The Trouble With Corporate Compliance Programs

Multinational corporations spend millions of dollars per year on compliance. In highly regulated industries such as health care and finance, large companies spend much more, sometimes hiring hundreds or even thousands of compliance officers at a time.1 Siemens AG reportedly spent more than $1 billion on an internal investigation related to a government inquiry into the company’s payment of foreign bribes.2 But the costs are not just financial. Compliance programs are aimed at eliminating the time-consuming and distracting regulatory and legal processes that accompany ethical failures.

There is a belief on the part of corporate leaders that when rigorous compliance programs are in place, employee wrongdoing will largely disappear. If something does go wrong, the hope is that having a comprehensive program will help convince regulators that the company’s compliance and ethics initiatives were “effective” (the standard set by U.S sentencing guidelines).3

Companies strive to make their programs as “bulletproof” as possible. Unfortunately, even the most comprehensive programs won’t curtail corporate wrongdoing or the government intervention that follows. For instance, Volkswagen AG’s compliance program didn’t stop employees from installing “defeat device” software to cheat emissions tests, nor did Wells Fargo & Co.’s policies prevent its employees from opening new customer accounts without customers’ authorization. More than 15 years after the Enron scandal, most companies know very little about how employees make ethical decisions or the psychological mechanisms that cause them to perform unethical and illegal acts. Even fewer companies have compliance strategies aimed at curbing such behaviors.

The goal of this article is to pull together the burgeoning field of behavioral ethics, which provides insight into how individuals make ethical decisions, with the work of criminologists who study individual and corporate criminality. My aim is to help business leaders see why their corporate compliance efforts are falling short and how those efforts can be improved. In addition, I will offer some practical and cost-effective steps for improving compliance programs that focus on employee behavior — the best way to make compliance truly effective.

Dual Systems of Thinking

Corporate compliance depends on the behavior of individual employees. If employees, officers, and managers always acted in a law-abiding and ethical manner, compliance failures would rarely occur. Of course, that is not realistic. That is why companies need to be aware of how and why employees act the way they do. This starts with understanding how people make decisions generally and how that translates into ethical decision-making.

Contrary to traditional economic theory, people don’t make strictly rational decisions. Instead, as the work of psychologists Daniel Kahneman and Amos Tversky revealed, most decisions are influenced by dual cognitive processes: intuitive and reasoning.4 The intuitive process (which Kahneman and Tversky refer to as System 1) is “fast, automatic, effortless, associative, and often emotionally charged.”5 It operates by associative memory and habit, which makes it difficult to control or modify. A lot happens at once through System 1 — the mind offers associations rapidly, one idea after another, all linked effortlessly. The speed and ease by which System 1 operates means that “most of the work of associative thinking is silent, hidden from our conscious selves.”6

The reasoning process (referred to as System 2) is more serial and deliberate. It is engaged when we use thought in an organized manner. We use it to solve complex math problems, write a paragraph, or contemplate multifaceted decisions when there aren’t easy associations to make. System 2 thinking gives us the “experience of agency, autonomy, and volition.”7 Not surprisingly, the reasoning process requires much more mental effort than using intuition. Reasoning isn’t necessarily better than intuitive thinking — you wouldn’t want to reason your way through every one of your day-to-day tasks — but for the most important decisions, it’s critical. Yet, because System 2 thinking takes more effort, our minds have developed to rely primarily on System 1, reserving System 2 either for the most challenging mental tasks or to correct errors in our automatic thinking. This may seem fine, but research shows that people often use System 2 to justify their System 1 conclusions.8 Instead of correcting errors, sometimes our reasoning process reinforces our often flawed intuitions.

Although Kahneman and Tversky did not study ethical decision-making directly, their findings are critical to understanding how people make decisions in an ethical context. Behavioral ethics researchers have taken the insights of dual system thinking and applied them to ethical decision-making in business. They have found that while most people intend to act ethically, good people often do bad things.9 Indeed, research has found that self-interest is associated with intuitive thinking.10 Despite this, most of us act ethically most of the time. That is because System 2 is properly functioning as an ethical monitor, jumping in to control the automatic self-interest each of us possesses.11

Rationalizing Unethical Behavior

If System 2 is an ethical monitor, why does it seem to fail so often? For example, what enabled VW employees to install the code used to defeat emissions tests? Although behavioral ethics research helps us understand how the brain works, it doesn’t explain what allows the brain to take that critical step toward unethical behavior.

