Evolution of Compliance Management

Evolution of Compliance Management

The Boston Consulting Group (BCG) is a global management consulting firm and the world s leading advisor on business strategy. We partner with clients from the private, public, and not-forprofit sectors in all regions to identify their highest-value opportunities, address their most critical challenges, and transform their enterprises. Our customized approach combines deep in sight into the dynamics of companies and markets with close collaboration at all levels of the client organization. This ensures that our clients achieve sustainable compet itive advantage, build more capable organizations, and secure lasting results. Founded in 1963, BCG is a private company with 75 offices in 42 countries. For more information, please visit bcg.com.

Evolution of Compliance Management Ivan Bascle, Olaf Rehse, Andreas Dinger, Clemens Frey, Philipp Loosen, and Martin Walter March 2012

AT A GLANCE Corporate compliance is evolving from a specialist's domain to a top management topic which concerns the core of the company. An increasing trend towards governmental regulation, the quest for transparency by new media and public stakeholders, and the proliferation of social networks mark the next step in the evolution of compliance management. In the past as well as today, major cases from Enron to Olympus serve as drivers and catalysts for further development. Corporate executives will face major challenges in developing an integrated and efficient compliance framework along their entire value chain, across borders and global businessnetworks. Contemporary compliance management needs to establish a strong link into business in order to increase efficiency and impact. 2 Evolution of Compliance Management

Green and white economy: An analogy The role and relevance of compliance management is changing: from a pure corporate necessity to a core element of corporate strategy and organization. closer look reveals that the evolution of compliance shows striking A similarities to the so-called "green revolution" or "green economy." Today, it is widely acknowledged that green business has evolved from an externally imposed inconvenience to good business in economic terms: Across industries, the markets for eco-friendly and sustainable businesses are booming, and the integration of a green perspective into corporate strategy has become a basic requirement for sustainable competitive advantage. Today's perspective differs widely from the view of decades ago, when companies (and governments) regarded environmental issues as marginal ideas from a minority of green freaks, a cost factor and potential burden for business strategies. Most companies chose a defensive "wait-and-see" attitude as a growing social consciousness translated into tighter regulatory standards. Recent research by The Boston Consulting Group shows that the companies who were among the first to realize the scope of the change and actively develop environmental standards and a framework to cover environmental issues along their value chain have gained considerable competitive advantage within their industries. Today, compliance is currently at exactly at this point: It is evolving from a pure cost factor into a quality indicator of well-managed, transparent companies and provides a long-term basis for competitive advantage in a market environment and society that have undergone deep changes. White business can even be part of a marketing strategy (e.g., fair trade). To illustrate our understanding, we have developed a four-phase model comparing the two trends (see Exhibit 1). Compliance is evolving from a cost factor into a quality indicator Another striking similarity between the two trends is that they developed in waves, with large scandals initiating major changes. In the green economy, we think about the Exxon Valdez in Alaska or the Ixtoc I oil spill in the Gulf of Mexico, as well as the Seveso disaster or the Sandoz Rhine pollution in Europe. Increased public awareness following such scandals resulted in tighter regulations (for example, the EU industrial safety regulations are known as the Seveso II Directive). Similarly, today everybody knows about the major compliance cases like Enron, WorldCom, Siemens, or Olympus more recently. The Boston Consulting Group 3

Exhibit 1 The white economy began its rise earlier, but developed slower 1970s 1980s 1990s and 2000s 2010s Green economy Less relevant First steps Growth Developed Green economy only a marginal topic Increased awareness towards green economy Green economy started to become commonly accepted Green economy fully developed White economy Less relevant First steps Growth Developed Corporate compliance issues not in discussion Beginning of regulation following major scandals Corporate compliance developing into a serious topic Compliance fully integrated into business Source: BCG analysis Clean business needs an integrated approach to compliance The green and white economies also share the symptom of considerable differences between well-developed and less developed countries. The awareness of green and white business in particular seems to cohere strongly with the development level. As a result, today, corruption is a larger problem in less-developed countries (see Exhibit 2). The chart shows at a glance that economic prosperity and the development of compliance management are strongly related. Even if the global fight against corruption is a long road ahead, there is no turning back: From a macroeconomic perspective, there is no doubt that fair competition can be seen as a cornerstone of any functioning market and a key prerequisite for prosperous economic development. The underlying rationale is that sustainable and secure profits can only be generated from clean business as a precondition for the "license to operate." Economic success should be supported neither by corrupt and illegal behavior nor by economic disasters. Avoiding corruption and other economic crime and misbehavior is a global task not only in developed countries, but especially in underdeveloped countries. Although compliance has always been part of the business and management agenda, the role and impact of compliance management today is reaching new levels. The concept of compliance, commonly defined as adherence to external laws and regulations, can be traced back to the turn of the 20th century, when public safety agencies began to emerge. For decades, the predominant model of compli- 4 Evolution of Compliance Management

