Corporate Culture
Emerging trends and international best practiceCorporate Culture
Emerging trends and international best practice‘Culture’ on the agenda
It is hard to escape the fact that “culture” hasbecome a buzzword in the field of corporaterisk management. Conversations around board
room tables, with regulators, with advisers andbetween industry peers focus on the subject,leading quickly to difficult questions aroundhow to define, measure and improve anorganisation’s culture.
From a regulatory perspective, the belief that
culture and risk are inextricably linked has
been made clear. This is particularly the case in
the financial services industry, where bodies
such as the UK’s Financial Conduct Authority,
the Financial Stability Board, the Hong Kong
Monetary Authority and the Federal Reserve
Bank of New York have all highlighted theirfocus on culture, and their view that a ‘good’culture can act as a risk management tool.
The trend continues outside the financial
services sector, with clear expectations being
set by institutional investors and industry
bodies that quoted companies will have regard
to their culture in managing risk and delivering
long term success.
Messages around culture are also flowing fromprosecutors such as the Department of Justicein the US and the Serious Fraud Office in theUK, as they set out their views on the featuresof a successful compliance programme.

There is widespread acceptance that achieving
the ‘right’ corporate culture can go a long way
towards helping to manage risk. Employee
misconduct risk is at the heart of the risksfacing businesses today. The actions of
employees can lead to material reputational or
financial damage (and in a worst case scenario,
criminal liability). Managing that risk is notjust about catching ‘bad apples’ who engage in
intentional wrongdoing. Many incidents of
misconduct stem from broader cultural issues
that create an attitude of non-compliance with
policies or poor decision-making. A focus on
culture within compliance programmes can bea critical tool that helps organisations manage
the risk of misconduct.
As we set out in this guide, culture adds value
in three core areas from a risk management
perspective:• Firstly, in the prevention of wrongdoing;• Secondly, in the identification of any
wrongdoing that slips through the net; and• Thirdly, in a worst case scenario, in
demonstrating to a regulator, prosecutor orother interested stakeholders that aneffective and appropriate complianceprogramme has been operated and that anorganisation has done all it reasonably
could to prevent misconduct.

2

Corporate Culture
Emerging trends and international best practice

A framework for thinking
about culture
Understanding why things go wrong –lessons learned from our experience

direct cause or by creating an environment inwhich misconduct has been able to flourish.

We have a wealth of experience of undertaking
investigations worldwide and seeing first-handthe consequences of things going wrong.
We advise on the most sensitive issues thatbusinesses face – whether those areinvestigations into competition or regulatory
breaches, boardroom disputes or material
reputational issues.

On the basis of interviews with lawyers acrossour global network who have been involved insome of the major investigations on which thefirm has been instructed, we identified 12
cultural factors present in environments inwhich misconduct or other problems occurred,
in a range of countries and across a variety of
sectors.

Drawing upon our experience of investigations
across a range of sectors and geographies, we
carried out an empirical analysis of theunderlying cultural factors that may haveallowed misconduct to take place, whether as a

We grouped the 12 factors into three
categories, depending on the frequency withwhich they arose in the investigations we
reviewed.

Lack ofspeak-up
cultureUnclearallocation of
responsibility

Lack of training
and unclear
policies

Strongpersonalities

Highlytechnical areas

Weak legal/
compliance

Overlooking
red flags

Not questioning
over-performance

Languagebarriers

Conflicts
of interest

3

Inadequate
records

Unclearcommunication

Corporate Culture
Emerging trends and international best practice

A framework for thinking
about culture
There are many examples of each of thesefactors arising in practice and there isfrequently a degree of overlap between them.
Not all of these factors can (or should,
necessarily) be eliminated. Instead, the focus
should be on identifying whether they arepresent, considering what risks they may poseand deciding what steps could be taken to
reduce those risks.
The 12 factors have been tested by us as aframework to assess the culture of anorganisation to good effect, through a
combination of survey data and qualitativeinterviews. Using a framework approach canhelp organisations to give a structure to theirefforts to monitor and test corporate culture,providing a starting point for the possible risk
factors that it may be appropriate to test. It is
important to remember that corporate cultures
are not always simply ‘good’ or ‘bad’ –particular features can have both positive andnegative consequences. For example,
collaborative and supportive environments
may be rewarding to work in but makeindividuals reluctant to challenge others or
have difficult conversations withThis area of the businessis particularly technical,
so who from a risk andcompliance perspective
really understands it andcan provide the rightscrutiny?

underperformers who make mistakes andexpose the organisation to regulatory risks.
The key for organisations is to identify the risks
or vulnerabilities arising from their own
corporate culture and to think in practical ways
about how to address those.
Having identified their list, an organisation canthen ask itself important questions at all levels,from the board to middle management, as it
moves towards managing risk – for example:

We know we have a strong
personality in this areaof the business, so who acts
as the counter-balance
to that person?