This is where criminology, the study of crime and criminals, comes in. Criminologists researching white-collar crime have theorized that three conditions are necessary for a corporate crime to occur.12 First, an individual must possess a problem he or she feels cannot be solved by revealing it to others. A “non-shareable problem” might be anything from gambling debts to the prospect of job loss — anything that the person is deeply concerned about. Second, the individual must believe that the problem can be solved in secret by violating a trust. As corporate leaders know, trust is an essential element in any organization — almost every principal-agent relationship is built upon it. Third, the individual must have an internal dialogue about the problem and the unethical — even illegal — solution that makes the trust violation seem acceptable.13 The classic example is the banker who tells himself he is only “borrowing” the embezzled funds and will pay them back later.

The last step, which criminologists call “verbalizations” (and the rest of us usually refer to as rationalizations or even excuses), is the crux of white-collar crime. Criminologists don’t view verbalizations as simple, after-the-fact excuses that offenders use to relieve their culpability upon being caught. Instead, they see them as “vocabularies of motive” — words and phrases offenders use to make bad behavior seem appropriate.14 This means that an offender’s rationalizations are created before acting and actually allow the bad act to proceed. As the criminologist who developed rationalization theory puts it, “[t]he rationalization is [the offender’s] motivation.”15 Rationalizations, which have been identified in numerous studies, permit white-collar offenders to act in ways that they would otherwise deem unacceptable.

This is consistent with what we know about how people make unethical decisions. Behavioral ethics research does not suggest that everyone wants to act ethically but fails to do so because of cognitive obstacles. Rather, people default toward acting unethically because they are driven by self-interest, and then they find ways to convince themselves — consciously and subconsciously — that they are acting ethically.16 This appears to be a case of System 2 justifying System 1 conclusions. It’s likely this process is a product of our unique evolution. Although the ability to cooperate with one another is one of humankind’s greatest advantages, the best course of action from an individual perspective is often to act in one’s self-interest.17 Thus we have developed mechanisms to deal with the countervailing aspects of living in our “hypersocial” yet competitive world.18 One of the mechanisms is to rationalize our behavior — to reframe how we look at it in order to align our self-perception as a “good person” with the unethical or illegal behavior we are contemplating. There is no better way to act self-interestedly while simultaneously projecting to others (and ourselves) that we are good members of a cooperative society.

I believe that rationalization theory, which has greatly influenced the study of both white-collar crime and business ethics, explains what happens when an individual’s ethical monitor is overcome.19 Essentially, rationalizations trick the System 2 reflective thinking process that normally intervenes to contain our unethicality. Once this happens, there is nothing to stop a person from committing an unethical or illegal act, regardless of the organizational norms, business regulations, or criminal laws in place.

What are the most typical rationalizations? And more importantly, how do we identify them? My research suggests there are eight rationalizations most commonly used by those committing unethical and illegal acts within companies.20 (See “About the Research.”) As part of an effective compliance program, corporate leaders need to understand these rationalizations and be able to identify their usage.

Denying Responsibility

Offenders use this rationalization to relieve themselves of responsibility, thereby mitigating social disapproval and a personal sense of failure. White-collar offenders deny responsibility by pleading ignorance, suggesting they were acting under orders, or contending that larger economic conditions caused them to act illegally. This may be considered the catchall rationalization leading to wrongful conduct.

Denying Injury

This rationalization focuses on the injury or harm caused by the illegal or unethical act. If an act’s wrongfulness is a function of the harm it causes, an offender often excuses his or her behavior if no clear harm exists. Offenders employ this rationalization when the victim is insured or the harm is to the public or market as a whole, such as in insider trading or antitrust cases.

Denying the Victim

Denying the victim takes two forms: when the offender argues that the victim’s actions were inappropriate and therefore the victim deserved the harm; or when the victim is unknown or not clearly defined. White-collar offenders often use this rationalization when committing frauds against the government, such as in false claims or tax evasion cases.

Condemning the Condemners

This rationalization shifts attention away from the offender’s conduct to the motives of others, such as regulators, prosecutors, and government agencies. It can take various forms: The offender calls his or her critics hypocrites, argues that they are compelled by personal spite, asserts they are motivated by political gain, or complains about selective enforcement.

Appealing to Higher Loyalties

Individuals use this rationalization when they are willing to sacrifice societal norms to advance the interests of a group to which they belong. The actions are needed, the offender argues, to protect a boss or employee, shore up a failing business, or maximize shareholder value. For example, if an employee argues that he or she committed a fraud not for personal gain but to help the company, he is or she is likely using this rationalization.

Using a Ledger Metaphor

This rationalization is based on a “behavioral balance sheet” whereby people balance their negative actions against their positive accomplishments, thus minimizing their sense of moral guilt. Senior executives, particularly those active in philanthropy, are especially prone to this type of rationalization.

Claiming Entitlement

People involved in employee theft and embezzlement cases frequently use this rationalization in the belief that they deserve the fruits of their illegal behavior. This rationalization is also common in public corruption cases.

