Natalia Gindler Corsini (ncgindler@gmail.com) is a corporate compliance professional who has worked for several Fortune 500 companies and is based in Miami, Florida, USA.
Recently I had the pleasure of attending a world-class program in the area of compliance, which covered managing compliance in multiple countries. It was such a unique event, with experienced compliance professionals (panelists and attendees) exchanging their knowledge, practices, and challenges.
One of the points of the program focused on managing compliance in Latin America. Throughout the discussion, the panelists highlighted specific examples to show how each country in the region can differ. Although the essence of the region may look similar at first glance, every country in Latin America is characterized by different cultures, originating from different histories of colonization (e.g., by Spaniards and by Portuguese); by distinct political and economic environments; and by populations with diverse types of mind-sets. These differences across the region present unique challenges for a global company implementing and establishing compliance programs in Latin America. It is important to keep in mind that one size does not fit all.
The Brazilian mind-set
I wasn’t surprised by how many times Brazil was cited during the program; not only because of all the negative exposure related to corruption and the country’s positive reactions, but also because of the way the Brazilian mind-set works. I could hear, like echoes from the past, concerns I experienced when implementing compliance programs in Brazil.
Establishing procedures, controls, and audit and monitoring processes in my home country of Brazil is not an easy task. I had the opportunity to work in many Latin American countries, to know their cultures, and to initiate compliance programs there. However, Brazil has its own unique issues. It is customary in Brazil to extemporize solutions to resolve problems; however, this is done not through procedures and previously established rules, but through behaviors passed down through the centuries, from one generation to the next. Such behaviors come from political and social conditions, imposed centuries ago, that have created among Brazilians a dislike for following rules and even laws.
Between 2012 and 2013, IPCA Brasil (Perception of Legal Compliance Index), measured by Fundação Getúlio Vargas School of Law of Sao Paulo,[1] evaluated how important it is for Brazilians to obey or not to obey laws as well as some authorities in Brazil. The results of the research revealed that 82% of the population considered it easy to disrespect the laws of the country, and 79% agreed that, whenever possible, improvised solutions can be used to solve problems instead of following rules and legal procedures.
In Brazil, for decades, there has been an accepted state of amorality among the population—people acting wrongly; disregarding laws and rules; and using the fallacious argument that everybody does it, so it should be considered normal and harmless. Subsequently, if one doesn’t do it, he/she is considered to be not a smart person. This rationalization is used to further justify that an individual can be absolved from an illegal act if the population collectively commits the same illegal act. By applying this mentality to the corporate environment, the rationale used to be, “If we don’t do this, or if we comply with the rules and laws strictly, then there is no way to be competitive, and we will lose business, which will be reflected in our P&L.”
Living in that environment while working for a global company with the mission to implement a compliance program based on foreign laws and regulations can be a gigantic challenge. There is always someone who will ask the classic question: “Why, in Brazil, am I supposed to follow rules imposed by another country?”
I was fortunate to be able to address these challenges and answer this type of question in my role as a compliance officer. My first assignment in compliance was to implement the export control program in Latin America, based on the laws and regulations of the United States, which have an extraterritorial reach. It would be irresponsible of me to only check the boxes, disregarding how profoundly the concept of the program would touch the employees. I had to ensure they understood the importance of adhering to the procedures in order to mitigate any negative exposure that the company and the individuals might face if they did not comply.
With the full support of corporate headquarters, I was equipped with all the information I needed about the Export Compliance Program (ECP), based on the Bureau of Industry and Security principles and guidelines,[2] to reproduce it in my country. Basically the program consists of eight elements that are critical for an effective ECP for items subject to the Export Administration Regulations:
-
Management commitment
-
Risk assessment
-
Export authorization
-
Recordkeeping
-
Training
-
Audits
-
Handling export violations and taking corrective actions
-
Building and maintaining the ECP
Designing a training strategy
In order to transfer all that knowledge to my coworkers and to third parties, a strategy had to be designed in a way they could digest, assimilate, and then put into practice. Here I share the main points of the plan I considered during the implementation process.