We have a whistleblowing
policy and a hotline, but
do our employees reallyfeel able to speak up?

4

Corporate Culture
Emerging trends and international best practice

A framework for thinking
about culture
Culture can feel like a nebulous topic and one of the most difficult
questions an organisation will ask itself is where to begin in tackling
it. There is a danger that culture may be seen as a ‘soft’ issue that is
the sole domain of HR, or that significant time and energy will bespent in focusing on culture without generating any measurable
output.
We have set out our views and experience in this guide, using thefollowing framework:

What are we talking about when
we refer to ‘culture’, and what do
we mean when we say that it canbe a risk management tool?

Why does this matter?

Who should be accountable foran organisation’s culture

Where within the businessshould an organisation focus its
efforts?

When is it most important tofocus on culture?

How can an organisation use
culture in its risk management
efforts?

Corporate Culture
Emerging trends and international best practice

What do we mean by culture?
There is a wealth of commentary and analysis
on culture and how it should be defined. A
typical definition that is offered is “how we dothings around here” – a statement that is
capable of capturing everything from the toneof internal discussions to an organisation’s
hierarchy, the respect afforded to colleagues,
the fairness with which customers are treated,
the way in which employees are remunerated
and the willingness of staff to raise matters ofconcern. Culture is often mentioned in thesame breath as ‘values’. It may be easiest to
consider these complementary concepts asfollows:

ValuesThe principles that anorganisation subscribes to, andwhich guide its approach.

CultureThe practices and processes
operated by an organisation,
through which it demonstrates
its values.

As lawyers, we do not specialise inorganisational psychology and we make noattempt to look at culture through the lens of
behavioural science. When we refer to culture,
our focus is on the cultural factors that can
expose an organisation to risk and how culture
can be woven into compliance programmes
and governance arrangements. Looked atthrough that lens, the exercise of setting,measuring and changing culture has a clear
risk management purpose.

We would add ‘governance’ to the suite ofterms that organisations should be thinking
about at the same time as culture. Governancearrangements provide the framework within
which decision-making takes place, acting as aset of guide rails to assist an organisation tooperate in a manner consistent with its values.
Each organisation must define its own values
and desired culture. Undertaking that exercise,and communicating the results to theworkforce, will lay the groundwork foreverything that follows. Having set andcommunicated its desired culture, the nextquestions are likely to be:• What is the gap (if any) between our desired
culture and our actual culture; and• How are we going to close that gap?

6

Corporate Culture
Emerging trends and international best practice

Why does this matter?
There are many stakeholders who areinterested in the efforts that companies aremaking in respect of culture.

Media
Workforce
Regulators
Customers
Prosecutors
Competitors
Shareholders

The interests of some of these stakeholders incultural issues are obvious. For example:• the media may seize on a cultural news
story as an opportunity to generateattention and attract viewers/readers;• members of the workforce will care about
the environment in which they areoperating and how they are treated by theircolleagues and managers;• customers will care about an organisation’s
culture to the extent it impacts upon thefairness with which they are treated, andthe level of service that they receive.
Cultural factors can also impact reputation
and brand, both of which can influence
customer choices; and• companies will have an interest in news
stories about their competitors, whether
positive or negative. The positive stories
may provide food for thought and a catalyst
for change, whilst the negative stories may
demonstrate a weakness that is ripe forpotential exploitation.
We have set out below in more detail thedifferent perspectives of shareholders,regulators and prosecutors, to emphasise theimportance of this topic and the need for it toreceive attention at the highest levels.

