Troy McAlister (troymcalister@hotmail.com) is an ethics and compliance professional with experience internationally designing, implementing, monitoring, and assessing compliance programs, based in The Woodlands, Texas, USA.
Normal may never be normal again; however, that does not necessarily mean abandoning all old approaches and pioneering new ones. Rather, it calls for a reexamination of old approaches and finding ways of adapting them to our new environment. Zoom meetings and conference calls have helped us survive, keeping the wheels of progress moving just fast enough to not stop, but they will never replace the value and information (both spoken and unspoken) that ethics and compliance professionals gain from face-to-face interactions.
For companies with a decentralized structure of administrative, sales, and branch locations throughout the US or the world, I have always felt one of the best tools in the ethics and compliance arsenal was the well-planned site visit—an opportunity to put faces with names, to become more than just a suit at the corporate office or a poster on the wall, to take your message to the masses, and to really get a feel for how the locations operate. The time is coming when site visits will not only be a possibility again, but a necessity. After months of forced isolation, it will be time to establish (or reestablish) the relationships and expectations so vital to having a healthy compliance program.
COVID-19 has had varied effects on industries, but it is likely travel budgets will still be tightly guarded. This makes getting the biggest bang for your buck out of your site visit so crucial. The new site visit will need to be multifaceted and well thought out. If done right, the work plan could serve as the basis for future site visits at your other locations and a great argument that your compliance program is engaged in continuous monitoring, communication, and feedback efforts. The following is a breakdown of how you could develop or modify your site visit plans.
Do your homework
Whether this is your first visit or a return visit, you always want to be armed with some level of intelligence to conduct meaningful discussions, show you have taken a legitimate interest in the business, be knowledgeable of past or current issues, or call interviewees out on less-than-truthful responses to your questions. This can be accomplished with some combination of the following.
Goals
What is it you hope to achieve on the visit? Are you building relationships? Do you want your presence known? Are you focused on high-risk activities? Identify your top achievable goals and stay focused on those. Lack of focus or trying to do too much with available time will yield underwhelming results.
Surveys
Cultural, risk assessment, or other compliance surveys provide great insight into a location’s operations. If you have conducted a survey in the past year covering that location, you may be able to use it. If not, consider refreshing or conducting a new survey of local leadership, middle management, and even some frontline personnel. Make sure you close out and review the results prior to the site visit so you have time to digest the results and adjust accordingly.
Audits
The higher the assessed risk of financial or reputational harm for a location, the more detail and scrutiny you will want to exercise over its policies and processes. For moderate- or high-risk locations, use internal audit or outside specialists to conduct targeted audits of key policies, such as third-party due diligence, gifts and entertainment, or third-party commissions, prior to your visit. If possible, be on-site with the local management team to review audit findings in real time and discuss any necessary remediation efforts.
Data analytics
Depending on the makeup of your compliance team, you can either perform, or ask internal audit or accounting to perform, analytics on gifts, entertainment, charitable contributions, political contributions, sponsorships, commissions, consulting or other third-party fees, write-offs, etc. You may want to look at their summarized financials or general ledger for unusual accounts, balances, or activity. Trend analysis over the past one or two years is beneficial information as well.
Personnel
Review organization charts to see how deep the staffing levels are and whether all functions (legal, human resources, accounting, supply chain, etc.) or only some functions are present at the location. Get an understanding of pay structures for key personnel (management, sales), including bonus or commission arrangements.
Third parties
Foreign locations that use third-party representatives to obtain or retain business subject your company to higher risk of financial or reputational harm. For these locations, determine what third parties are used (e.g., agents; distributors; business partners; freight forwarders; accounting firms used for taxes or other filings; legal firms used for government filings, licensing, or personnel matters). What due diligence was performed on these third parties and when was the last time they were refreshed? Who are the employees at the location who are responsible for the actions of those third parties (i.e., sponsors) and when was the last time you discussed or trained them on the risks and their responsibilities?