Consciousness
Know your audience. Each of the functional areas or business units in a company can present a different type of exposure and level of risk. It is important to create specific training sessions, tailored to each of those groups, and to make the approach more attractive to the audience by allowing people to actually see themselves as part of the situations presented. Also, it is important to build a partnership between compliance and the businesses in order to create a healthy relationship where risk mitigation, transparent information, and ethical behavior flow well together.
Regardless of the audience’s background and education, simple language (in this case, in Brazilian Portuguese specifically) is always the best choice for providing an effective training session.
People have to know and understand the consequences on a personal level if they violate the rules and laws. Factual examples—with nonconfidential information—have to be presented in detail, in a way that shows the story timeline, how and why the violation occurred, how it was discovered, and what the consequences were for the company and for the individuals involved. The audience has to put themselves in the violator’s shoes.
Go through the details
The extraterritoriality of the law must be made clear to the attendees, as well as how the law’s country of origin enforces it.
From the beginning of a program’s implementation, everyone in the company has to be aware of all the steps, including the controls that will be put in place and the audits that will happen periodically. People must be conscious of the fact that, in the end, compliance efforts are also intended to protect them as individuals, and it cannot be taken personally. Yes, Brazilians often take internal controls, audits, and investigations (if needed) personally and may not understand that those actions are related to the process.
Prevention
That is another point that has to be exhaustively discussed. People have to understand that prevention is much less painful and less costly than remediation. In Brazil, problem avoidance is not part of our culture. That said, an emphasis on how significant it is to not neglect preventive measures is an essential message to be delivered and constantly reiterated. By prevention I mean being vigilant and thinking about the risks before taking any action, from the manner that one handles everyday information or documents to the way classified information is managed during an investigation process.
Ethics
A robust compliance program cannot be successful without understanding ethics. The difference between ethics and compliance must be explained in an in-depth and understandable way for all workers, at all levels of the company. This is the key to ensuring compliance in an organization. The goal is to have individuals embrace the mentality that “I do it because it’s the right thing to do and not just because I want to stay out of trouble.” It has to be clear to all employees that compliance is not as simple as just saying that one has to strictly obey the company’s rules and the laws. People have to understand that even though they may not be breaking the law, they can still be acting unfairly, unsafely, and dishonestly. I see this topic as one of today’s most challenging goals for compliance personnel in Brazil. These messages need to be delivered clearly, from the beginning and on a regular basis, in order to effectuate a change in consciousness.
Visual communication and knowledge testing
The messaging also has to be spread in a visual way, in the local language. It is crucial to hang posters with simple diagrams, customized to each department’s workflow, procedures, and risk, thereby reinforcing what is presented during the training sessions. As people continue to look at the diagrams—at the names of embargoed countries, at the main questions they should ask before every operation is completed in order to ensure there are no red flags—the more likely it is that the information will be inserted in their minds and the procedures will gradually flow more naturally.
Knowledge testing in training sessions is critical. There are people that move their head up and down as a way of showing understanding; however, it may not necessarily indicate they have assimilated the information. By performing tests, information is better absorbed.
Internal and automated controls
Checkpoints and checklists must be part of each department’s workflow. By making sure the steps are taken carefully and red flags are raised at the right time, risks are mitigated and problems avoided, thereby saving the company the time, effort, and money to fix a violation after it has occurred.
Controls should be performed by an automated system. Technology is the key to guarantee that an operation is put on hold if a red flag is raised. Otherwise, controls can be mistakenly skipped or conveniently bypassed from time to time.
Monitoring and internal audits
Compliance focal points (e.g., champions, coordinators, partners) who are part of the functional teams are also people chosen to be the compliance ambassadors in the department they work for. So besides ensuring the controls are in place, that representative is responsible for monitoring them and randomly testing them to check if they are running properly. Once or twice a year, an internal audit, run by the audit team, verifies the implementation accuracy, the effectiveness of controls, and infringement indications.
Consistency and availability
When people start noticing that the program implementation is an ongoing process—and not just a check-the-box process—and they have embraced the training and education, they tend to be more careful to no longer use shortcuts and to no longer close their eyes to red flags. This model, involving changing the consciousness, training, communication, control, and monitoring, needs to be kept moving; it’s a nonstop system.
During the training sessions, one of the important messages to be emphasized is in regard to the availability of compliance personnel. Everyone in charge of compliance has to make themselves accessible for any questions and/or concerns that any person may have at any time.
