).

A crisis management plan requires the board members and management to know their roles. A crisis is any unplanned event with a potential significant impact on the business.  A crisis can bring out the worst in people as well as the best. It's in a crisis that you see whether a director is thinking about the business, its employees, shareholders, suppliers and customers or their own personal interests.

Dealing with fraud allegations against the CEO is the subject of My 16 Days on the HealthSouth Board. It reminds me what the recent HIH, National Australia Bank and James Hardie experiences proved: boards under pressure may not survive a crisis intact without sound leadership. That's something boards need to plan and train for.

Communicating with customers: blogging about your business closure

I am an advocate of using blogs to communicate with your customers. But I have just come across the first example of a business owner using his blog to tell his customers that he has closed down and to tell them how they can retrieve their goods.

Ifulfill was an internet fulfillment house (they deliver goods you order over the internet). In the owner's blog he confirms the business has closed, posts FAQ's and answers and offers suggestions for alternative suppliers (via Business Blog Consulting).

It's not clear whether the business is insolvent or not but here's the owner's explanation:

"The question everyone wants an answer to: what happened?

In a nutshell: rapid growth and undercapitalization. In other words, not enough money to grow as fast as we did.

So why didn't I give 30 days notice? I've spent 6 years building this company. We've had many problems and many successes. The entrepreneurial spirit dictates that you solve whatever problems you are faced with. I've always tried to do that; sometimes more successfully than others, but you have to have faith and believe that you can solve whatever comes your way if you're actually going to tackle the problems you encounter.

But then a point arrives where you have to finally throw in the towel. Until that moment however, you maintain the same faith and continue to believe that you can work out problems."

Interestingly he's left on the ability to make and read comments to his blog so you can see his customers' worry and concern.

It appears that it's an orderly wind down with the co-operation of his landlord.

UPDATE 6 August: Business Week has the full story and here's the consultant's response.

An insider's account: crisis management in the boardroom

As a lawyer and adviser my prime obligation is to keep confidential information about  my clients confidential. I won't write anything here that compromises me or my clients.

So when I read My 16 days on the HealthSouth Board by Betsy S. Atkins (pdf) I thought that it was an article that could give directors and managers an insight into the many strategic, financial and operational decisions that needed to be made in a crisis situation.

It's written by a lawyer who accepted a directorship of a major US health services business 1 day before the CEO was charged with massive fraud.

It's a blow by blow account of what happens in a boardroom when it finds out that its accounts may not be correct and its CEO and major shareholder is under criminal investigation.

Whilst some of the board processes it describes are US specific, I like the way it describes the issues that needed to be be addressed, the way that information was collected, alternatives identified and the decision making process in a crisis in order to keep the company stable and solvent.

The article also clearly identifies the regulatory mess businesses can get caught up in.

POSTSCRIPT: The CEO was subsequently acquitted and is fighting to get his job back.

About blogs: just harvesting?

I was recently asked whether this blog was really just "harvesting"?

Yes and no. The internet is by definition a network, a series of links. What makes it, and blogs, so interesting is the ability to collect and comment on links in your particular area of interest.

And hopefully along the way share my own thoughts which others might find of interest.

In addition blogs permit comments. Comments start conversations and ideas flow.

Blogs allow me to write. And writing a blog allows me to understand the technology they are based on.

Collaboration. Networking. All necessary for business.