7

Corporate Culture
Emerging trends and international best practice

Why does this matter?
Shareholders
To state the obvious, shareholders have aninterest in the success of the companies inwhich they invest. If a focus on culture will
enhance that success, whether throughappealing to customers, acting as an effective
risk management tool or withstanding thescrutiny of regulators or prosecutors, it
represents good news for shareholders.
Institutional investors have acknowledged therole that culture has to play in a company’s
success. State Street Global Advisors, forexample, stated in 2019:'This year we will be focusing on corporate
culture as one of the many, growing intangible
value drivers that affect a company’s ability to
execute its long-term strategy. We
acknowledge that corporate culture, like manyother intangible assets, is difficult to measureand manage. However, we also recognize thatat a time of unprecedented businessdisruptions, whether in the form oftechnology, climate or other exogenous shocks,
a company’s ability to promote the attitudes
and behaviors needed to navigate a much
more challenging business terrain will be
increasingly important. We all know the oldchestnut that culture eats strategy forbreakfast, but studies show that intangibles
such as corporate culture are driving agreater share of corporate value, precisely
because the challenges of change andinnovation are growing more acute.'1

It goes on to state that:'The board should assess and monitor culture.
Where it is not satisfied that policy, practices
or behaviour throughout the business arealigned with the company’s purpose, values
and strategy, it should seek assurance thatmanagement has taken corrective action. The
annual report should explain the board’s
activities and any action taken.'In its Annual Review, published in January
2020, the Financial Reporting Council statedclearly its high expectations of boards of
directors when it comes to setting and testing
culture, and commented on the limited(voluntary) reporting it had observed to date:'The FRC recognises that leading andmaintaining the right culture for a company
requires long-term commitment by the board.
It was disappointing that only a small numberof boards disclosed that they already receive
reports on culture to aid discussions,especially as the importance of corporate
culture was raised by the FRC more than three
years ago. Moreover, only a few reported thatit had a specific agenda item on alignment of
culture with values and strategy.'
The direction of travel is clear: culture is a topic
with which the most senior individuals within acompany must engage. Moreover, they must beable to explain what that engagement has
involved.

We include within the ‘shareholder’ category
the expectations that are placed upon quoted
companies by industry bodies and relevant
regulators. In the UK, the Corporate
Governance Code published by the Financial
Reporting Council sets out the principle thatboards of directors are responsible forcorporate culture:'The board should establish the company’s
purpose, values and strategy, and satisfy itself
that these and its culture are aligned. All
directors must act with integrity, lead byexample and promote the desired culture.'1https://corpgov.law.harvard.edu/2019/01/15/2019-

proxy-letter-aligning-corporate-culture-with-longterm-strategy/8

Corporate Culture
Emerging trends and international best practice

Why does this matter?
Regulators and prosecutors
Organisations in the financial services industry will be well-versed in the topic of culture andthe focus by their regulators and industry bodies on it. To give just a few examples:

UK Financial Conduct Authority:

Federal Reserve Bank of New
York:

In its March 2018 paper on Transforming
Culture in Financial Services, the FCA
stated that 'Culture in financial services iswidely accepted as a key root cause of the
major conduct failings that have occurred
within the industry in recent history.' It
added that 'Given its impact and the role itneeds to play in re-building trust in
financial services, firms’ culture is apriority for the FCA.'John Williams, President of the NY Fed,
said in a speech in January 2020,'…culture is both the hardest and the mostimportant thing to get right. Culture is at
the heart of behavior and norms, and thesingle most important factor driving thedecision-making of employees. It’s not an
exaggeration to say that culture is critical- both when things go right, and when
they go wrong.'

Hong Kong Monetary Authority:

Financial Stability Board:

In March 2017, the HKMA initiated a bankculture reform, seeking to encouragebanks to 'develop and promote a soundcorporate culture that supports prudent
risk management and contributes
towards incentivising proper staff
behaviour that will lead to positive
customer outcomes and high ethicalstandards in the banking industry, so thatbanks put their safety and soundness aswell as the interests of depositors andcustomers at the centre stage in the
pursuit of commercial interests.'

The FSB, in its toolkit on 'Strengthening
Governance Frameworks to Mitigate
Misconduct Risk', said that 'A firm’s
culture plays an important role in
influencing the actions and decisions
taken by employees within the firm and inshaping the firm’s attitude toward its
stakeholders, including supervisors andregulators. It also may allow or
encourage misconduct by individuals, orlarge numbers of employees, particularly
if instances of misconduct are overlooked.'Corporate Culture
Emerging trends and international best practice

