Theories of Corporate Compliance

Before I entered academia, I was a compliance attorney at a large, public company.  Prior to that, I was a federal prosecutor in Manhattan.  It was no accident that the large, public company hired me to work on compliance matters.  During my fifth year at the United States Attorney's Office (around 2003-2004), I received several calls from recruiters who were looking for prosecutors interested in taking in-house jobs in "compliance."

Different people ascribed different purposes to corporate compliance departments.  The DOJ perceived compliance as a means of leveraging its police power. Compared to outsiders, internal compliance people could more easily find and prevent wrongdoing. 

Another view of compliance was that in addition to policing and deterring wrongdoing, it should serve as a means of improving ethical norms within corporations.  If greed had driven Jeffrey Skilling and Bernie Ebbers, then compliance programs were needed to improve organizational culture.

Finally, there was a third view of compliance - that it would improve deliberation within companies.  Specifically, employees would feel empowered to speak up and take action when it appeared their supervisors were violating the law or company policies.  Hotlines and robust compliance organizations theoretically would facilitate such voice. 

In sum, people would be deterred from wrongdoing, adopt nicer values and talk to each other more.  What's not to like?  More after the jump ....

Of course, if you ascribe too many goals to one policy, inevitably that policy will disappoint.  As it turns out, effective internal policing requires a certain level of deceit.  Even a surprise audit is "deceitful" in the sense that it is designed to occur without warning.  Deceit, however, clashes with some of the norms that the ethics folks were touting, like loyalty and transparency.  As I argued in this piece, you can't have both without creating some serious friction.

Policing does not necessarily lead to more or better deliberation either. I'll address this in more detail in a later post, but suffice it to say that there has been no indication that compliance organizations within publicly held companies caused managers to make better decisions or avoid bad risks (although compliance people might argue that this wasn't their job). For that, you arguably need "enterprise risk management" (ERM) and whatever its benefits, ERM does not draw on the same skill set as corporate policing.

So all this leaves me a serious skeptic of the value of compliance.  It may have temporarily restored public confidence in the stock market, but it certainly did not eliminate crime, much less improve corporate values.  (If you thought corporate titans were too greedy back in 2001, I imagine you found them just as greedy in 2009).  Sometimes, too much confidence can be a bad thing.  Just as the legal industry is headed for a large change, the much younger compliance industry may be facing its own tipping point quite soon.