Claiming Relative Acceptability or Normality

This rationalization compares the offender’s bad acts with those of others to relieve moral guilt. Tax violators and those involved in real estate, accounting, and trading fraud often rationalize their actions by citing the behavior of others. It may be particularly prevalent when a negative organizational culture is strong and insulated.

How Rationalizations Undermine Compliance Programs

There are plenty of practical examples illustrating how employees rationalize behavior that leads to compliance issues. The experiences of Intel Corp. and Wells Fargo are instructive.

In the early 2000s, Intel adopted an aggressive approach to compliance in order to curb potential antitrust violations by its sales executives.21 It devised a program in which the company’s compliance professionals periodically conducted random audits in which they searched through papers, emails, and other electronic records of managers, seizing anything that might be sought as part of a government investigation. If the company found irregularities, it sometimes even held mock depositions of the offending executives, using outside antitrust lawyers. Intel’s general counsel explained that these role-playing exercises served as a wake-up call, giving lax executives the experience of being in the government’s crosshairs. He boasted that Intel’s aggressive approach to compliance was “the world’s best.”22

Yet Intel was unable to avoid government intervention in its business. Intel spent years in private antitrust litigation, and in 2009 the New York attorney general sued the company, arguing its compliance program not only was ineffective but had helped contribute to illegal anticompetitive behavior by appearing to have communicated to employees that the goal of the compliance initiatives was to limit mention of illegal behavior, rather than to eliminate the behavior.23 Based on my analysis of employee emails revealed as part of the lawsuit, the company’s approach may have facilitated a host of rationalizations, including two mentioned above: denial of injury and denial of the victim. In addition, employees more easily denied their responsibility, the catchall rationalization, because anticompetitive practices were seen as part of doing business at Intel.

Wells Fargo’s recent difficulties appear to offer another example of rationalized corporate wrongdoing. The company’s fake-account scandal demonstrates how executives can affect the context in which employees make decisions regarding ethics. Details of how exactly the bank’s ethics and compliance program operated are still emerging, but preliminary reports suggest it allowed an environment riddled by employee rationalizations. On the heels of the bank’s $185 million settlement agreement with the Consumer Financial Protection Bureau, a number of former employees have reported that despite ethics training and messages from headquarters to not create fake accounts, the bank’s aggressive sales culture drowned out any explicit compliance measures. Essentially, the compliance program failed to address the systemic problem of managers pressuring employees to meet unrealistic sales goals.24 “The reality was that people had to meet their [sales] goals,” one former employee explained. “They needed a paycheck.”25 This suggests that employees, under pressure to meet unrealistic goals, rationalized their conduct by denying responsibility and claiming relative normality.

Combating Rationalizations

Behavioral science, coupled with criminological insights, indicates there are complex, interwoven, and deeply seated psychological processes at work that can undermine even the best compliance program. So what are companies to do? Is there a way to do compliance better — one that solves some of the problems created by the automaticity of self-interest we all possess? Yes, but it requires a fundamental shift in corporate thinking.

The best approaches to compliance focus not on how government regulators will react to a compliance initiative but on how employees — the real “customers” of compliance — will be affected. They consider the behavioral implications of the compliance program at every turn, particularly how company policies might foster or defeat employee rationalizations. While no program will entirely change our cognitive processes or stop all unethical behavior, there are three cost-effective steps companies can take.

Hire a behavioral specialist. Although dual-system thinking, rationalization, and behavioral ethics theories have been around for decades, their application to business and compliance is still in its infancy. Hiring a behavioral specialist or developing someone internally to stay abreast of the various fields and their increasing insights into ethical decision-making is a good first step.

One of the tasks a behavioral specialist can take on is to educate the organization, particularly the compliance team and HR staff, on key takeaways from current research in the fields of behavioral ethics, behavioral economics, moral psychology, and criminology.26 Books on decision-making and dishonesty by serious researchers, yet aimed at more general readers, can be a helpful resource.27 A company’s behavioral specialist should create a behavioral compliance curriculum tailored to various groups of employees, giving all members of the organization insight into their ethical decision-making processes. Such a curriculum can become the backbone of a behaviorally cognizant compliance program.

Use behavioral best practices to eliminate rationalizations. To create compliance programs that take advantage of behavioral insights instead of falling prey to them, companies must start to adopt compliance practices driven by the behavioral science at the heart of criminology and behavioral ethics. This will necessarily go beyond the traditional law-driven compliance practices employed by the vast majority of Fortune 500 companies.