Exhibit 2 Less corruption indeveloped countries Corruption Perceptions Index (logarithmic) 10 High tendency to compliant business Germany France Austria Japan R 2 = 0.6342 India China Turkey United States Spain Italy Ethiopia Brazil Mexico Argentina Congo, Dem. Rep. Egypt Russia Pakistan 1 10 Low tendency to compliant business 100 Sudan 1,000 10,000 Population: 100M 100,000 GDP ($, logarithmic) Note: Inflation-adjusted GDP in US$, Transparency International Corruption Perceptions Index (higher CPI score means lower corruption perception). Data from 2008 Source: Gapminder; Transparency International ance was centered around public safety. In the 1970s, however, events such as the Watergate scandal and foreign corruption investigations widened the scope of compliance. After an investigation by the U.S. Securities and Exchange Commission (SEC) revealed that several hundred U.S. companies engaged in bribing foreign officials to obtain foreign government contracts, companies were instructed by the government to develop internal resources to actively monitor compliance with the laws and rules of their industry. These rules, set forth in detail in the U.S. Foreign Corrupt Practices Act (FCPA), can be regarded as one of the origins of compliance management regulation. Until the mid-1990s, most compliance management systems were formal rather than truly effective, generally handled with low priority, located in legal departments, and regarded as a pure cost factor and (potential) burden in global competition. Following the emergence of scandals such as those involving Enron and Siemens, the trend towards cleaner business conduct gained momentum. Further milestones in the evolution of compliance include the U.S. Sarbanes-Oxley Act (SOX) of 2002, or the recent UK Bribery Act of 2010. According to new laws and standards set by courts, it is not only the organization which may face monetary sanctions in cases of non-compliance the leadership team, too, can be held personally liable. The Boston Consulting Group 5

Public stakeholders and new media increase the pressure No way back: Compliance at a turning point Several major trends indicate that compliance management will rise to one of the crucial success factors of long-term profitability and sustainable growth strategies. First, there is hardly a chance for illegal, illegitimate, or ethically questionable behavior to be concealed from detection. The means and new instruments of communication technologies and platforms have put an end to the idea of being in the driver's seat and being able to control information flows top-down. Customers discuss frankly whether a new product is good or bad, and in almost all industries, non-profit and non-governmental organizations closely observe whatever a company does or does not do. We are witnessing a considerable increase in public awareness, fostered mainly by the proliferation of new social media. The communication between the corporation and its various stakeholders has become multi-directional and rapid. Whistle-blowing has become much more simple and effective. Exhibit 3 illustrates the importance of blogs and social media during external compliance investigations in emerging markets as an example. Exhibit 3 Compliance research today: 30% of findings from social media sources Online forum, other social media (excl. blogs) 15% Blog Law database 10% 4% 11% Other privately maintained Web site 32% Government/ public authority Web site 29% Professional news Web site Note: Data taken from systematic BCG compliance research in emerging markets Source: BCG analysis 6 Evolution of Compliance Management

