But, if you can muster up the courage to stay, we’ll explore some ways companies can develop ethical corporate cultures, and keep themselves from becoming the next cautionary tale splayed across the front pages of the Wall Street Journal.

1. Instilling a Corporate Culture of Integrity, Ethics And Compliance

One hears a lot these days about the “tone at the top”—that is, the message a company’s leaders communicate about how their company and its employees should comport themselves. In practice, a company’s tone is set by its leaders’ deeds, not merely their words. There are some practical suggestions corporate leaders can consider to establish a “culture of discipline” and integrity.

1. The starting point for creating an effective “tone at the top” resides with a company’s compensation committee. If ethics and integrity are really important, compensation committees have to identify them as objectives of every major management position, and compensate appropriately if those results are achieved.
   
   
2. The character of senior corporate managers is critical. Having effective procedures and policies is certainly necessary, but it’s not sufficient. A company must also have the right people in leadership positions, leaders who are truthful, transparent, and fair, just as they expect their companies and employees to be. That means leaders must not only talk the talk, they must also walk the walk. As financier and Wall Street legend Bernard Baruch aptly put it, a whole succession of technological revolutions can’t do away with the need for character or the ability to think and act ethically.
   
   
3. A climate of transparency must be set at every level. Creating a real culture of discipline and integrity requires that the entire management team, at every level, reflect these essential qualities. An appropriate culture doesn’t simply happen, and managers aren’t born knowing or exuding it; it must continuously and repeatedly be taught, inculcated and emphasized.
   
   
4. Communicate directly and honestly with employees. Corporate leaders must connect with employees face-to-face, not simply through memos and emails, or a “Wizard of Oz” approach. This means that all managers need training in ethics and communication skills.
   
   
5. Managers must be engaged in their company’s compliance and ethics program. Establishing a culture of compliance and ethics isn’t something that can be delegated. It’s hard to set a tone at the top unless those at the top demonstrate their familiarity and facility with the company’s compliance and ethics programs, and unless those at the top demonstrate their personal commitment to these programs by active involvement.
   
   
6. Employees must be “invested.” I’m not talking about employees purchasing stock in their company, although that’s nice if it happens. What I mean is that employees must feel they’re part of a team that values them and encourages them to be ethical. This is done, in part, by assuring employees they have a role to play in developing or refining existing programs, and that they will be rewarded for ethical behavior, even if it uncovers problems people would prefer not to know about.
   
   
7. Establish a corporate ombudsman. Companies that encourage their employees to raise problems internally give themselves that all-important critical step: finding out about a problem before it has become a crisis or a catastrophe.
   
   
8. Separate the message from the messenger. In far too many situations, companies start by assessing the motivations of the messenger, rather than considering the accuracy of the message. Even disgruntled employees may have accurate information about wrongdoing that is ongoing within a company. Besides, have you ever met a “gruntled” employee?
   
   
9. Provide a mechanism for various constituencies to raise their concerns internally, and then respond effectively to them. Employees must be free to raise issues. Anonymous reporting channels permit employees and others to complain about things they’ve observed without fear of retribution. This is not only important to achieve, it is important for employees to know and believe that the reporting process is truly anonymous. The use of 800 numbers and anonymous email communication systems are two effective ways to provide anonymity, but the best way to provide both anonymity and follow-up is to “outsource” the reporting function.
   
   
10. Keep careful records. It’s important not only to do the right thing, but also to be able to prove you did the right thing.
    
    
11. Use a special compliance committee. Contrary to some current wisdom, independent directors are a CEO’s best friends. The process of overseeing a company’s compliance and corporate “tone” should be vested in a special compliance or legal quality control committee. To avoid the falling-through-the-cracks syndrome, at least one member of the audit committee should be a member of the special compliance committee.
    
    
12. Employ quarterly reviews. These issues require attention all during the year, and not just on an annual anniversary.
    
    
13. Require periodic forensic audits. I can’t emphasize how important it is for companies to reassess their own auditing and accounting. Hiring an independent firm to take a look at how a company’s books are kept, perhaps triennially, is a smart move that will pay enormous dividends.
    
    
14. There is no such thing as de minimis ethical or compliance breaches. Not every breach is a hanging offense, but all breaches must be treated as serious and significant. If “senior” or “important” folks are not sanctioned even for seemingly small breaches, the company is giving a message that some people may be exempt, and some breaches, if small enough, will go unpunished. While the punishment must fit the breach, every breach should be sanctioned. Having taken that step, it’s not enough simply to sanction someone. There needs to be publicity regarding breaches and sanctions. I’m not suggesting you have to indicate that, “Employee X violated our ethical code,” but you should tell all employees if you’ve discovered conduct that is deemed to contravene your ethical precepts, and indicate that it’s been punished.
    
    
15. Employ a system of rewards for good ethics. If we want corporate managers to set the right tone, they should be rewarded when they achieve that result.
    
    
16. All companies need a formal, full-time, well-compensated senior officer position to administer ethics and compliance programs. If ethics and compliance are really important, there should be a senior officer who’s responsible for ensuring that the system remains up to date and is enforced, and that all employees know someone is paying attention on a full-time basis.
    
