Selling Integrity

Compliance and integrity

Compliance and integrity: much is said about these two words, but what do they mean in practical terms? How do they differ? And how can they contribute to a business’s success?

The concepts are intertwined and complement each other. While compliance works on the adherence of internal rules, regulations and legislation, integrity is a much broader concept that transcends a specific norm or procedure and pertains to culture, principles and values.

It is fair to say that integrity precedes compliance, and both contribute not only to a business’s success but to its sustainability. Compliance with rules, regulations and legislation would not be possible or effective without the development of a culture of integrity that spreads throughout the entire business in a top-down manner. The company’s purpose, value, mission and vision must be based on this culture of integrity, and this will help mitigate the risk of corruption, fraud and deviations from ethical conduct.

While compliance focuses on concrete issues, integrity focuses on subjective issues, aiming to acculturate and change people’s conduct, promoting ethical relations. The implementation and development of an ethical culture in a company must reach every employee from senior management to professionals working in operational and support areas.

A well-structured integrity and compliance system contributes to the development of an ethical culture and promotes a company’s values. This system needs to work alongside other management systems at the company, such as quality, environment, and occupational health and safety, with aims towards the prevention, detection and correction of potentially harmful acts.

The integrity and compliance system should also have key performance indicators (KPIs) to help leaders make good decisions. Compliance indicators will be quantitative, while integrity indicators will be qualitative. In this sense, integrity and compliance must be part of a company’s strategy and guide business decisions towards doing what is right and responsible, in order to succeed and leave a positive legacy.

Integrity and compliance areas need to work in a dynamic manner with the entire company. It is important that an integrity and compliance system evolves according to the business’s maturity and comprises procedures that will permeate other areas, serving as a common denominator for other areas to create their own operational procedures.

To achieve this, communication and transparency are two fundamentals that go alongside integrity and compliance. Every individual in a determined company must clearly understand where the company is heading and what is expected of him or her. Internal rules, policies and procedures must be written in a user-friendly way, so as to communicate transparently and correctly.

From the moment a company elaborates its processes based on transparency, it is acting with integrity towards its employees, suppliers, customers and other stakeholders. This conduct demonstrates the image the company wishes to achieve in the market in which it operates, that is, working with transparency in order to build relationships based on integrity.

How to turn integrity and compliance into a business strategy and use it to your organisation’s advantage

Well-known standards that regulate ethical business conduct establish the need of implementing an effective integrity and compliance system to satisfy certain requirements. The most important international standards include the following.

US Foreign Corrupt Practices Act (FCPA)^[2]

Although the FCPA’s anti-bribery provisions do not expressly require implementation of an integrity and compliance system, the sanctions imposed on a company that violates this law are typically harsher if the company previously lacked an effective system. Additionally, issuers of US securities are subject to the FCPA’s accounting provisions, including requirements regarding internal accounting controls.

According to the Principles of Federal Prosecution of Business Organizations, US prosecutors in deciding whether to bring a criminal action against a company must consider factors such as the existence and effectiveness of the pre-existing integrity and compliance system, as well as remedial measures the company adopted after identifying the improper conduct, including potentially adopting or improving an integrity and compliance system.

UK Bribery Act (UKBA)^[3]

UK law implicitly recognises that it is impossible to absolutely prevent possible acts of corruption. For the corporate offence of failing to prevent bribery, the only enumerated defence is proof that a company had previously adopted adequate procedures designed to prevent bribery. A company that demonstrates a structured and effective integrity and compliance system may theoretically avoid liability.

In many Latin American jurisdictions, companies have been adopting compliance programmes in part to attract foreign investment. Further, integrity came along to be developed jointly with compliance as a result of corruption scandals involving both private and public sectors around Latin America.