Why does this matter?
Regulators and prosecutors – continued
The focus on culture is not confined to thefinancial services industry. It transcends
sectors and is a relevant factor for prosecutors
when considering the culpability of companies
in which wrongdoing has occurred. The UK’s
Serious Fraud Office published in January
2020 its views on evaluating corporate
compliance programmes. It cited with approval
the guidelines published by the Ministry ofJustice on the UK Bribery Act, in which there
are notable references to culture, withemphasis being placed on the role of the board
to 'foster a culture in which bribery is neveracceptable.'
The US Department of Justice’s guidelines on
effective compliance programmes refer heavily
to the 'culture of compliance' and ask:
'How often and how does the company
measure its culture of compliance? Does thecompany seek input from all levels of
employees to determine whether they perceive
senior and middle management’s commitment
to compliance? What steps has the company
taken in response to its measurement of thecompliance culture?'

are a prevalent feature of the US litigation
landscape, are gaining momentum in the UK
and may soon be introduced in Australia. In
deciding whether to invite a party to enter into
DPA negotiations, public interest factors forand against prosecution will be weighed. These
will include the presence or absence of a proactive corporate compliance programme at thetime the offence was committed. If a DPA is
put in place, there will be an inevitable andongoing focus on the effectiveness of theorganisation’s compliance programme, most
likely overseen by a monitor. Cultural factors
contributing towards the success of thatcompliance programme will therefore be highly
relevant.
Regardless of which stakeholders are the most
relevant for an organisation, it is clear that a
focus on culture is becoming a matter ofinternational best practice and a necessary areaof focus at the highest level.

The presence or absence of an effective
compliance programme can be a key feature in
the decision as to whether to prosecute anorganisation or to invite negotiation of adeferred prosecution agreement (DPA). DPAs

10

Corporate Culture
Emerging trends and international best practiceWho should be accountable for an
organisation’s culture and where
within the business should anorganisation focus its efforts?
We have addressed the ‘who’ and ‘where’
questions together as they are closely linked.
The board of directors is usually cited as thestarting point for setting culture, and that
expectation is made clear in the statements
referred to earlier in this guide. In light of this,any director should be able to do the following:• Articulate the organisation’s values andculture;• Explain how culture is assessed, what gaps
have been identified and the steps that are
being taken to address them; and• Understand and test the organisation’s
progress against its stated cultural goals.
While ultimate accountability for an
organisation’s culture may most logically rest at
the top, a culture programme which fails topermeate throughout the organisation isunlikely to be effective. In cascading a culture
programme, the buy-in of the various layers ofmanagement will be critical, and that buy-in
may best be achieved by placing someaccountability for culture at their door.
As well as considering who within the businessshould be accountable for culture,organisations must consider where to focus
their efforts. In a speech delivered in June
2019, the Chair of the Supervisory Board of theEuropean Central Bank stated that:… The first line of defence is where a culturalshift is needed most, and still lags behind at
many banks. The frontline business units, at
all levels, should continuously check whether
their behaviour is in line with the declaredvalues and desired conduct of the bank. They
sometimes fail to do so because they areobsessively focusing on meeting quantitative
targets, for instance. If this is the case, though,it is very difficult for the other two lines ofdefence to ensure proper behaviour and agenuine and lasting cultural shift. Only whena strong risk culture and sound standards ofconduct are fundamentally embedded in the
behaviour of the business areas will gooddecisions become the norm.'
The idea that the focus on culture should occur
throughout an organisation and include
frontline business units at all levels may be
daunting. For practical purposes, there may be
merit in undertaking a risk assessment andfocusing first on specific areas of the business –eg those that would present the greatest overallrisk if misconduct were to occur, or thosewhere an assessment of culture has
demonstrated that a worrying gap exists
between intention and reality.

'The tone from the top has an important role toplay, but it is not enough: a sound culture has
to be embedded at all levels of theorganisation, with particular attention to
middle management and frontline business…

11

Corporate Culture
Emerging trends and international best practiceWho should be accountable for an
organisation’s culture and where
within the business should anorganisation focus its efforts?
Although the ECB speech quoted on theprevious page related to banks in particular, thecore message translates well to otherindustries. Whatever sector an organisation isin, the strength of any messaging aroundculture (and in turn, the effectiveness of culture
as a risk management tool) depends on its
promotion throughout the organisation. Thereis a need to move beyond the age-old focus on
tone from the top – or, at least, to understandthat the ‘top’ can mean different things fordifferent people. To a junior employee in aremote area of the business, the board of
directors may feel impossibly remote andirrelevant to their day-to-day work. For them,the ‘top’ for all practical purposes may be acountry manager, the head of a business unit oreven their direct line manager. The messaging
and tone from that person will therefore be as(if not more) important than that of the board.
The US Department of Justice refers in its‘Evaluation of Corporate Compliance
Programmes’ guidance to the importance of thecompliance message flowing down through anorganisation:'The company’s top leaders – the board of
directors and executives – set the tone for the
rest of the company. Prosecutors should
examine the extent to which senior
management have clearly articulated thecompany’s ethical standards, conveyed anddisseminated them in clear and unambiguous
terms, and demonstrated rigorous adherenceby example. Prosecutors should also examine
how middle management, in turn, havereinforced those standards and encouraged
employees to abide by them.'
The key for the board and senior management,
having set the tone, will be to understand andtest whether and how their message permeates
and to have access to sufficient information toallow that testing to take place.

