Episode 1- Tom Fox – The Voice of Compliance: How to design, create, and implement the right compliance program.

Tom Vox, thank you very much for joining our podcast. So straight to every on the call on the episode. Happy to be here. Thanks. Thank you so much. So Tom, you are a compliance event, Galista. Also known as the voice of compliance. You wrote books and out to 19 books actually on business leadership, compliance and ethics and corporate governance doing so many things in the field and best practice under the FCPA and bribery act and so many more actually. So Tom, there's so many achievements and wow, that's actually incredible. Maybe I forgot something. Would you tell the audience a little bit about yourself? Sure, it's actually I'm up to 23 books now. June was my latest publication of the third edition of the compliance handbook, which is in my opinion the best single volume on the design creation and implementation of the best practices compliance program. I've been in the compliance fields since 2007. I was a general counsel at a company that had a violation of the U.S. Foreign Corrupt Practices exact and that's I was part of the new management team that came in to put together a compliance program and that's really where I learned how to design, create and implement compliance programs. I went out on my own in 2010 and I wanted to be the nuts and bolts guy and so if you need someone to help design, creator, enhance your compliance program, I'm the guy. I guess there are many complexities in the process and companies might be asking themselves well, should they start? Well it's a simple program, it's just not easy. And as you said, where do you start? Well you start with a risk assessment because every government wants you to assess your risks. The risk of your company are going to be different than the risk of my company. One, we operate in different countries for instance. Number two, we have different employees. Number three, your customers are not my customers, meaning they're different. And so our risks are different and so what the government would say to each of us for both your company and my company is assess your risks and then manage the risks you have through a compliance program. Yeah, and thinking about that, the company is, you said that and that they regulate or might come and knock in at your door. Companies need to perform internal audits or external audits or just be prepared. How can they verify the implementation and effectiveness of their compliance program? Sure, and that's a great point because remember the last, when I gave the kind of eight categories, the last category was continuous monitoring. Internal audit is a part of that step. So an audit is a relatively narrow review but a deep review. So audit may say we want to look at your entertainment spend over the past two years. So they may come to you or me and we have to give them all of our entertainment, business entertainment for business development spend. And they would look at each one of our spending to see if we follow the policy and procedures. That's audit. Contrast monitoring with audit. Monitoring is a very broad look at one topic but not very deep. So monitoring might look at spending for the last three months. It might look at it for the past six months, but monitoring can look at it across your organization. So it's going to look at all your salesman. And say your spending is say you have a policy which says anything over $75 spent for business development must have pre-approval by your compliance program. Well that means anything below that you don't. So you would look at all of your spending. Number one, if it's above $75, was there pre-approval? Number two, do you have one salesman who has 100 receipts for $74.99? That tells you something as well. So monitoring and auditing are both tools to use in your continuous monitoring process. They have different functions but they're both an important part of a best practices compliance program. Oh wow, that's just raising many, many other questions but that's great idea where to start. And also it seems that also ethics is about the compliance of the FCPA because ethics says something to do. I think it's closely related ethics and FCPA. What do you think about that? Does it? Sure. And so in the United States, the US Department of Justice talks about what is your corporate culture? Do you have a culture that asks each employee to do business in the right way, meaning don't pay bribes to get business? That's ethics. And so what's the tone in your organization? Is your organization one that follows the rules? How do you measure that? How do you assess that? Because if it's important to the US government, it's important to you and me and it's important to our companies. So how you assess that issue of ethics and corporate culture is extremely important but you have to find a way to do that because it's important to the government. So ethics is absolutely a part of compliance. Compliance is how you implement the ethical values of your organization which is another way of saying your corporate culture. Yeah. And is this the thing that the code of conduct and ethics that every employee in the company needs to sign when he's hired, following you rolling in a company? Absolutely. And for a couple of reasons. Number one, I'm a lawyer by professional training and I believe everyone should know what the rules are. And your code of conduct broadly sets the rules. It doesn't give you the specifics but it may say don't pay bribes. It may say don't collude with competitors for anti-competitive actions. It may say don't discriminate. They say a variety of things. So it's going to set the general tone for your organization. So it's important that when an employee, a new employee comes to your company, you give them code of conduct training so you can begin to set that tone. One, they get to know the rules. Two, you set the tone. And if I'm a new employee and I see that your company has a robust code of conduct, I'm going to understand this is what you expect of me when I do business for this company. So it's important to set the expectations. And lastly, it's important to set not simply the expectations but try to set the corporate culture or the tone of the organization through your code of conduct. So I believe every new employee should receive code of conduct training. You have to be tested on it to prove you've taken it and you understand it. As a lawyer, I'm all for telling people what the rules are. But it's much more