Many countries implemented anti-corruption legislation making companies accountable for corruption and fraud, leading to the incarceration of many business leaders and politicians. Companies and governments reacted by implementing integrity and compliance activities and programmes in their environments. In light of these developments, compliance could not be simply a name, but an active area that in fact would be independent, have direct contact with decision-making leaders and the board of directors, and fully interact with all areas in a company.

Examples of legislation in Latin America

Brazilian Federal Law No. 12846 of 2013

The creation of an integrity and compliance system is provided expressly in Article 7, Item VIII, as an attenuating circumstance of the penalty of a fine. The regulation of integrity programmes is found in Articles 41 and 42 of Brazilian Federal Decree No. 8420 of 18 March 2015.

Argentine Law No. 27401 of 2017^[4]

Although this law does not broadly require Argentine companies to have an integrity programme, it does bring one exception. If a company enters into contracts with the Argentine federal government, it must have an active integrity programme so that it can participate in certain types of government contracts (for example, contracts that, according to local law, require the approval of a higher-ranking minister or civil servant, and some concession and public works contracts).

Chilean Law No. 20393 of 2009^[5]

Article 3 provides that, if a company has committed the crime of corruption, any resulting sanctions will be mitigated if, prior to the crime being committed, the company had adopted and implemented models of organisation, administration and supervision to prevent crimes such as the one committed. One way to illustrate the existence of this management model is through the implementation of an integrity and compliance system.

Peruvian Law No. 30424 of 2016^[6]

The adoption of a prevention model, such as the implementation of an integrity and compliance system, is considered a mitigating factor when applying the penalties for bribery crimes, as provided for in Article 12(e).^[7]

Colombian Law No. 1778 of 2016^[8]

Considering the principle introduced by Article 23, the Superintendency of Societies (the regulatory agency of the government of Colombia that supervises corporations) establishes the companies that must implement a business ethics programme, as well as the requirements brought by Resolution No. 100-002657 of 25 July 2016, with the market segments mentioned by this Resolution being pharmaceutical, infrastructure and construction, manufacturing, mining (energy) and information technology.^[9]

Overview

Latin American countries have introduced a variety of rules and legislation to fight corruption, bribery, money laundering and the financing of trafficking and terrorism. Compliance is, therefore, guaranteed by the application of these rules, which are rigorous and have severe penalties. However, the real fight against corruption takes place in the sphere of intentions. In other words, to amend incorrect behaviour, we must enter the mind of the acting individual, and work his or her conscience so that he or she understands that what he or she intends to do is wrong and there will be consequences for him or her, for the company and for society.

A certain level of tolerating malfeasance is still present in Latin American jurisdictions, mainly owing to society’s resignation to corruption scandals and lack of perspective and transparency of governments. Even though governments have evolved considerably, much of the efficiency of anti-corruption legislation is yet to be proven.

Jurisdictions like Colombia and Peru have evolved significantly to establish anti-corruption frameworks compliant with international standards. Moreover, Brazil is gradually recovering from Operation Car Wash and slowly, but constantly, improving its legal framework, as well as integrity and compliance awareness.

Despite efforts to fight corruption through the implementation of specific anti-corruption legal frameworks, it is clear that there is still a long way to go in Latin American countries. It is a two-way street: not only do private sectors need to change, but also public sectors, otherwise all efforts will be unsuccessful. Education and a collective awareness of integrity and principles will play a fundamental role for substantial and structural change to happen.

The implementation of an integrity and compliance system should not only be a fulfilment of a legal requirement, but must also be seen as a considerable competitive advantage for a company that carries out operations both locally and overseas. Companies and governments need to embrace their accountability and responsibility towards the legacy they leave to society.

In addition to minimising the incidence of penalties and fines, a company that acts with integrity and is in compliance with rules, regulations and legislation is also exercising its social responsibility in that it generates jobs, pays taxes, and preserves the environment, safety and health of its employees. When this compliance extends to the supply chain, the positive effects are even greater, given that the company should require that its external stakeholders adopt the same attitude towards integrity and compliance. In this sense, working collectively may transform an economic sector by creating responsible awareness.

