Another cause for optimism is the attention compliance now receives in law schools and other graduate programs. Two examples are NYU Law School’s Program on Corporate Compliance and Enforcement, and Fordham Law School’s LLM program in Corporate Compliance. These programs engage key leaders in the field in important public discussions, and train students who, in terms of their understanding of corporate governance, are well ahead of where many of us were when we began our careers. These programs will contribute to a bright future for the compliance profession. Compliance, enforcement, and accountability I also want to say a few words about enforcement and accountability. I believe, of course, that past misconduct should be punished. I also believe that we who play a role in bringing wrongdoers to account should also require forward-looking reforms under the mantra of “Never again.” For those forward-looking reforms to be successful, firms and enforcement attorneys need to pay attention to root causes of misconduct. There is a vigorous and important debate in academic and regulatory circles about the prosecution of individuals in cases of corporate misconduct. Virtually everyone agrees that individual prosecutions can have deterrent effect on future misconduct if people believe they will get caught. I follow the debate with great interest. Suffice it to say, I agree that individuals must be held accountable for misconduct. If the misconduct is criminal, criminal prosecution is warranted.
The role of the compliance officer is often divided into two categories—serving as a control function and serving as an advisor. In many respects, this framing works just fine. Compliance sometimes needs to control. And sometimes it needs to advise. Indeed, for in-house counsel, this dual-hatted approach is not unfamiliar. I have discussed in previous remarks the “partnerguardian” model espoused by the former general counsel of General Electric, Ben Heineman. He argues that a lawyer serves as both a partner to the business unit and a guardian of the organization.4 I am a big fan of this model and think it serves in-house lawyers well. But, this binary approach—advisor versus controller—also misses something. I think we would be well served to keep in mind that the mark of a strong compliance function—at least, from my perspective—is that it is influential within the organization. Compliance functions, like in-house counsel, need to adeptly use all the tools in our respective toolkit to influence behavior within an institution. Some of these tools are more advisory; others, are more controlling. Policies and procedures that reinforce clear roles for the first and second lines of defense, along with clearly defined escalation paths, can help compliance exert appropriate influence over business decisions. When a senior manager understands that she has responsibility for control failures that occur on her watch, and sees that her responsibility cannot be deflected or redistributed, then her view of the compliance function shifts.