This has been an existential question for a long time. How do you measure compliance success? How do you know if it’s working?
Sean Griffith, director of the Corporate Law Center at Fordham University in New York casts a skeptical eye on compliance through the lens of corporate governance in a new law review article: Corporate Governance in an Era of Compliance. He concludes there is not enough data to prove that compliance works.
That part is true. It is hard to measure successful compliance.
The first goal of compliance is to prevent bad acts from happening. Part one is education to let employees know what is good and what is bad. Part two is detection so that an employee making a bad act will have a fear of getting caught.
For most organizations few bad acts ever happen. The occurrence is an outlier with no data to measure against. It is only the biggest of organizations that will have an ongoing occurrence of bad acts to measure.
For those biggest of organizations, they can measure a decrease in the occurrence of bad acts as a measure of success. But that decrease can be for one of two reasons. One reason is an actual decrease in bad acts. A sign that compliance is working. The second reason could be that the bad acts are not being caught. Employees knowing that they may get caught take extra steps to avoid their bad acts from being detected. In the second reason, compliance is not being effective. Yet the data is the same.
It’s hard to prove that something didn’t happen because of compliance.
As Professor Mike Koehler, the FCPA Professor, responded to my note, “nobody knows whether #compliance really works”, with
“Same can be said for lots of things in life – but how can one truly measure compliance success stories?”
The other problem with measuring compliance success is that “compliance” means different things to different industries and different firms.
Compliance in financial services is different from compliance in health care and different from extractive industries. You can’t find a meaningful measure of compliance across those industries.
None of this is meant to say that compliance doesn’t work. I feel strongly that it does work. The issue is merely measuring that success.
Sources:
- Compliance: Lots of Effort, But No Proof by Sue Reisinger, Corporate Counsel
- Corporate Governance in an Era of Compliance by Sean J. Griffith in SSRN; William & Mary Law Review, Vol. 57, No. 6, 2016