Furthermore, the increased competition across old and new media drives the need for good "bad news" and the willingness to investigate and publicize any questionable corporate action or management behavior. The number of scandals which became public in recent years has increased and will continue to increase. Another trend can be coined the "return of the politician" and has dramatically accelerated in the aftermath of the financial crisis of 2008 when governments in almost all Western countries spent billions to prevent a great recession and stabilize their economies. The fundamental shift of power between political and business leaders will shape the years to come. Companies have to rethink and reconcile the different perspectives and conflicting interests of their stakeholders. This includes the definition of best practices in compliance, which in most cases comprises definitions of key elements of compliance management systems and guidelines for fighting corruption set forth in companies' self-imposed standards. In addition to stricter public regulation, non-governmental organizations like the UN and the World Bank have gained public support and political power to set standards for corporate behavior that are not compulsory. Private regulation is also driven by institutes such as the World Economic Forum or common auditor standards (e.g., IDW EPS 980 in Germany). Directly linked to tighter regulation, increased liability also raises the stakes for managers as individuals: They can now be held personally liable for their decisions and have to handle any legal risks and corporate responsibilities pertaining to their current role. Recent cases show that courts of law are willing and able to enforce the individual liability and act accordingly. Compliance management today and tomorrow has to answer a variety of difficult questions concerning the extent of personal and corporate responsibility. Recent scandals, the financial crisis, and media presence of very few, but highly visible cases of individual misbehavior of business leaders have enforced and intensified public awareness of corporate compliance issues. Polls and studies show a disquieting degree of distrust towards (and even disdain of) business leaders as a group, which fuels public awareness of corporate actions and creates an environment where whistle-blowing is encouraged and appreciated as civil courage. These mutually reinforcing trends mark a turning point. There will be no way back: The times when transparency was optional, communication lay in the control of the company, and compliance was a specialist's domain, locked into the legal department, are gone. Fortunately, most companies have taken the new challenge of compliance management seriously, and many have already started to actively develop their compliance management systems. The Boston Consulting Group 7

However, BCG research shows that there is still a wide gap to close: Only half of the companies in our study have already taken the step from reactive to active compliance management with the implementation of group-wide rules and processes to integrate compliance into day-to-day business and corporate strategy (see Exhibit 4). For the majority of companies, there is still room for improvement and room to turn the necessity of compliance management into an opportunity to pull ahead of competition and thus gain sustainable competitive advantage. Exhibit 4 Compliance maturity model shows room for improvement Description 1 Basic compliance system Code of conduct available Compliance function in place Basic processes defined 2 Group-wide rules and processes in place Staff well informed about rules Group-wide compliance organization in place Engagement of senior management 3 Compliance as part of daily life and corporate strategy Staff well trained to apply code of conduct Compliance rules also apply to suppliers and partners Staff proactively reports possible violations Alignment of compliance and strategy to create value 4 Compliance as an integrated part of business Compliance optimized to be both, as an efficient and effective Business-integrated approach to compliance Clear decision making Lean compliance Room for improvement ~ 50% of benchmarked companies are clustered in buckets one and two Source: BCG benchmarking study; press searches; company Web sites; analyst reports 8 Evolution of Compliance Management

Integrated compliance management: Responding to inefficiencies As a basic model for an integrated and advanced approach to compliance management, The Boston Consulting Group has developed a framework which can be applied to check the current level of corporate compliance management and close any existing gaps. The framework spans different levels and covers four areas which should be addressed by advanced compliance management: corporate strategy, prevention and reaction, and compliance infrastructure (see Exhibit 5). In most companies, the individual elements are well known. The primary challenge will be to combine and align the pieces into a well-balanced, effective, and efficient overarching framework to eliminate conflicts between compliance requirements, corporate goals, and policies on a sustainable basis. Advanced compliance management needs a shift in perspective, from an external, purely legal matter to an internal, business-based point of view to create competitive advantage. Succeeding in a new era of tighter regulation, higher visibility, and public surveillance will not simply require "more" compliance in quantitative terms, e.g., more internal regulation or more detailed rules and instructions for behaviors, actions, and decisions. Instead, advanced compliance management will require a leap in quality and it aims to achieve more with less by integrating compliance management deeply into the company's business processes, value chain, and culture. Exhibit 5 BCG compliance framework: a basic concept Strategy Culture and attitude Communication/management reporting Compliance goals Continuous improvement/audit Prevention Reaction Risk assessment/planning Business conduct Business process Reporting channels Detection audit Case handling Remediation Infrastructure Compliance organization Compliance HR Compliance IT Source: BCG analysis The Boston Consulting Group 9

