By Monica C. Meinert
In 2015, news came out that that German auto manufacturing giant Volkswagen had engineered its so-called “clean diesel” vehicles to pass an emissions test in an indoor lab setting, while knowingly concealing the fact that once on the road, the cars would emit nitrogen oxides up to 40 times over the permissible limit.
The scandal reached the highest levels of the organization—Volkswagen’s CEO resigned shortly after the news broke, and the company ultimately paid $25 billion in fines to the U.S. government in one of the most egregious cases of corporate misconduct in recent history.
These kinds of scandals are, of course, not limited to the automobile industry. Since 2008, for instance, large financial institutions around the globe have paid more than $320 billion in fines connected to misconduct. But beyond the financial penalties, employee misconduct can have serious repercussions for an organization’s reputation and can damage the confidence of customers and shareholders.
Conduct risk and culture
Conduct risk is not a new concept by any means, but banks have only recently begun to look at it as a discrete risk category. The Federal Reserve Bank of New York defines conduct risk as “the potential for behaviors or business practices that are illegal, unethical, or contrary to a firm’s stated values, policies, and procedures.”
There’s an inextricable link that exists between ethical conduct (or lack thereof) and the culture of an organization. “Culture is a form of capital—it’s an intangible asset that you need,” explains Kara Tucker, enterprise ethics strategic manager at SunTrust and a panelist at ABA’s Regulatory Compliance Conference earlier this year. She uses an example of rocks in a glass jar. “The rules, laws and regulations are rocks in a glass jar. Culture is water. It fills the cracks, it tells us how we need to act.”
When culture is weak, inconsistent or toxic, it increases the chances of misconduct occurring within the organization. So how do banks build strong internal cultures and stay on the right side of conduct risk?
1. Create an environment where problems can be escalated
A key indicator of a strong internal culture is whether employees believe that they can speak up if there’s a problem. Regardless of the bank’s size, Tucker emphasizes that employees “need places to report inconsistencies in culture.”
While SunTrust uses a third-party provider to manage its anonymous hotline, she says that smaller institutions can be successful running a program internally to handle whistleblower complaints. Of critical importance is ensuring that employees are educated on how to report—and understanding what will happen when they do.
“We have a whole campaign around speaking up,” adds Aprille Savarese, SVP for conduct, security and financial crimes risk management at Zions Bank. Part of that process involves meeting with leadership teams around the bank so that they understand that allegations don’t disappear into a “black box.”
It also involves making sure employees who do report feel like they’re being heard and that investigations take place in a timely manner. Savarese—who monitors Zions’ third-party whistleblower hotline—says she’ll occasionally “mystery shop” the bank’s hotline, calling in a fake complaint to ensure that information is being collected responsibly and escalated in a timely fashion and through the correct channels.
2. Have strong communication practices
Building a strong organizational culture starts with strong communication, Savarese says. “Having a clear communication path is critical, and it needs to be multiple layers.” That means that everyone—from the bank’s senior management team down to branch management needs to be able to clearly and consistently communicate the organization’s expectations to their staff.
At SunTrust, Tucker also tries to embed messaging about ethics into employees’ everyday tasks. These can be things as simple as running ethics messages on desktop screen savers or popping up a compliance reminder when employees fill out expense reports.
3. Pay attention to subcultures
Regardless of the bank’s size, bank leaders should also pay close attention to subcultures that form within the organization. Whether it’s a single department within a local community bank or at a branch miles away from a regional bank’s headquarters, subcultures can have a significant effect on employee attitudes and behaviors—both positive and negative. “People imitate what they see others doing,” Tucker says. “The goal is to figure out where the subcultures are.”
Zions Bank, for example, has more than 400 branches in seven different states, and Savarese says one of the key challenges is making sure that there is a consistent understanding and application of the bank’s values. Ultimately, the goal is to “make sure you have a sound culture, and not a lot of subcultures.”
4. Use reporting and metrics
To gain a holistic understanding of an organization’s culture and potential conduct risk exposure, bank management and compliance teams can work to pull together data points from across the enterprise. By monitoring things like compensation data, performance reviews, employee surveys, corrective actions and consumer complaints, it’s possible to start identifying trends and potential weaknesses. “Any time we can look at behavior, we have an opportunity to put metrics round it,” Tucker says.
Another key source of data? Employees on their way out the door. “Exit interviews are goldmines,” she adds.
5. Get buy-in from employees
At the end of the day, the success or failure of a bank to build a strong internal culture depends on whether its employees truly believe in the organization’s mission and values. As she recently worked to update SunTrust’s code of conduct, Tucker says it was important to make sure that it would be something employees could easily understand and relate to.
“I used ‘we’ language to get the buy-in, and I gave behavioral examples so that it’s tied to what people are doing.” She also added a formal non-retaliation policy to the beginning of the code of conduct—a signal to employees that they should feel safe to report any misconduct they observe.
Ultimately, Tucker says: “if you have strong morale around complying and doing the right thing rather than finding the line and skirting it, you have a form of capital.”