Contrary to this idea, the absence of a structure aimed at preventing and combating corruption, bribery, fraud and other deviations from ethical conduct within the company makes it more vulnerable to illegal acts, bringing immeasurable consequences such as loss of credibility among stakeholders, as well as financial losses.

The creation of an integrity and compliance system does not guarantee the existence of an ethical culture in a company. It is necessary that actions and activities foreseen in the system be carried out continuously and effectively and experienced by all employees on a daily basis.

An integrity and compliance system put into practice

Camargo Corrêa Infra is an example of how integrity and compliance combined can positively influence and direct a company’s future. Camargo Corrêa Infra is a Brazilian infrastructure company incorporated in 2017, as a result of a turnaround and new vision of its holding company, Construções e Comércio Camargo Corrêa.

Construções e Comércio Camargo Corrêa (CCCC) was one of several major construction companies in Brazil to have been targeted in a sweeping investigation in 2014, which exposed a multibillion-dollar miasma of bribery, larceny and political manoeuvring across Latin America. As a result, CCCC was the first company to sign a leniency agreement with Brazilian authorities in 2015 and then in 2019.

At the core of CCCC’s restructuring and new direction is integrity and compliance, which also resulted in the incorporation of an entirely new company, Camargo Corrêa Infra, comprising seasoned executives hired from multinational companies to bring a new view to this new company.

CCCC was concentrated on the portfolio of works associated with the aforementioned investigation as well as with the ongoing negotiations with authorities, while Camargo Corrêa Infra started afresh and has been focusing on new engineering and construction projects. Integrity and compliance have a fundamental role in decision-making at Camargo Corrêa Infra, across all leadership levels. To achieve this, policies, rules and procedures were detailed based on integrity and compliance, and in a comprehensive way, so as to be accessible to all employees based in Brazil and overseas.

Training and communication play an important role in understanding integrity and compliance across the company, in order to enhance the company’s culture and awareness among employees and stakeholders.

As a result of this awareness, integrity becomes part of every employee’s DNA. At Camargo Corrêa Infra, there are ‘integrity agents’ from diverse areas at the company – corporate and construction sites – who volunteer to be ‘guardians’ of the integrity and compliance system. They focus on raising awareness of compliance and integrity to foster a healthy workplace culture.

This practice has had significant results: having seen integrity agents in action, more employees feel engaged with the concepts of ethics, integrity and transparency. Alongside integrity and compliance, there is also transparency. It is crucial that all parties, including employees and stakeholders, communicate transparently and share the same information pertaining to a determined situation.

At Camargo Corrêa Infra, transparency has been placed at the very centre of the company’s culture, together with integrity and compliance. The company publishes information regarding operations with governments, as well as information on safety, sustainability and environmental KPIs – including how much CO2 the business is saving or how much water it is using.

A robust integrity and compliance system based on company values and transparent, company-wide communication helps to mitigate risk and contribute to the company’s preparedness in the face of a crisis. This has been the case for Camargo Corrêa Infra in dealing with the coronavirus pandemic. On 16 March 2021, all Camargo Corrêa Infra corporate employees were sent home with their laptops to reduce the risk of contamination in the work environment. In addition, in relation to construction sites, sanitary protocols were implemented, and employees only returned to their workplaces when authorised by the authorities. Compliance controls and the development of integrity, through training and communication, were also not negatively impacted by the coronavirus pandemic. To the contrary, innovation played an important role in adapting some controls to make them 100 per cent technological and more efficient. This was owing to transparent communication that was already part of the company’s culture.

Another example of how a robust integrity and compliance system facilitates the company’s internal processes is the internalisation of environmental, social and governance (ESG) principles. In particular, the company has adapted activities according to ESG principles incorporated into the company’s strategy. Having ingrained integrity and compliance practices facilitates understanding about what has to be done, as professionals already appreciate complying with rules, working to mitigate risks, enhancing corporate governance and being aware of impacts on the internal and external environment. This all reinforces ESG practices. The ability to adapt to new situations is also the result of a robust integrity and compliance system based on the company’s values.

