Salience can be achieved by prompting about moral codes—through language that emphasizes words like “moral,” “ethical,” and “good.” Discussions by leaders and key culture carriers—that is, esteemed colleagues regardless of rank in a hierarchy—can also help if they address ethical dilemmas that arise in the course of business decisions. Finally, salience occurs through proximity of decision-makers to those affected by decisions.12 So, look for ways to make the human consequences of choices more apparent. In my view, a habit or culture of considering what is right, and not merely what is permissible, will help any organization attract, retain, and develop high-quality employees. It will promote individual wellbeing and will contribute, over time, to an industry that makes fewer errors of judgment. Do not rest Above all, remember that this is a marathon, not a sprint. So your organization now has three lines of defense—great! But your work is not over. You still have to question whether your organization can be better controlled vis-à-vis its risks. The challenges and opportunities facing your firm do not stop changing. You need to adjust accordingly. I encourage you to ask questions about the three lines of defense model and how it is applied in your organizations. Here is one of the questions on my mind: How do the three lines of defense take account of advances in technology? Technological solutions in financial services are becoming cheaper, faster, more easily available—almost off-the-shelf—and help make your business more efficient and profitable. But do you know how these solutions work?
We cannot rely exclusively on controls or process to achieve desired outcomes. Not every situation can be anticipated. Not every decision can be automated. Controls can be out-maneuvered—sometimes unwittingly, but other times on purpose. For all these reasons, good processes are necessary but not sufficient. There will be situations in which your employees have to make choices. Ignoring the moral dimension of choices carries significant risk.8 If you want your organization to be well controlled with regard to its risk, you have to consider the quality of choices, not just the reliability of processes.9 An organization should therefore develop the capacity of its employees to make good choices, not just permissible choices. So, how do you practice moral reasoning? Bill Dudley has offered what I thought was a good starting point. Get rid of the notion that a separate morality applies at work than at home.10 Bankers—and, for that matter, lawyers—cannot check their morals at the door when they step onto a trading floor or into a courtroom. Here are some other ideas, courtesy of a 2016 report by the Financial Conduct Authority entitled “Behaviour and Compliance in Organizations.”11 The report argues, among other things, that ethical considerations need to remain salient in order to promote good choices.