12

Corporate Culture
Emerging trends and international best practice

When is it most important to focus
on culture?
The default answer to this question is that
culture should be a constant feature on anorganisation’s agenda and a matter to which its
senior management has continuous regard.
Inevitably, though, there will be times when thefocus on culture is greater. We have considered
the 'when' question in two ways:

After detection, the next step is investigation.
Appropriate triage and consideration of theissues raised by any reported incident is
critical, and another culture test is the ability ofdifferent functions (HR, Legal, Compliance,
Internal Audit) to work together to best
identify and address risks.

• At what stage in the cycle of risk should
efforts be focused?

Finally, remedial steps have a role to play inmanaging further risk. Culture forms a part ofthat, whether in identifying the root causes ofthings going wrong or in the steps taken toprevent a recurrence. The key message fromour experience is the importance of learning
lessons from the problems that arise andthinking about everyday steps that can be taken
to manage these sources of risk.

• What are the culture ‘triggers’ which mightcause an organisation to focus on (or revisit)
aspects of its culture?

The risk cycle
In an ideal world, efforts would concentrate on
the use of culture to prevent wrongdoing andwould achieve total success. However, somethings will slip through even the most tightlydrawn preventative net – whether because
there are rogue ‘bad actors’ within an
organisation or employees who inadvertently
stray off course. This means that detection isimportant. If wrongdoing cannot be stopped in
the first place, the next best thing is to spot it
early so that any damage can be contained. The
ability and willingness of employees to raise
concerns plays a huge role in detection,
meaning that a speak-up culture is important.

The risk
cycle

13

Corporate Culture
Emerging trends and international best practice

When is it most important to focus
on culture?
Triggers for a focus on culture
Particular events in an organisation’s life cycle, or wider market conditions, may trigger a need ordesire to focus on culture. These include:

M&A Activity

Changes in Leadership

The combining of two (or more)businesses, which may have different
risk appetites and risk management
frameworks, is an obvious time to standback and take a holistic look at culture
and governance and to consider how
best to achieve consistency or reduce
conflict.

If culture is set at the top of anorganisation, then a change inleadership is an obvious point at which aperiod of reflection might occur – notnecessarily with a view to changing
culture, but at least to measuring it andunderstanding whether any statedobjectives have been met.

Near-misses or reported incidents

Changes in legislation or
guidance'Never waste a crisis' is the mantra ofmany lawyers and compliance heads.
Some of the most valuable lessons about
an organisation’s culture and risk
exposure can be learned through a root
cause analysis following a near-miss oran incident of wrongdoing.

The introduction of new legislation or
regulatory or prosecutorial guidancemight cause an organisation to revisit its
risk management framework and its
effectiveness. A consideration of culture
in connection with that assessment is aworthwhile exercise

Responding to feedback

Peer group problems

Employee engagement surveys and exit
interviews are a valuable means ofassessing an organisation’s progressagainst its cultural objectives.
Unexpected or negative results may
prompt a focus on particular areas ofconcern.

When a crisis hits a competitor, it might
be time for an organisation to turn its
attention inwards and consider whether
it faces exposure to similar risks, andwhether those risks are being effectively
managed.

14

Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
The most important (and challenging) question is
how an organisation should use culture to assist
in its risk management efforts.
The first point to make is that efforts need, to alarge extent, to be bespoke to an organisation.
The risks faced by organisations are specific tothe jurisdictions and industries in which they
operate and, in some cases, the individuals whomthey employ. Nevertheless, there are some core
steps that all organisations can consider and, in
our experience, some cultural risk factors thattranscend industries and geographies.
We outlined on pages 3 and 4 the lessons
learned from our experience of the cultural
factors that can play a part in things goingwrong. The key for any organisation is to
identify the risks arising from its own
corporate culture, and to use that list as thebasis for its risk management efforts.