The relationship between an integrity and compliance system and crisis management

It is important to highlight that, for crisis management to be efficient in times such as during the coronavirus pandemic, having a robust system that works both with compliance and integrity is key. During a crisis, a company needs to continue complying with rules, regulations and legislation, as well as recover from any negative results incurred from the crisis. At this moment, if a company does not have a well-implemented integrity and transparency culture, the pressure suffered by employees to achieve positive results and minimise a negative financial impact, may cause them to give in to corruption. This is what we call the ‘fraud triangle’.

The fraud triangle was coined by Donald Cressey in 1953, and it allows us to analyse the fraudulent behaviour of employees through the observation and analysis of three dimensions: pressure, opportunity and rationalisation. Pressure, also known as motivation, may be owing to some personal problem or the need to achieve high performances; the opportunity is to take advantage of failures in internal processes or standards to achieve certain objectives at any cost; and the rationalisation involves the justification for committing such a fraud or the possibility of creating situations so that the person responsible for the irregularity can justify his or her actions.

The covid-19 pandemic has proven to be an excellent example in this sense, as employees at different leadership levels and from diverse businesses have been under pressure to achieve high performance in the midst of an unprecedented crisis. The opportunity to circumvent a company’s procedures by justifying that during this time the procedures need to be faster to prevent negative results can be the perfect storm that inevitably leads to fraud.

Some examples regarding pressure, opportunity and rationalisation arise from Latin American countries during the covid-19 pandemic. Brazil has experienced irregularities and fraud during the purchasing of face masks and respirators by governments. Argentina and Peru are facing vaccine scandals. For example, the Health Minister, Ginés González Garcia, was forced to resign from office after allegations that he had given preferential treatment to friends and family when receiving covid-19 vaccine doses. Moreover, in Peru, a similar case to that in Argentina arose. The Peruvian Health Minister, Pilar Mazzetti, resigned from office after reports of several Peruvian officials and others receiving covid-19 vaccines outside of clinical trials and before the national immunisation programme began.

Fraud and corruption does not only take place within the public sector, but also within the private sector if companies fail to implement a robust integrity and compliance system, in order to surpass strong turbulence during a pandemic period. Companies that did not have a well-established integrity and compliance system certainly experienced strong turbulence during this pandemic and, as a result, faced occasions of pressure, opportunity and rationalisation leading to fraud.

If a company does not have an integrity and compliance system that works both on complying with internal rules and regulations, as well as employees’ awareness of always doing what is right, fraud, corruption and deviations from ethical conduct may prevail during a crisis, leading to far more negative results than the crisis itself.

How to measure an integrity and compliance system’s effectiveness

In order to develop a continuous and effective integrity and compliance system, it is necessary to constitute a specific, independent and autonomous area within the company that is responsible for managing the following pillars: corporate governance, prevention, detection and correction. According to Bruno Carneiro Maeda of Maeda, Ayres & Sarubbi Advogados:

To be effective in fulfilling its purpose, a company’s compliance area must be able to: 1. inhibit and reduce the probability of committing any breach of laws, [and] internal ethical and regulatory standards of the corporation; 2. detect any undue activity or exposure to unacceptable levels of risk; and 3. react appropriately to verified deviations, allowing the application of administrative and, if applicable, judicial punishments, always quickly and fairly.^[10]

Although there are some differences among guidelines issued by the United States, the United Kingdom, Brazil, Argentina, Chile, Peru and Colombia, the common denominator among them is prevention, detection and correction. An effective system must establish standards and procedures to prevent and detect criminal conduct, and demonstrate the commitment of the company’s senior management (which should not include any person who has been involved in illegal activities or has acted contrary to an integrity and compliance system). Effective training and communication are also essential components of an integrity and compliance system, as well as monitoring the effectiveness of this system through defined auditing procedures, defining effective disciplinary mechanisms, and determining specific procedures for internal investigations and the correction of non-compliance.