If rationalizations are the crux of employee wrongdoing, then compliance programs should be aimed at eliminating them. One possibility is to ask employees to sign a certification before they engage in behavior that creates compliance risk. A group of researchers working with an insurance company asked customers to report how many miles they had driven that year, according to the odometer.28 Reporting lower miles meant lower premiums. But instead of simply asking for the number of miles, researchers included a certification of honesty at the top of the form. Customers who certified at the top of the form, before providing their mileage number, reported almost 2,500 more miles than those who signed the same certification at the bottom of the form, despite there being no difference in driving habits.29 The certification was effective in reducing dishonesty because it engaged morality at the moment of the decision to act ethically or unethically, just before there was an opportunity to rationalize. By triggering people’s System 2 ethical monitor at the correct time, the potential for rationalization was greatly reduced. Researchers found the same type of results with tax deduction forms styled like those of the U.S. Internal Revenue Service.30

A similar approach can be used by companies for any expense report, conflict of interest form, or funds authorization — anything in which an employee is being asked to engage in behavior that creates compliance risk. It’s up to companies to decide how high-tech they want to get. JPMorgan Chase & Co. has been developing software that monitors the actions of its traders, including emails and telephone conversations, to ensure they “adhere to ‘personal trading rules’ and risk limits,” and Credit Suisse Group AG is also working on technology to monitor traders’ behavior.31 JPMorgan’s effort is noteworthy in that the software’s algorithms can generate alerts if it appears that traders may be headed toward an ethical or legal violation. Such “predictive monitoring,” like a certification at the top of a paper form, could be used by companies to intervene with a prompt before a problematic behavior occurs, forcing the employee’s System 2 reasoning system to engage — and thus improving compliance.

Companies should also encourage employees to openly discuss rationalizations and how they affect ethical decision-making. This can be accomplished through storytelling by employees and the company. Employees should be encouraged, even required, to meet periodically in small groups to explore the potential effects of compliance violations and white-collar crimes. The idea is for employees, guided by compliance professionals (or, better yet, senior managers), to discuss topics such as what regulations are relevant to the business, common compliance pitfalls, and how some business practices produce externalities that negatively impact stakeholders. When rationalizing statements pop up, as they inevitably will, they should be identified and flagged. Only after patterns of self-exculpatory rationalization are openly discussed and labeled as problematic will employees be able to internalize that knowledge and use it when presented with an opportunity to act unethically.32

The company also should share stories of genuine compliance successes. Compliance messaging is most effective when it conveys that positive behaviors are widely engaged in and approved of within a company.33 The reason is related to the claim of relative normality rationalization, which allows individuals to favorably compare their potential unethical act to the unethical acts of others. Positive compliance messaging combats this rationalization by demonstrating that while there may be isolated compliance lapses, the majority of the company is committed to making ethical decisions.

One company that has used storytelling and discussions effectively in its ethics program is Parsons Corp., an international engineering and construction company based in Pasadena, California. The company hosts an internal website where it has posed hypothetical ethical problems and asked employees to vote on how they should be resolved. It then has published the narrative comments anonymously and followed up with a detailed analysis by the company’s ethics committee. Such practices serve to unite employees around the company’s values as applied to real-life scenarios. Through the narratives, employees themselves identify common ethical traps and rationalizations.34 Periodically posing ethics challenges and quizzes to employees is one of a number of techniques Parsons uses in its award-winning ethics and compliance program.35

Use incentives to influence behavior in the right direction. Behavioral ethics research has shown that even seemingly inconsequential factors can greatly influence ethical decision-making. This is especially true when considering how rationalizations can be drawn from a company’s internal culture, a large part of which depends on incentive structures. This is one of the early lessons from Wells Fargo, where the social and monetary incentives to cross-sell products swamped the company’s compliance protocols. What’s more, Wells Fargo is not an isolated example; prior research has found that when major corporate trust violations occur, the root cause often has less to do with a rogue employee than with elements of the organization that are “dysfunctional, conflicting, or incongruent.”36 As a result, executives need to be aware of the common forms of rationalization described earlier in this article — and examine where in their organizations conflicting incentives could foster rationalization and wrongdoing.

To that end, business leaders can tap nonmonetary incentives to aid in compliance. According to research, praise and expressions of gratitude motivate more than money, and social group interactions motivate individual behavior more than almost anything.37 That means the most effective compliance likely comes from something other than salary and bonus. Research also shows that compliance is most effective when employees perceive it not as a constraint but as “the governing ethos of an organization.”38 The goal, then, is for companies to build a corporate culture that incentivizes the rejection of rationalizations through the creation of shared values.

No compliance program will entirely eliminate bad employee conduct. But behaviorally cognizant programs, ones that seek to understand employee decision-making and target the cognitive mechanisms that foster unethicality, hold the promise of achieving the primary goals of compliance: reducing unethical and illegal behavior within the company.