Aligning compliance management with corporate strategy Compliance functions in corporate organizations should no longer constitute small branches of legal departments, but rather board functions with a huge direct impact on many parts of the organization. Defining and implementing subsequent changes are key tasks which can only be accomplished if compliance management becomes a major focus of attention. However, even within a developed compliance management system, compliance cases will occur. Therefore, the right reaction to emerging compliance cases must also be defined. The basis for all this is to establish the right infrastructure, i.e., to design an appropriate compliance organization and specific processes, consider all HR aspects of compliance, and set up IT systems covering all relevant compliance management tasks. Four key elements mark the difference between good compliance management and best practice: business integration, customization, efficiency, and extension to external partners: A large European industrial goods conglomerate worked hard to overcome a large bribery scandal and is now perceived as market-leading in compliance. Significant efforts were made by implementing a transparent compliance management system to create a culture of integrity. Financial controls were improved, the global compliance organization and processes expanded, compliance tools and processes simplified, and compliance integrated into the employee incentive system as an explicit component. In addition, compliance organizations received many additional competencies and a strong link to the top management to ensure that it would be powerful enough to exert a dominating influence on corporate strategy and business. Finally, the company set out to integrate compliance vertically and horizontally in order to establish a lean compliance management system. 1. Business integration: Most companies, especially those who have had to cope with a major compliance issue, have increased the headcount of their compliance offices or department or created a specialized unit and function, strictly separated from day-to-day business activities. An advanced approach to compliance management must accept the challenge and truly integrate compliance into the organization across business functions and levels, from top management to front-end employees. Future compliance strategies and frameworks should be designed to enhance close cooperation between corporate functions such as risk management, legal departments, communication (internal and external), and corporate audit. Getting everyone involved is more than a matter of culture it is a major lever to enhance efficiency by cutting out complex procedures and redundancies, thus integrating compliance into the business reality and culture to make a real impact. 2. Customization: Each industry and each company holds a specific risk profile. Companies cannot rely on a single standard or one-size-fits-all approach to compliance they need a highly customized approach aligned with their individual risk profile and value chain. This requires an analysis of individual business processes and their specific exposure to compliance risks. Case studies show that there can be huge differences with respect to different markets and locations, product offerings, services, and corporate cultures within the same industry as well as between corporate strategies. Companies need a clear view of these differences to align their compliance management, identify their specific key issues, and define their individual compliance management priorities, strategy, and investments accordingly. Any effort to improve compliance management must be inherent to the specific business model. The definition and 10 Evolution of Compliance Management

quality of compliance standards is strongly linked to corporate strategy. Accordingly, compliance management can also be part of the marketing strategy (e.g., fair trade). If companies succeed in adapting compliance standards to their specific needs, compliance management can evolve from a cost factor into a basic tool to manage risk, maintain the company's reputation, and make profits and growth strategies sustainable. 3. Efficiency and effectiveness: To transform compliance from a cost factor into a competitive advantage implies a clear sense of efficiency and effectiveness. Efforts to establish and enhance compliance management should be based on key performance indicators and accompanied by a monitoring process. Advanced compliance management cannot be achieved by pouring money into the compliance department or by simply adding compliance topics to the corporate training catalog. At the new level of compliance management, less will be more in terms of competitive advantage: In reaction to recently increased regulatory requirements, many companies have expanded their internal rules and regulations and provide extensive and detailed catalogs for their employees, business partners, and processes. Analogous to the origin of "lean management," lean compliance primarily requires the ability to take a fresh look at the compliance management legacies in order to eliminate unnecessary rules, steps, processes, and services that do not add value and instead often increase complexity, slow down decision-making times, and reduce willingness to comply and the applicability of rules in employees' daily business activities. Efficient and effective compliance management starts with a clear focus on the individual businesses, from which customized rules and compliance processes can be derived. As in other business functions, regular reviews, benchmarking, and performance evaluation should be established as an integral part of compliance management. A continuous improvement process based on quantitative and qualitative measures for compliance effectiveness is indispensable in order to create a self-learning system a culture of compliance which balances internal regulation with enough leeway in terms of action, speed, and costs. 4. Extension to business partners: As company boundaries have become more fluid, and integrated value chains have been replaced with global networks and supply chains, the gap between internal control and external views of liability and responsibility has grown and extended the scope of compliance management. Advanced compliance management must master the challenge of balancing the independence of business partners, e.g., in distant locations or different cultures, and the need to guarantee certain standards. Creating a culture of compliance across borders Another example highlights the challenges for many international companies which are about to expand to unknown emerging markets with their very specific way of conducting business. A large automotive company started a production joint venture in an emerging market with a local partner. It turned out that the joint venture was to cooperate with more than 2,000 business partners who were largely unknown to the parent company. Before the joint venture could even be established, all business partners had to be checked. In order to complete this task, the parent company chose to follow a risk-adjusted approach. The Boston Consulting Group 11