15

Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
Practical ways to test culture
Once an organisation has articulated its desired culture and identified a list of the points that it
may wish to stress-test, the next step is to identify the tools that might be used to undertake any
assessment. Again, there is not a one-size-fits-all answer, but all or some of the following may be
useful:Employee surveys

Exit interviews

MI from
whistleblowing
hotlines

Audits – specificor general

Lessons learned
exercises

Employee surveys can capture views on a range of topics and are a useful
tool for measuring attitudes and awareness. A critical point if organisations
are going to use surveys is being prepared to address both the positive andnegative information flowing from them, and taking steps to resolve any
concerns highlighted.
Exit interviews are a rich source of information (and, some might say, themost revealing in terms of cultural issues as a departing employee may feel
more willing or able to speak candidly than at any other time). Carrying out
trends analysis and looking for patterns in exit interview data is important,as well as reporting on that data (on an anonymised basis, as appropriate)
to ensure that senior stakeholders are aware of the trends emerging or canspot red flags.
Whistleblowing reports are a rich source of data (albeit one which often
requires some ‘sifting’, to separate day-to-day workplace complaints from
more serious or systemic issues). Again, trends analysis is key – assessing
whether there are hot spots within particular business areas or geographies,
or particular patterns of behaviour emerging which may point to wider
cultural issues. Equally, data on usage of the whistleblowing hotline can be
useful. Low usage rates can be as worrying as a high number of reports, andmay indicate a lack of awareness or a lack of willingness to use this route forraising issues.
Audits targeted at culture (or specific cultural issues) are increasingly
popular and a range of providers are emerging. Key points to think about
when considering an audit include: (i) what is the organisation’s desired
culture; (ii) what are the particular ‘worry’ areas on which any audit should
focus; (iii) what does the organisation want to achieve through the audit; (iv)
who will be responsible for taking forward any learnings orrecommendations; and (v) how will success be measured?
‘Lessons learned’ exercises often focus on one particular issue rather thanlooking holistically across a range of issues. The tendency in the aftermathof a crisis is to focus on the immediate conduct and systems and controls
issues rather than the impact of the corporate cultural environment in which
the problems occurred. Standing back and looking holistically at theorganisation’s recent (and more historic) experience is likely to be moreculturally revealing. The exercise may give a valuable data point to look at indeveloping culture in a practical and meaningful way.

16

Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
Practical ways to test culture - continued
It is likely that a combination of tools will need to be deployed to test culture. The UK’s Financial
Reporting Council, commenting on annual reporting by companies on their efforts to assess andmonitor culture, noted that the main tool used by companies:'appeared to be employee engagement surveys, with the main metric being completion rates ofsuch surveys. While these are beneficial, they only provide a snapshot of information and should
not be used in isolation.'
The FRC went on to state that 'Very few companies cited more than three metrics used to monitor
and assess culture. Linking different sources of information together will help companies better
understand their culture.'

Tools to shape culture and manage misconduct risk
Once any assessment exercise has been undertaken, consideration will turn to how to effectmeaningful change and to close any gaps identified between intention and reality. In the context ofapproaching culture as a risk management exercise, the following steps may prove useful. Many ofthese factor into the design of an effective compliance programme.
There is a careful balance to be struck between demonstrable, measurable procedures and lessstructured approaches that are designed to win over hearts and minds in the fight against
misconduct risk. While there is an evident shift towards behaviour-based compliance efforts, there
is also a place for rules and the need to be able to measure compliance in order to demonstrateeffectiveness. Whichever end of the spectrum an organisation may gravitate towards, culture is
likely to be a core part of its compliance efforts.

Linkage between
culture andremuneration

There is a widely accepted link between remuneration and behaviour – inparticular, the notion that inappropriate performance metrics (to which
remuneration is tied) could drive inappropriate behaviour. Conversely,
having the right performance metrics might incentivise behaviour that isbetter aligned with the organisation’s culture and values.
In the financial services sector, this link has been addressed through strict
requirements around employee remuneration, including tools such as
malus and clawback, deferral and payment in share-based instruments tobetter align employees with the long-term interests of the company andits shareholders. Outside the financial services sphere, corporate
governance requirements place emphasis on the link between
remuneration and long-term sustainable performance. Remunerationcommittees may wish to consider whether there is more that could bedone – eg setting specific key performance indicators which are directly
linked to culture (whether at an individual, business unit or group-widelevel) and demonstrating a willingness to impact remuneration (negatively
or positively) based on an employee’s alignment with culture and values.

17Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
Tools to shape culture and manage misconduct risk
Training is a key pillar in the management of misconduct risk, andensuring that it is as effective as possible is critical.

Training

There is evidence of an evolving approach to training. For example, manyorganisations are focusing strongly on emotion, storytelling and making
the misconduct ‘feel personal’ to make their training impactful. Other
possible approaches include working cultural concerns (ideally bespoke tothe organisation, based on any prior assessment of its culture) intotraining by using case studies that reflect possible real-life scenarios
within the organisation, in order to understand how people would react
and to give them strategies for future use.
Not only is it key to ensure attendance at and completion of training, it isalso important for organisations to consider appropriate follow-up
actions, allowing them to test the effectiveness of that training - theclassic example is a fake phishing email after cybersecurity training.

Demystifying thewhistleblowing
process

Having a strong speak-up culture is a critical part of any organisation’s
compliance efforts. Although prevention will always be better than cure, itwill not be possible to prevent every incident of misconduct or poor
decision-making. An important fallback is the ability for an organisation to
spot issues as early as possible, so that problematic conduct can be
stopped and appropriate remedial action taken. However well-resourced aCompliance function may be and however sophisticated its monitoringand surveillance, using the eyes and ears of the workforce to spot issues isof fundamental importance.
Information can be a powerful tool in cultivating a healthy speak-up
culture. This can range from training sessions on how the organisation’s
whistleblowing system works, explaining the end to end process and what
employees might expect if they report a concern, to feedback provided to
employees who have raised concerns. Feedback is particularly importantin mitigating the feeling of futility that many whistleblowers report. A
perception (whether right or wrong) that a reported concern has
disappeared into a black hole is likely to have a chilling effect on speak-up
culture.

Multi-disciplinary
teams

Working horizontally across teams can be valuable in tackling misconductrisk, given the different perspectives that are brought to the table. The
willingness and ability of cross-functional teams to work together is an
aspect of culture which it may be beneficial to address as part ofdesigning any compliance programme.
Legal, Compliance and Audit teams should be conscious of the need to
draw the threads together when separate issues are raised, in case there
is in fact a bigger underlying issue requiring investigation. Employees may
only complain about part of a problem because they may not have sightof the full issue. Because of this, it is important to stand back and look at
the totality of complaints and investigate what they are saying about theorganisation. It is also why it is important for different functions to work
together and pool knowledge and experience – it may only be when agroup of functions come together that they collectively spot a trend or abigger problem.

18

Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
Tools to shape culture and manage misconduct risk – continued

A greater focus on
behaviours andprinciples, rather thanrules and regulations.

Despite the importance of clear rules, a focus on behaviours that are
problematic could help address a range of potential legal, regulatory andcompliance issues in a more effective way than prescriptive rules andpolicies. There are specific behaviours that underlie or could indicate
misconduct or legal risk – for example, failure to challenge suspicious
activity or dubious instructions, or demonstrating a disregard for ‘lowlevel’ compliance requirements. From a practical perspective, focussing on
behaviours might include:
Defining what good behaviour looks like through training, performance
reviews and communications.
Encouraging people to raise issues if they see behaviours that fall short ofthat standard (even if they cannot articulate a specific legal violation).
Recognising and rewarding good behaviours.
Providing frameworks to assess behaviours.
Tracking what behaviours give rise to legal or regulatory breaches andusing that data to develop future training or monitoring techniques.
There remains a place for rules (eg an anti-bribery policy), not least to
assist companies in demonstrating they have taken reasonable steps toprevent particular actions, but a programme of focusing more holisticallyon behaviours and principles could be a powerful complimentary tool.

Response to incidents –disciplinary action

There is a clear expectation by regulators and prosecutors alike thatorganisations will take decisive action in response to wrongdoing. Froman employment perspective, this is likely to mean disciplinary action.
Organisations should be ready to explain what steps they have taken (ornot taken). Dismissal will not always be the correct answer, whether
because of employment law constraints or a strong feeling that an
employee has learned their lesson and can act as a positive culture carrierin the future. Nevertheless, if the individuals who engaged in any
identified misconduct remain employed, organisations should be ready to
explain why that decision has been made.
As well as giving a strong message to third parties, disciplinary action canhave an impact on the culture within an organisation. Demonstrating toemployees that certain conduct has been met with a zero tolerance
response can be a powerful tool in emphasising an organisation’scommitment to its stated culture.