Other risks and considerations
Does the location have interactions with foreign officials or government entities? Is it a long-standing location, or is it a new location as a result of organic growth, merger, or acquisition? Have you been there before and already established a relationship with local personnel, or is this your first time? Has the location been involved with any internal control deficiencies, financial misstatements, or audit findings?
The length of your visit
The information considered and gathered during your preparation will heavily factor into the length of your visit. So too will the availability of the people you want to visit with. All too common is the presence of a flawed mindset: get in and out as quickly as possible. This seems to rise from a lack of conviction that your site visit is purpose driven and not merely a budget-eating boondoggle. Determine the length of visit based on getting it right and not just getting it done. You’ve already incurred the cost to get there, so get the most out of it. Factor in a certain amount of inefficiency as it is unlikely you will be able to catch your targets in perfect succession on your calendar. Also leave yourself time for the planned or unplanned tour of facilities and operations that may be located a few minutes or a few hours from your primary target.
On-site interviews
Whom you interview, how, and when will vary significantly from visit to visit. One-on-ones through a staff meeting, town hall, etc. may give you an opportunity to get a higher number of participants at the same time. Individual interviews will undoubtedly result in more candid and revealing conversations. Include a mix of high-, medium-, and low-level personnel. Local management will often attempt to make the situation sound better controlled than it actually is. Speaking with mid-level and frontline workers will allow you to pressure test management’s responses. For example, management may say a certain policy or expectation is well communicated or understood while conversations with other employees may show that to be clearly untrue. If time is tight, your priority should be management personnel due to their trickle-down influence on subordinates. Be prepared with a list of questions and topics you want to cover to stay focused and efficient and to avoid forgetting an important topic. Do not be afraid to let the conversations drift (though not too far) into discussions about personal lives and interests. This makes you human and approachable, even when you are no longer there in person. My experience is that personal relationships yield more calls seeking guidance than email, poster, or communication campaigns.
On-site training
No site visit should go without some form of training session. Hold these later in the visit after interviews and facility tours, when you’ve established rapport and obtained a more detailed understanding of operations, personalities, and culture. This will allow you to tailor your training to focus on areas of need and limit discussion on areas of lesser importance. A good tip is to enlist local management to introduce your training session and stress the importance of its content. Obtain sign-in sheets so you have documented evidence of personnel present at the training session(s). Some training topics to consider include elements of your compliance program, whom to contact and how to raise concerns, hotline metrics, enforcement trends, and evolving industry risks.
Post-visit documentation and action items
We all know the saying, “If it isn’t documented, it didn’t happen.” Immediately following your visit, while discussions are fresh in your mind, document where you went and when, what documents and information you reviewed, whom you met with, what discussions you had, what training was delivered, and any action items from those activities. Include training sign-in sheets as an addendum to the file. The action items should be carefully thought out before finalizing. Discuss them with local and/or corporate management to ensure agreement and commitment to complete within an urgent, yet realistic, time frame. Pie-in-the-sky action items that you have no real intention or likelihood of achieving should be avoided. Develop a mechanism to assign owners and follow up until the action item has been completed. Also, include your finalized documentation as an addendum to your next audit or compliance committee presentation. Finally, do not forget to express your gratitude to your host(s) following the visit via a thank-you note, call, or reasonably priced gift or promotional item (in accordance with your internal gift-giving policies).
Time to reconnect
Times have changed and so have the ways in which we do business. But business is still made up of the people behind the processes. After an extended period of isolation, it will soon be time to reestablish those relationships and rebuild your connectivity with your operations. Plan ahead so you are getting the most out of your efforts and your employees see that they are still on the forefront of your mind.
Takeaways
-
Personal interactions between the compliance professional and company employees is still a vital component of a successful program.
-
Detailed planning can turn a simple meet and greet into a highly effective visit that clarifies for the operations what the compliance function provides to the organization.
-
Give yourself enough time to accomplish the goals you have set and get the most value for the time spent and cost incurred.
-
Never miss the opportunity to provide in-person training about your program, risks, and controls.
-
If you did it, make sure you get credit for it. Documentation is key to memorializing your actions and the resulting actions of others.