These CFOs engage with HR, legal, and other functions (including internal audit and the compliance office) to ensure the company is communicating its standards and expectations, training employees as needed, and providing an effective mechanism for employees and others to report suspected wrongdoing, investigate potential violations, and generally monitor the ethics program.

The Ethics Resource Center recently published its biannual business ethics report, based on a survey of 4,800 responses from various levels of employees. While I won’t say the results are remarkably different from the prior, 2009 survey, I was surprised by some of the statistics and suspect most CFOs will be also about the current U.S. environment:
- 45% of employees have witnessed misconduct at work. While this figure is down from 49% in 2009 and 55% in 2007, it is still remarkably high and justifies continued vigilance.
- Nearly two-thirds have reported misconduct, the highest level on record. Unfortunately, 22% of those who reported misconduct suffered retaliation as a direct result. This is higher than the 15% in 2009 and 12% in 2007, and should be a cause of great concern. The only conclusion I can draw is that employees are not aware of their company’s internal-reporting process. The report says only 5% of reported misconduct were via hotlines. Unfortunately, the study did not ask about awareness of hotlines.
- The number of companies with “weak ethics cultures” rose from 35% in 2009 to 42% last year. However, 42% said “their company has increased efforts to raise awareness about ethics.”
- More people (now 13%) are feeling pressure to bend the rules, or even break the law.
- Just over one-third of employees said their managers do not display ethical behavior (up from 24% in 2009). That can have a cascading effect through the organization, resulting in a company of employees who are more likely to violate the code of ethics.

To overcome these poor results, the report recommends that executives:
- Invest in ethics and compliance programs, and view ethics as a business priority.
- Make ethical leadership part of all managers’ evaluations.
- Communicate their personal commitment to ethical conduct. One way is by using social networks to connect with employees and engage them in ethics-related discussions.
- Focus on their own behavior, because their actions (walking the talk) and responses to reports of misconduct are at the heart of the matter.

But are those steps enough?

I suggest CFOs go further and ask these questions: Is it time to revisit the HR-preferred “talk to your supervisor” approach to potential problems, and replace it by encouraging employees to report independently of their supervisors? Shouldn’t an ethics program be risk-based, looking at the areas of greatest potential harm (which may not include reports of wasting time at work -- the most frequently reported misconduct, according to the survey), ensuring policies and controls are sound (including training), putting metrics in place, and then monitoring at regular intervals?

I also recommend bringing in internal audit to assess all or part of the program and assure the CFO and the rest of the executive team that the program is meeting expectations.

CFOs cannot, in my opinion, leave the issue of ethics to human resources, legal, compliance, or audit. It’s a management responsibility, and the CFO can add great value by taking the lead. They should ask the questions that cut to the heart of the ethics program, being alert to any signs of inappropriate behavior, and setting an example for all to follow.

Published in first on CFO.com:
www3.cfo.com/blogs/risk-compliance/risks--compliance/2012/05/98018d1e-821c-416e-b91d-ce2d0a021351

Norman Marks, CPA, is vice president, governance, risk, and compliance for SAP's BusinessObjects division, and has been a chief audit executive of major global corporations for more than 15 years. He is the contributing editor to Internal Auditor’s “Governance Perspectives” column.
normanmarks.wordpress.com/