broader than telling them what the rules are. It's really to set the tone of the organization and the expectations for each employee. All right. All right. No, that's my sense. And I've been experienced this process myself. It's working at UI and also it's our kind company at Cytel. This is actually a mandatory process for employees to come and read a code of conduct and understand get training and eventually sign and consent to the code of conduct. But I will think and that's connected. Get me back to the previous subject and monitoring the effectiveness. I guess it's not easy. Well, it's very broad. It's comprehensive across the company. You know what you know? You know what you don't know. But sometimes there are things that you don't know that you don't know. So it's fine, challenging in some cases for a company into monitoring the effectiveness. Do you see any trends on that space? Sure. So you're absolutely right. And you coming from EY is the perfect example. I'm sure you had a robust code of conduct. I know you do. And I know you have training on that. Just as I was with major energy companies in Texas where I had code of conduct training and I was tested on that training. I had to teach that as a lawyer in the legal department. But you can't anticipate every situation in a code of conduct. Nor should you. You try to give broad guidelines. Don't pay bribes. Don't discriminate. Don't engage in an uncompetitive behavior, etc. But what I would ask of you if I was giving you training is, if you have a question, raise your hand. Here call compliance. What I try to tell people in training is the most important thing. important thing I want you to leave here with is if you have a question pick up the phone call me raise your hand ask your supervisor talk to someone speak up whatever it may be and it could be a 30 second call it can be the example I gave about the $75 limit on your expenditure you call me and say you know Tom I'm going to a very expensive restaurant have a very important client wanted to let you know that we may go over the 75 can I call you at home to get an approval when the bill comes answer sure is a verbal approval acceptable in that circumstances absolutely if you're sitting in the restaurant and your bill is come in you've had a very nice bottom line maybe a little more expensive than usual and you call me and say I've got this can I can I get it absolutely but for me in the compliance function I want to have one I want you to trust me enough to pick up the phone to I want to be there when you as the business person have that question and three I need to have the professional and subject matter expertise to answer your question you don't have to know everything about compliance that's the job of the compliance officer and they should be able to answer your question about can I give this gift can I give this dinner can I do something quickly and efficiently so you can go do business for the company yeah you don't know just ask as simple as that exactly I could not have said it better back I'm going to steal that line from you don't know just ask that's great yeah that's that's maybe the secret does when it's come for compliance and just before we finish many many people thinking about getting into the compliance space and do you have any tips for people at the beginning of the journey maybe lawyers or you know just just personal that really find this in a inquisitive about compliance any tips for them sure so and that's a great question because I came to compliance from the general council's office I didn't start in compliance like most people my age we all started our career somewhere else and gravitated a compliance either or whatever the reason was and I'm one of those people but now compliance has become so important and so significant in every corporation that it is compliance is recognized as its own discipline and there's now professional training you can get at the university level at a graduate level you can get MBAs focusing on compliance you can take law schools now have sort of compliance courses you can take and it's a great opportunity for people in academic in university right now or people who are thinking of making a change of going into a field that's relatively young relatively new but it's going to be around here forever I see ESG as an outgrowth of compliance and ESG is the most ubiquitous term in the corporate world right now I think literally across the world and so if you have the skills to do compliance you can do wide variety of things in a corporation some of those skills as I've said I don't know how many times I'm a lawyer so I look at things to a lawyer's eyes and I think it's a value to know the law but you don't need to be a lawyer to be a compliance you can be from marketing you can be from supply chain you can be from business operations you can be from finance all of those skills are incredibly important to compliance the interpretation and use of data is probably the most important skill a person can have now going into compliance unfortunately that's not a skill I have I can read and write and I tell you what the law is and I can tell you how to build a program I'm not very good with numbers there are many lawyers so if you really want to distinguish yourself and compliance and your professional background is as good as any you know with the why whatever your work you did with the why was and I don't know what it is but I know it involved numbers and so you have a set of skills I don't have and whether it was audit whether it was research whether it was consulting it doesn't matter you you brought a different set of eyes to problems than I did and so you would have an advantage over someone like me who is legally trained so the field is wide open it's open for you for women it's open for men it's open for non lawyers and it's only going to grow amazing amazing that's super curious and I'm sure many many people understand that that's the future it's already it's been the past it's the present it's the future it's only going to grow for different space I see this in the information security space compliance became a big thing when it came to data I'm in financial in legal and actually everywhere so compliance days a future and and I think that person I'm very curious about that and thank you very much for sharing from your insights and knowledge that was was fascinating and so thank you very much Tom and hope to meet with you again soon well I hope so thank you for having me on your show thank you so much