A survey conducted in 2018 by Transparency International, a non-­governmental company, revealed that the continued failure of most countries to significantly control corruption is contributing to a crisis of democracy around the world. That is to say, even though some companies have created an awareness of compliance, data show that most companies have not yet heeded the risk of not having a culture of compliance, or yet a culture of integrity. To improve this situation, some companies have been adopting the nomenclature change from ‘compliance’ programme to ‘integrity and compliance’ system or programme. Furthermore, this must not be just a change of words but a change of culture, as the concept brought by the term ‘integrity’ encompasses both the fulfilment of a company’s legal and internal requirements, and the internalisation of a culture of ethics and transparency.

To illustrate this understanding, we quote Alexandre Di Miceli da Silveira:

When mismanaged, a company’s culture can become so pernicious that people often take no meaning in internal regulations and laws. The recent scandals in Brazil, evidenced by Operation Lava Jato, for example, were not caused by the absence of governance documents, but by toxic cultures that led ordinary people to omission or illegal behaviour.^[11]

In this matter, being compliant is limited to meeting regulations applicable to the company. Integrity, on the other hand, means acting correctly even if the conduct is not provided for in any regulation. This becomes a competitive advantage.

Key performance indicators

As mentioned at the beginning of this chapter, an integrity and compliance system is considered to be a management system based on the ‘plan, do, check and action’ cycle. In this way, and to guarantee the effectiveness of the system, it is not sufficient just to plan and to take action. It is also essential to measure whether the actions contemplated in the planning are having the desired effect or whether they need to be adapted.

The most robust tool to assess whether a given action is efficient is through performance indicators, comprising three variables: objectives, metrics and goals.

The objective of a KPI is what the manager seeks to accomplish in the company (the ‘why’ measure). The metric is the methodology used to evaluate the indicator (the ‘how to’ measure). Finally, the goal is the minimum index to be achieved using the metric, demonstrating whether the indicator has achieved its objective.

In terms of integrity, the main performance indicators could be divided into three pillars:

• processes:
  • training planned versus training performed;
  • result of audits (internal and external); and
  • control of the risks identified in an integrity risk assessment;
• culture:
  • dissemination of the company’s code of ethics and conduct; and
  • the company’s psychological security climate company (how safe employees feel in their work environment with regard to the quality and transparency of organisational communication, commitment from senior management, freedom to participate in meetings and decision-making); and
• leadership:
  • degree of ethical leadership in the company (assessment of leadership by their followers, considering issues of governance and integrity); and
  • periodic behavioural assessments by senior management.

Finally, performance indicators signal reached goals and therefore can be transformed into process controls. This entire process is continuous improvement put into practice.

Conclusion

It is clear that integrity and compliance must go hand in hand to create sustainable business opportunities for any given company. Doing what is right is not an option; it is mandatory and will undoubtedly create value to the business.

A robust and efficient integrity and compliance system needs to work in a dynamic and integrated way among all areas in a company, in order to mitigate diverse risks and implement procedures that will guarantee the company’s social, environmental and governance responsibility.

To achieve this efficient management model, it is essential to develop the company’s most important asset: its employees. Working alongside all employees, through training, practical daily situations, ethical dilemmas and creating consciousness and awareness towards what is right and what will make the company sustainable during time will certainly make the difference.

It is not enough just to establish rules and punishment in case of misconduct; we need to tackle unethical conduct from the very beginning in order to prevent negative consequences.Thus, when faced with the term compliance, its meaning must transcend the boundaries of law and enter the individual sphere and its complexities regarding personalities, understandings and behaviours. Developing integrity is the key to making compliance effective.

Footnotes