Getting business partners on track and preventing reputation risks stemming from misbehavior of key suppliers or sales partners has evolved as a key challenge with the growing access to information and communication media. A perfect showcase is a large consumer goods company which experienced serious compliance problems among its suppliers. Instead of considering the business partner issues as burdens, they turned the tables: While customers focused more and more on the way goods were being produced, it was not sufficient to merely comply with relevant local laws. Own superior standards much stricter than official laws were developed and explicitly communicated to the market. It was shown for the first time that compliance does not end at the gates of your own company. The key lesson is that it is indispensable to apply an external view on business partners and actively manage them. G ood compliance management today has developed into an indicator representing good management practices in general. Thinking about how to adapt one's business model to comply with today's laws and regulations will not suffice. It is a key challenge for corporations to develop from good to great, i.e., to develop leading compliance standards into the future. Hence, now more than ever, it is necessary to go beyond formal standards supporting so-called "paper compliance" and step into each and every business process to ensure that the business is truly compliant and compliance management is as efficient as possible. 12 Evolution of Compliance Management

Compliance and corporate management: A checklist Do you rely on the right success factors in your compliance management? 1 Business integration How far are your compliance tasks embedded in your corporate culture, leadership principles and business activities? In which way do you include compliance considerations in strategy and business decisions? 2 Organizational setup Do you regulary revise your compliance organization in order to keep it up to date? How does your compliance organization interact with corporate functions like risk, internal audit, and legal? 3 Process orientation How do you ensure that individual processes are adapted to compliance needs? For which compliance tasks does your IT support deliver automated solutions? 4 Performance management Which tools do you use to measure the effectiveness of your compliance management? How do you define areas of improvement and who sets targets for your compliance department? 5 HR compliance concept Have you defined an overarching compliance HR concept? How closely is your HR incentive system linked to compliance? 6 Riskadjustment Where are your company-specific compliance risks located, and how do you mitigate these risks? How do you manage external risks, e.g., business partners, supply chain, and sales force? 7 Organizational learning and communication How do you get your facts and to what extent is your compliance analysis data-driven? Which channels do you use for effective compliance communication to employees and internal learning? The Boston Consulting Group 13

About the Authors Ivan Bascle is a Partner and Managing Director in the Munich office of The Boston Consulting Group. You may contact him by e-mail at bascle.ivan@bcg.com. Olaf Rehse is a Partner and Managing Director in the firm's Düsseldorf office. You may contact him by e-mail at rehse.olaf@bcg.com. Andreas Dinger is a Partner and Managing Director in the firm's Munich office. You may contact him by e-mail at dinger.andreas@bcg.com. Clemens Frey is a Principal in BCG's Munich office. You may contact him by e-mail at frey.clemens@bcg.com. Philipp Loosen is a Consultant in BCG's Hamburg office. You may contact him by e-mail at loosen.philipp@bcg.com. Martin Walter is Group Compliance Officer of Telekom Austria (since November 2011). You may contact him by e-mail at martin.walter@telekomaustria.com. Acknowledgments First and foremost, the authors would like to thank Karin Beiküfner for her input. The authors are also grateful to Rolf Giebeler, Hubertus von Funck, Christoph Schlüter, Melikshah Ünver, Johannes Brehmer, Uwe Vogt, Sonja Viessmann, and Andrej Levin. Finally, the authors would like to thank Mokihana Arnest Hehn, Gerd Meyer, Ellen Treml, and team for their contributions to its editing, design, and production. For Further Contact If you would like to discuss this report, please contact one of the authors. BCG provides no legal advice. 14 Evolution of Compliance Management

To find the latest BCG content and register to receive e-alerts on this topic or others, please visit bcgperspectives.com. Follow bcg.perspectives on Facebook and Twitter. The Boston Consulting Group, Inc. 2012. All rights reserved. 03/2012

Abu Dhabi Amsterdam Athens Atlanta Auckland Bangkok Barcelona Beijing Berlin Boston Brussels Budapest Buenos Aires Canberra Casablanca Chennai Chicago Cologne Copenhagen Dallas Detroit Dubai Düsseldorf Frankfurt Geneva Hamburg Helsinki Hong Kong Houston Istanbul Jakarta Johannesburg Kiev Kuala Lumpur Lisbon London Los Angeles Madrid Melbourne Mexico City Miami Milan Minneapolis Monterrey Moscow Mumbai Munich Nagoya New Delhi New Jersey New York Oslo Paris Perth Philadelphia Prague Rio de Janeiro Rome San Francisco Santiago São Paulo Seoul Shanghai Singapore Stockholm Stuttgart Sydney Taipei Tel Aviv Tokyo Toronto Vienna Warsaw Washington Zurich bcg.com