Salvador Hernandez (sal.hernandez@huschblackwell.com) is Senior Compliance and Ethics Advisor with the law firm Husch Blackwell LLP in St. Louis, Missouri, USA. Gregg N. Sofer (gregg.sofer@huschblackwell.com) is a Partner with the law firm Husch Blackwell LLP in Washington, DC.
You’ve just completed your compliance and ethics presentation to the audit committee or perhaps the full board. Your comments regarding the success of your revamped compliance and ethics training program were well received. You can relax a bit, knowing that the recent employee survey revealed that the training program is changing behaviors and that your program training requirements are being met, right? Not necessarily.
A 2017 survey of Society of Corporate Compliance and Ethics (SCCE) members regarding board compliance revealed that a third of publicly traded companies—despite government and regulatory guidance to the contrary—reported offering no compliance training to members of the board.[1] A 2021 survey of in-house governance professionals by Corporate Secretary placed that number even higher, at more than 40%.[2]
When did you last provide the board of directors compliance and ethics training? Have you ever?
The regulatory push
The appropriateness of providing compliance and ethics training to the board of directors is well established and originates with, not surprisingly, the source document for corporate compliance programs and the de facto measure of an effective compliance program, chapter eight of the Federal Sentencing Guidelines, “Sentencing of Organizations.”[3] In relation to board training, the commentary to chapter eight provides: “The organization must have taken steps to communicate effectively its standards and procedures to all employees and other agents, e.g., by requiring participation in training programs or by disseminating publications that explain in a practical manner what is required.”[4] “Agents” is defined elsewhere in the guidelines as including members of the board of directors.
In a 2004 amendment to the guidelines, application of the training requirement to the board of directors was more explicitly stated. Section B2.1(b)(4)(A) reads: “The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program, to the individuals referred to in subparagraph (B) by conducting effective training programs and otherwise disseminating information appropriate to such individuals’ respective roles and responsibilities.”[5] Continuing, subparagraph (B) reads: “The individuals referred to in subparagraph (A) are the members of thegoverning authority, high-level personnel, substantial authority personnel, the organization’s employees, and, as appropriate, the organization’s agents” (emphasis added).
Further, whereas the 1991 commentary seemed to allow for the “dissemination of publications” as a means of satisfying the requirement for the communication of standards and procedures to employees and agents, the 2004 amendment—by replacement of the word “or” with “and” between “training programs” and “otherwise disseminating information”—suggests that for a compliance training program to be considered effective, actual training must be provided and, further, that the training must be specific to “individuals’ respective roles and responsibilities.”
The U.S. Department of Justice’s Evaluation of Corporate of Compliance Programs, the department’s guide to prosecutors considering charges against companies, carries this message forward, citing the guidelines and adding: “Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors, officers, relevant employees, and, where appropriate, agents and business partners” (emphasis added).[6]
The guidance in connection with board training is making its way into the best practices of private sector organizations. For instance, Ethisphere, an organization that promotes the standards of ethical business practices, annually recognizes high-achieving companies via its World’s Most Ethical Company designation. In 2018, approximately 80% of those companies recognized provided board compliance training. In 2021, the percentage stands at 87%, likely due, in part, to the rise of environmental, social, and governance (ESG) efforts. As ESG scores become commonplace—and as investors increasingly direct capital with ESG in mind—governance broadly, and board training in particular, will have implications beyond compliance that directly affect corporate value.
So now that you’ve decided to provide compliance and ethics training to the board, keeping the SCCE survey results front of mind can be helpful in fleshing out your program’s “what,” “when,” and “how.”
How to train the board
A majority of the SCCE survey respondents reported that the board’s role in these four areas were addressed:
-
Compliance
-
Conflicts of interest
-
Government expectations for compliance programs
-
Specific legal issues
At a minimum, an annual presentation to the whole board of code of conduct training—with emphasis on matters presenting the greatest risk and as stated in the guidelines, most “appropriate to the Board’s roles and responsibilities” would be in order. In addition to instruction on the board’s role in compliance, conflicts, government expectations, and specific legal issues, insider trading, the keeping of accurate books and records, anti-corruption, and updates on changes to the regulatory environment are logical additional training topics.
The SCCE survey also revealed that of the companies providing board compliance training, 71% did so on an annual basis. Of course, the training need not be delivered in only one session; it can be segmented and delivered over the course of the year in installments at quarterly board meetings. Periodic retraining, designed to keep the board current, is a best practice.
Further, SCCE survey respondents indicated that the training delivery method employed most often was a live presentation, which was preferred by margins of nearly four to one to web-based and written training. In-person training is likely to have the greatest impact but may not be the most expedient delivery method. A mix of in-person and web-based training may also be effective, but no matter when or how your training is delivered, board compliance training should be documented in board meeting minutes or by way of tracking web-based training completion.
Your next step
Regulatory guidance could not make clearer the imperative of board training, both as a means of encouraging compliance and as a signal of good faith to regulators. While launching these efforts requires buy-in from corporate leadership, the evidence in support of conducting board training is undeniably strong, and risk and compliance professionals have ample regulatory guidance to rely on in making the argument for this effort.
About the authors
Salvador Hernandez served 25 years at the Federal Bureau of Investigation (FBI) in various roles, including in several executive-level positions. Following his FBI career, he served as vice president of compliance and ethics with Enterprise Holdings Inc.
Gregg N. Sofer served for three decades as a federal prosecutor and was formerly the U.S. attorney for the Western District of Texas, overseeing 300-plus employees handling matters involving white-collar crime, contract fraud, national security, cybercrime, public corruption, money laundering, export violations, trade secrets, tax, large-scale drug and human trafficking, immigration, child exploitation, and violent crime, among other areas.
Takeaways
-
Board director training is an often-overlooked area of corporate compliance programs.
-
Regulatory guidance could not be clearer concerning the importance of actual director training, not just the “dissemination” of information.
-
As investors increasingly direct capital with environmental, social, and governance concerns in mind, governance and board training in particular will have implications that directly affect corporate value.
-
An annual presentation to the board should at least emphasize areas of greatest risk and contain information most “appropriate to the Board’s roles and responsibilities.”
-
Training can be delivered in installments and can feature a mix of in-person and media-based formats.