    
17. Just because it appears things are going well, doesn’t necessarily mean that’s the case. Don’t succumb to the Sara Pitt syndrome. Sara Pitt, my mother, was a health nut who self-medicated. Many years ago, after ignoring stomach pains for years, they finally were so bad that she gave in and went to the doctor, only to learn that she had what proved to be terminal stomach cancer. Her take on her visit to the doctor was instructive. When I inquired what the doctor said, she told me, and then said, “You know, Harvey, I was never sick a day in my life until I went to see the doctor!” Unfortunately, too many CEOs and senior officers are like my mother; they think that just because no one tells them they have cancer, they don’t actually have cancer. We all know that’s not true, so it’s important to look for problems before they find you.
    
    
18. Play out crisis scenarios. Many companies harbor the illusion that you can’t prepare for a crisis. That’s really not so. There are three certainties in life. I’ll skip the first two, since we all know what they are. But the third certainty is that there will definitely be a crisis in every company’s future. Playing out scenarios enables companies to move quickly and effectively when their next crisis hits. Notice, I said “when,” not “if.”
    
    
19. Government-mandated regulation can’t substitute for people doing their jobs honestly. I’m amazed by what I call the “reverse laissez faire approach” of so many companies: They wait for the government to tell them if what they’re doing is wrong, why it’s wrong, and how to fix it. Companies can do a far better job of finding problems and solving them than the government can. They just have to realize that it’s in their own self-interest to do so.
    
    
20. Sometimes, bad things happen to good companies. How a company deals with evidences of misconduct, however, will determine exactly how the company will be perceived. When the unthinkable occurs, companies have a small window of opportunity to seize control of the situation and cabin its consequences. Being prepared to do so is of the utmost essence.
    
    

***

II. Options Backdating

We now have an unfolding scandal over alleged backdating of option grants to senior executives. With the recent slew of news reports focusing on the corporate greed and poor governance practices that allowed options backdating to occur, it seems that the tone at the top is the sound of CEOs and compensation committees calling “Sooo-ie!” Even though it’s unlikely we’ll find much of this misconduct occurring after SOX was enacted, this is more than of historical interest. There are important lessons to be learned from this still-nascent scandal.

For one thing, options backdating may provide compelling support for those who oppose fixing Sarbanes-Oxley. SOX, hastily and badly drafted, suffers from multiple deficiencies. But one noteworthy provision is Section 403, requiring options grants be reported in two business days. This has had an empirically observed effect of diminishing the apparently widespread practice of backdating options. While there’s a need to refine SOX—at a minimum, its one-size-fits-all philosophy should be ameliorated—this unfolding scandal will give opponents of change a very powerful contrary argument.

Options backdating calls a company’s internal controls into question. Many discussions of backdating options start with the observation that backdating is not, per se, illegal. That’s wrong. Options backdating almost always involves falsification of corporate records used to gain access to corporate assets. That conduct violates the Foreign Corrupt Practices Act and its internal controls requirements. If corporate directors were complicit in these efforts, state law fiduciary obligations are violated. While companies plagued by these events must keep their focus forward-looking, the fact remains that backdating is not only illegal and unethical, it bespeaks a lack of integrity of a company’s internal controls.

Those who backdate option grant documents violate federal and state law. But those on whose watch this conduct occurred also may have potential liability. If they knew about the backdating, they were participants in fraudulent and unlawful conduct. If they didn’t know about the backdating, the question will be: Should they have done more to discover it? All that begs the question of why senior executives making millions of dollars in compensation would cheat to gain even more. And what does this say about the people who are setting the “tone at the top” in Corporate America?

Companies that have failed to properly disclose the practice of backdating face SEC investigations, tax repercussions, restatements of their financial results, plunging stock prices, and shareholder lawsuits. As more and more companies are identified as having a backdating problem, the issue for regulators, prosecutors and plaintiffs’ attorneys is often (if not always) whose fault it was. Already, directors, CEOs, CFOs, general counsels and others have resigned or been fired, with more casualties sure to follow. But from the corporate/shareholder perspective, the question is more properly one of how to move forward.

Solutions must start with the board of directors and its compensation committee. Compensation decisions shouldn’t be treated as if they were trivial. Boards and compensation committees must develop a sensible methodology for determining what they expect from each senior manager and how to measure actual performance. Larger public companies should also consider creating, filling and using an internal compensation officer. A senior internal compensation officer can assure that compensation decisions are handled appropriately, recorded, and then carried out. Similarly, compensation consultants should be paid for real performance, not mechanistic processes many use. Often, compensation consultants are hired for compensation committees by senior management. If this ever made sense, it no longer does.

Nor should compensation counsel be overlooked. They need to do a better job of explaining—and then monitoring—compensation requirements, processes and decisions. Finally, the accounting profession needs to revisit its standards. If companies are manipulating their documentation, it’s unlikely accountants will find it, no matter how bright or diligent. But the considerable breadth of this problem to date suggests that auditors need to spend more time with their audit clients identifying critical controls, and then evaluate how well those controls are applied, and how easily they can be avoided.

When I was at the SEC, we often remarked on the “driverless” car syndrome: When corporate fraud occurred, very often those who served in positions of responsibility would deny that they were “driving” at the time of the wreck. The only way to avoid a recurrence of this is to make sure many different hands are on the wheel, and that those hands are engaged in building an ethical and responsible culture throughout the company.

Thank you.