This is a little unsettling, because during the last 20 years we have been successful in establishing as a better practice the approval of the compliance program by the board of directors. One might think that, if the board of directors approves the compliance program, then it should not be difficult for the chief ethics and compliance officer to get the business owners to pay close attention. The devil here, as in so many other places, lies in the details. It is usually the implementation of the compliance program that causes the conflict. It is usually related to the cost of compliance, because the cost ordinarily affects how the business owner measures success, which is the size of the business’ profit. The chief ethics and compliance officer will not be able to resolve the conflict easily, because compliance is a cost to the business which can make compliance the adversary of the business owner. The chief ethics and compliance officer will not want to bring a specific conflict issue to the attention of the board of directors. While this might be very effective in resolving the specific conflict, it could absolutely destroy her ability to function effectively thereafter. In a recent survey of chief ethics and compliance officers conducted by Price Waterhouse, the survey respondents identified as a problem their “struggle to gain the attention of the board of directors.”6 Two specific issues were identified.
However, it is possible to look at compliance in a very different way, as a two-way street and not a “one-way” street. Let me explain what I mean. A sound and effective compliance program can be used, appropriately in my view, as a tool that would permit on-boarding of what is seen as risky business. To continue with the example of correspondent banking, if a U.S. correspondent had a sound and effective compliance program that was well tailored to identify and control the risks of money laundering, terrorist financing, and sanctions evasion, this correspondent might become sufficiently confident to on-board risk. This means that instead of closing accounts for everyone in a specific geographic area, it would continue with some of these accounts, or even open new accounts. Now, I do not want anyone to think I am saying that all correspondents can reasonably have such confidence now. At this point in our journey, I concede the need to develop greater confidence that the identified risks can be controlled at a reasonable cost. With that said, I believe that we will reach a place where ethics and compliance programs are sufficiently developed so organizations can make considered decisions to on-board risk and keep it within the accepted risk appetite by using effective controls. I look forward to that time as we move to the next level. 3.