Maintaining an Effective Compliance Program When Working Remotely

Updates

June 10, 2020

Maintaining an Effective Compliance Program When Working Remotely

As countries around the world overcome the first wave of coronavirus infections, one thing is becoming apparent: Remote working will almost certainly become a permanent fixture of modern life for many. Going forward, governments and companies may periodically require or encourage employees to work from home. And even when they do not, both employees and employers are more comfortable with work-from-home arrangements than ever before.

Companies must adjust to this new reality by adjusting how compliance programs are managed, including how incidents are reported, investigated, and resolved. Above all, companies will need to maintain their culture of compliance by preserving open communication with their employees, and by messaging from the top that compliance remains a top priority.

But what sort of tangible and practical things can companies do now to make sure their compliance programs continue to operate well in a remote environment? Here, we offer some considerations for compliance professionals when thinking about how to execute an effective compliance program in this new remote environment, including concrete tips on how to manage investigations and interviews from home.

Practical Considerations

Compliance programs are at the most risk of becoming "paper tigers" when they are impractical and don't reflect on-the-ground realities of how a business operates. For many companies, that on-the-ground reality just radically changed. Without thoughtful consideration of how a compliance program operates in a remote working environment, gaps in the program may be created: Things that are impossible or difficult to accomplish remotely may fall by the wayside.

The best solution is to thoughtfully consider preemptively how a compliance program operates remotely. Here are some practical things companies can do to ensure their compliance programs remain effective when employees work from home.

Update Compliance Policies

The shift to remote working provides an opportunity to review compliance manuals and policies to ensure they work just as well when employees are working remotely. Compliance professionals may be surprised to find many manuals and policies assume employees are working down the hall, and not at home on the other side of town.

For example, policies often require a certification by employees that they have read and understand relevant compliance policies and attended trainings—accompanied by a signature that is kept in the employee's personnel file. Policies sometimes also require that receipts and invoices in support of expenses be submitted in person. Amend policies so that these sorts of things can be accomplished remotely.

Rethink How Employees Are Trained

Employees working from home may have competing demands on their time, crowding out opportunities, like lunchtime, to hold compliance trainings. And even when employees can join training sessions from their home, the potential for distraction is high (or, perhaps more accurately, even higher than before). Where possible, consider giving quick five-minute trainings which may be more manageable in a distraction-heavy environment.

This is an ideal time to reconsider how compliance updates are communicated. Consider what sort of trainings can be moved to newsletters or written updates. If something is truly best suited for a training, consider recording it and posting it on the company's intranet site so employees can engage it at the time that works best for them. Also think about moving the discussion that would happen at the end of in-person training online by having each attendee ask follow-up questions either via email or on an internal online forum.

Ensure Anonymous Reporting Systems Are Available

Remote working has the strong potential to tamp down informal reporting of potential compliance issues—the sort of issues that are discovered around the "water cooler," as opposed to through a formal report.

Now is also the time to make sure compliance reporting systems—particularly those systems that operate by phone or email—are up and running, and to remind employees that those systems are available even when they are working from home. While many employees now prefer the internet over telephones to report ethics concerns, data shows that a substantial segment of the population still logs cases by phone. If an employee calls and is not able to get through, they may feel discouraged and not end up reporting the issue at all.

Finally, as the "social distance" between employees—and, in particular, recent hires—becomes greater, maintaining social norms of "if you see something, say something," becomes more difficult, but not impossible. The clearest solution is to insist that the lines of communication between managers and subordinates remain open. Encourage managers to periodically check in with their subordinates more often than they would in person. Find creative ways to instill these norms in new employees, like requesting existing employees to help "mentor" new employees on how to conduct business ethically, or including compliance and ethics subjects in existing mentorship programs.

Remind Employees How to Handle Company Information

Working from home can create data security risks, inasmuch as having company information at employees' homes will increase the chances that information is accidentally disclosed. But consider the opposite—the ways in which working from home can make documents or information more difficult to collect by the company in the case of litigation or an investigation. Chances are, it will be more challenging to review materials located in an employee's home office or home computer.

In response to this challenge, make sure to have a documented policy that requires employees to use firm approved systems and applications to conduct business for the company. Chances are most businesses already have one—but just in case, consider these recommended measures, and make sure to issue reminders of the policy periodically.

