Governance, Risk Management, and Compliance: It Can't Happen to Us—Avoiding Corporate Disaster While Driving Success

Beyond the Direct Costs

We should make no mistake—compliance is up there with strategy and risk management in boardroom discussions today. It's not just the significant costs but also program effectiveness that have captured attention, for good reason. Directors are well aware of the myriad laws and regulations to which their companies are subject. As a brief sampling, these include broadly applicable requirements related to product safety, employment, workplace health and safety, employee benefits, pensions, securities laws; those cutting across a number of industries dealing with information privacy, anti–money laundering, and appropriateness of product to customer profile; and industry-specific mandates for government contractors, pharmaceuticals, and health care, tobacco, and telecom companies.

Just as eye-catching are enforcement and related regulatory actions for noncompliance. These include ongoing and renewed activity by the U.S. Securities and Exchange Commission and Department of Justice, each of which says it takes a carrot-and-stick approach—being more lenient where a compliance program is strong and tougher when it is not, although some lawyers question whether those statements are supported by reality.⁸ Then there are the Delaware Chancery and Supreme Court cases, which underscore board responsibilities for ensuring effective compliance programs. Also having gained critical notice are the federal sentencing guidelines, which deal with criminal misconduct and a company's ...