The compliance team needs to walk its talk. Every time a commitment is made, it must be accomplished. That means to lead by example. This attitude serves as a motivation to the locals. As long as people note that compliance professionals do exactly what they said that they would do, it creates a reliable relationship that will be crucial in preventing wrongdoings. This will encourage coworkers to raise possible red flags and eventually use other channels of communication that the company offers to employees and third parties to disclose a concern.
Brazilian culture
In Brazil, the culture can be seen as a coin with two sides, and cannot be judged based on only one side. One of the sides may not be the ideal, but the other side shows positive features that can be exploited in a constructive way if taken into account when dealing with compliance.
There are, of course, positive aspects we can take from the Brazilian culture that benefit a compliance program implementation. Brazilians tend to be:
-
Optimistic: Despite the complexity of daily life (e.g., economic, political, social), having an upbeat attitude is cultural. The people are friendly and generous, and the country has been mentioned as having one of the happiest populations. Under these circumstances, employees can be confident about the future and take actions that will produce positive outcomes. Thus, by presenting the benefits that a compliance program brings to the company and to individuals, it nourishes their enthusiasm.
-
Emotional: We, in Brazil, are sensitive and can easily put ourselves in other’s shoes and can feel the pain of a violator’s punishment. That means actual examples of crimes and their consequences work well in consciousness trainings.
-
Patient and resilient: We are used to bureaucracy; therefore we accept that some actions are just out of our control and that sometimes we just have to go with the flow. As a result, we are more accustomed to having additional procedures in our daily activities. Brazilians are used to living with economic, political, and social crises; they constantly manage obstacles; and they fall down and get back up again. Consequently, if a company faces law infringement and penalties, there’s a collective effort to get the company back on track.
-
Proud: Brazilians are proud of their country. However, that satisfaction has been harmed by negative facts, massively exposed to the world, related to government, businesses, and corporations. This realization and acceptance is important, because it makes the population grounded in the truth and willing to admit there is a lot to improve in terms of prevention, controls, and respect for the law.
The scenario in Brazil is changing due to ongoing events (e.g., government and white-collar wrongdoing exposure) and also due to the country’s new generation. Unprecedented in Latin America, Brazil’s white-collar wrongdoers have been discovered and punished for violating the law. Brazil has finally started to fill in the gaps in its legislation, and it has been passing laws, inspired by international guidelines, that comply with international agreements and acts. For instance, Brazil’s Anti-Corruption Law (Law no. 12,846/2013)[3] and LGPD, the Brazilian General Data Protection Law (Law no. 13,709/2018)[4] legally support multinational compliance programs of corporations operating in Brazil.
Furthermore, worldwide we are witnessing a generational shift. Millennials and Gen Z are replacing Baby Boomers in the workforce. It’s no different in Brazil. Besides the risk those generations may present to a company, in terms of intense technology usage (e.g., social media exposure, inappropriate communication), they are much more concerned with how ethically businesses and governments behave, and whether leaders are committed to helping to improve society. The newer generations have different mind-sets; people are individualistic, and their self-confidence reflects their personal values, giving them the power to not tolerate bad attitudes, which the older generations have long accepted.
Conclusion
The implementation of an effective compliance system is greatly enhanced when you combine the compliance requirements with knowledge of the culture and with an understanding of the country’s current situation.
In addition to using the combination pointed out above, it’s imperative that local leaders genuinely support the compliance concept and team, and are committed to promoting an ethical environment and operating in an ethical mode. Otherwise, even though the vast majority of employees are aligned to the program precepts and act ethically, all their efforts will be reduced to a check-the-box task, and the program’s implementation and effectiveness are jeopardized.
The author would like to express her thanks to Monique Agia, Esq., for her assistance proofreading this article.
Takeaways
-
Latin America is characterized by different cultures, by distinct political and economic environments, and by populations with diverse types of mind-sets.
-
Guidelines and instructions have to be provided to employees and third parties in a way they can digest, assimilate, and then put into practice.
-
Prevention is a topic that has to be exhaustively discussed.
-
The difference between ethics and compliance has to be clear to the workers at all levels of the company.
-
Leaders must value local compliance personnel and their efforts.