Install and maintain authentication requirements to secure access to company information and systems.
Define minimum expectations for the use and protection of company information ("need to know" principle carries beyond the office).
Subject to the duration of the telework, consider automatic reminders when accessing company systems or networks that require consent before use. Include this in any overall compliance training designed to address minimum expectations for teleworking.
Consider defining a process for hard copy records (what's allowed, what's not, what must be submitted, what can be destroyed, etc.).
When issuing litigation or investigation holds, remind employees to also look in their home office and on any personal device on which they may have stored company documents.

Consider Increased Compliance Auditing

Given fewer social interactions, there may be fewer opportunities for an employee to "see something, say something." Consider adding some additional testing of controls and spot checking for compliance, particularly around areas that may have been made more vulnerable by remote work. Conducting compliance audits during this period of transition also has a salutary effect of reaffirming the company's commitment to compliance, whatever the circumstances.

Conducting Investigations Remotely

Conducting investigations in a remote environment presents its own set of challenges. Below are some suggestions for how to effectively investigate when employees are working remotely.

Deliberately Plan Investigations

Remote working—to say nothing of distractions caused by coronavirus itself—is likely to strain investigation resources. Plan accordingly by developing a detailed investigative work plan that not only addresses the specifics of the particular investigation, but that also accounts for the realities of remote working. The plan should discuss data collection approaches, privilege protections, and interviews, premised on the assumption that face-to-face contacts—whether in the United States or abroad—may be out of the question.

Above all else, the investigative work plan should be realistic in terms of its scope, timeline, and deliverables. Remote investigations may require more check-ins on the status of investigations to ensure they are progressing.

Plan Every Detail

When planning to do investigation interviews by video, no detail is too minute to consider on the front end to ensure the interview is effective. Below is a list of things to think about and plan for when getting ready for interviews:

Take steps to preserve confidentiality. Encourage the witness to attend the interview in a private area, and during the time of day when distractions are minimized. Open the interview by having the witness confirm no one can overhear you.
Ensure the interview is not unknowingly recorded. Witnesses may feel more comfortable recording the interview over video than they would be in person. Open the interview by confirming that the interview is not being recorded (audio or video) by either party.
Be prepared to share documents remotely. If there are documents to show to the witness, the best option is to show them to the witness through the video conferencing software. Only in special circumstances should documents be shared via email—and only if password protected.
Take steps to ensure security. Actively monitor the attendees on the call. If it is an especially sensitive call, consider requiring a passcode for any participant to even enter the call.
Be prepared for inevitable tech problems. Consider having back-up options available in case the video system stops working—for example, ask for the witness's cell phone number ahead of time. Be generous when scheduling the time for interviews—start 15 minutes before the hour to give yourself a 15-minute buffer and so you can join the system before the top-of-the-hour rush.

Keep It Simple and Slow During Interview

True, we are all getting used to it. But video conferencing still for most is an unnatural way to talk to someone. As a result, the sort of human connection that allows for the best interviews is harder to capture.

Take the following steps to help create that connection from afar:

Limit the number of attendees. Crowded video conferences, with many faces on the screen at once, are distracting and distancing—the witness feels like there's an audience. Keep the number of attendees to a minimum. And if several people must attend, limit the people who show up on video to yourself and the witness, so it feels like you are one-on-one.
Leave gaps in your conversation. Video conferences inevitably result in people talking over one another. And the stress of an investigation interview can make an innocent interruption be perceived as an intentional one. Avoid this by taking a beat before you speak and ask that the witness do the same. And when interruptions do occur, apologize.
Confirm understanding by "reading back." Conducting interviews via videoconference can lead to misunderstanding. Clarifying questions are often asked in person based on something fleeting and intangible that may be missed over video—a facial expression, pause, or shift in the seat. Ask clarifying questions liberally and repeat what the witness is saying back to them to confirm understanding. Start with "let me read that back to you to make sure I understand …" or "What you're telling me is …"
Be accommodating. Try to set a tone that while professional is not overbearing. If it seems the witness is becoming uncomfortable or tired, try and find a way to resolve that discomfort: maybe offer a break to allow the witness to compose him/herself, or suggest that the witness move to another room if their environment needs to change.

The Road Ahead

Seasoned compliance professionals are used to adapting. They have stayed the course as everything changes around them: when employees come and go, when the business takes on a new venture, and when new laws and regulations come to the fore. And with some deliberate planning and thoughtful execution, the coronavirus—and the changes that come with it—will eventually be added to the list of challenges overcome.

A version of this update was published in Bloomberg Law in June 2020 and adapted here with permission. Copyright 2020 The Bureau of National Affairs, Inc. 800.372.1033. For further use, please visit http://www.bna.com/copyright-permission-request/.