19

Corporate Culture
Emerging trends and international best practiceHow should an organisation use
culture in its risk management efforts?
Tools to shape culture and manage misconduct risk – continued

Understanding
and using data

Data, in the form of employee engagement surveys, exit interviews andtrends analysis, can be incredibly useful in providing information about
aspects of an organisation’s culture. Equally, that data can inform thesteps that are taken to make improvements.
Boards and senior management should consider the quality of the datathat is presented to them, and whether it is sufficient to give them ameaningful picture of the issues that are arising within the business. For
example, do they know:•

The recent trends in whistleblowing within the organisation – eg thebusiness or geographical areas from which the most reports originate,or which have seen a spike or dip in recent reporting•

The number of incidents of alleged retaliation against whistleblowers
in the last 12 months, and how this has changed from year to year•

What the prevailing themes emerging from exit interviews were, andhow employee retention rates have changed as compared to prior
years

•

How (if at all) remuneration is linked to non-financial indicators suchas embodiment of the organisation’s culture and values

Assuming that the data flowing upwards to management is sufficient toallow meaningful consideration, the next question is whether any changes
can be demonstrated as a result of that information flow – eg
recommendations made and implemented, or investigations undertaken
into worrying patterns.

Board culture
sessions

Different boards may have different views on how they wish to tackle
culture but, whatever their approach, they should be able to articulate thesteps that they have taken. Part of this exercise is likely to involve a reviewof the types of data referred to above (not necessarily in painstaking
detail, but at least in terms of understanding and responding to thetrends analysis that has been undertaken).
Some boards like to have ‘culture’ as a standing agenda item, to focus themind on this topic and to create a paper trail of the actions being taken.
For others, this may feel like the wrong approach, particularly if their viewis that culture must permeate all of the decisions being taken rather thanbeing viewed as a topic in isolation. There is no right or wrong answer tothis, provided that the board has turned its collective mind to how it
intends to address culture and chosen its preferred approach.

20

Corporate Culture
Emerging trends and international best practice

Where next?
We would be delighted to talk to you in more detail about ourexperience, and practical steps that we have seen otherorganisations take to assess and strengthen their corporate
culture and to manage misconduct risk.

Emma Rachmaninov
Partner, London
T +44 20 7785 5386
E emma.Rachmaninov@freshfields.com

Ben Morgan
Partner, London
T +44 20 7716 4158
E ben.morgan@freshfields.com

Holly Insley
Senior Associate, London
T +44 20 7785 2237
E holly.insley@freshfields.com

21This material is provided by the international law firm Freshfields
Bruckhaus Deringer LLP (a limited liability partnership organised under
the law of England and Wales) (the UK LLP) and the offices andassociated entities of the UK LLP practising under the Freshfields
Bruckhaus Deringer name in a number of jurisdictions, and Freshfields
Bruckhaus Deringer US LLP, together referred to in the material as‘Freshfields’. For regulatory information please refer towww.freshfields.com/support/legalnotice.
The UK LLP has offices or associated entities in Austria, Bahrain, Belgium,
China, England, France, Germany, Hong Kong, Italy, Japan, theNetherlands, Russia, Singapore, Spain, the United Arab Emirates andVietnam.
Freshfields Bruckhaus Deringer US LLP has offices in New York City
and Washington DC.
This material is for general information only and is not intended toprovide legal advice.
© Freshfields Bruckhaus Deringer LLP, 2020

This material is provided by the international law firm Freshfields
Bruckhaus Deringer LLP (a limited liability partnership organised under
the law of England and Wales) (the UK LLP) and the offices andassociated entities of the UK LLP practising under the Freshfields
Bruckhaus Deringer name in a number of jurisdictions, and Freshfields
Bruckhaus Deringer US LLP, together referred to in the material as‘Freshfields’. For regulatory information please refer towww.freshfields.com/support/legalnotice.
The UK LLP has offices or associated entities in Austria, Bahrain, Belgium,
China, England, France, Germany, Hong Kong, Italy, Japan, theNetherlands, Russia, Singapore, Spain, the United Arab Emirates andVietnam.
Freshfields Bruckhaus Deringer US LLP has offices in New York City andWashington DC.
This material is for general information only and is not intended toprovide legal advice.
© Freshfields Bruckhaus Deringer LLP 2020 DS 68768