S3Ep13: Reimagining Compliance: From Rules to Culture with Kirsten Liston

Introduction

0:00Welcome to Organizational Sherlocks, the podcast where business meets psychology and your organizational puzzles meet their match. Join us for captivating stories and practical solutions to unravel your toughest challenges. I'm Dr. Elizabeth Fleming. And I'm Morgan Ashworth, your guides to prescription for business success. Let's dive in. Well, listeners, in this episode, we are joined by a wonderful guest. We have Kirsten Liston here with us to really start to

0:36rethink compliance. Compliance, not just as a set of rules, but more as a reflection of human behavior, which as you all know, Morgan and I are very interested in. So in this episode, we're really going to talk with Kirsten and unpack how motivation, learning, decision making all really shapes what people actually do at work and why it matters, especially for building ethical cultures that go beyond kind of that idea of checking the box, if you will. So I'd love to

1:06start by learning a little bit more about you, Kirsten, and having our listeners do the same.

Kirsten's Background

1:11Can you tell us a little bit about your background, how you came to this perspective on compliance, and what do you do? Yeah, I would be happy to. Morgan and Elizabeth, thank you so much for having me on. I think it's such a great angle to explore because so much of compliance these days is organizational change, right? And to make organizational change, you have to get into the psychology of people. So this will be a fun discussion. I'm Kirsten Liston. As you said, I'm the founder and CEO of Rethink Compliance. That's an 11-year-old company. But for the last 26 years,

Compliance Learning

1:44I've been working in the field of compliance learning. That field kind of stood up in the early 2000s, but the whole idea is inside of just about any company of size now, there's a compliance team whose job it is to think, what are kind of the people risks that we could face? You know, what are the legal, ethical, reputational risks that could be caused by our people, and how do we get in front of them? And some ways of getting in front of them are thinking about your risks, doing a risk assessment, writing policies and procedures, but then it's letting people know about it. And so that's

2:19the training part. But then there's also the making people care about it and making them actually do something about it. So anyway, that's my field compliance, compliance training and things that go with that. Yeah, wonderful. Well, I love the intro. So funny enough, Kirsten, I actually come from the compliance realm as well. So a lot of what I do internally with organizations is compliance based, not all of it, but some of it, because all in all, I do gap analyses on companies. So it's a very interesting and really looking forward to a conversation, especially someone so local to myself. You know,

2:52I'm just outside of Boston. So hopefully soon we'll be able to connect in person too.

Change Management

2:57I love that. Yeah. Well, I think it's interesting because I'm hearing you, Kirsten, talk about change, and we talk about change a lot. And I do a lot of change management, not on the compliance side, but change is hard for people. It can be. And I'm just kind of curious, you know, when you think about change, like, how do you define that in your mind? Or how do you, I guess, kind of bucket that so people can understand, like, compliance is something you should care about. And it is something that, you know, is really for you, right?

Compliance Challenges

3:29I love where you went with that. As you were starting the question, something I was thinking to myself is when this field started, compliance didn't really understand it was about change. You know, compliance, the word means follow the rules. And kind of in the early days, the job number one was to educate people about the rules. Because really until compliance programs took off about 10, 20 years ago, people didn't always, like, know the rules and know how they could break the rules at work. So that was kind of job one. But job two, you know, you get these

4:01compliance programs stood up, you have rules, you've got codes and training and all that stuff. And then, you know, five, 10 years goes by, if just telling people the rules accomplished the goal, we'd be done, we'd have to train new employees. And that would be that. And it kind of dawned on both the people who practice in our field, their organizations, and then kind of the prosecutors and regulators who care that we get this right, because otherwise, there's misconduct that they have to deal with. It kind of dawned on everybody that you had to make sure this stuff was working.

Assessing Organizational Risk

4:32So when you say, when we think about change, kind of, what does that mean? It essentially means, you know, compliance is in the business of saying, where's the organization at on this stuff? We know what the rules are, but where are they actually at? And then how do we move them closer to where they want them to be? And that meant compliance had to start wading into things like capturing sentiment, finding data and analytics that measures behavior change, which is not simple, right? Especially if you haven't started out doing that. So that to say, in the compliance world,

5:07we didn't set out to be about change. But now that we're up and running, all we think about is change, because we have to be able to show the impact of what we do. And you talked about gap analysis before, measure the gap between what would really protect the organization and where we're really at. Yeah, I think, I think that's great. And also, noting how, you know, the first step was, in fact, education. That is the foundation of building a compliant framework is having the education. But then the change comes in, because you have to adjust your processes, your SOPs, your, your overall,

5:43you know, company build up to be compliant. And so that's where the change comes in. Then I would argue, and I'm sure you would agree, Kirsten, would you say that change then continues? Because now you're looking to the future on what other types of compliance, what other types of rules are going to need to be followed? Maybe not today, but tomorrow, for example?

Evolving Compliance Landscape

6:06Yeah, the thing I find so fascinating, fascinating about compliance, and the reason I've probably been in it for 26 years is, you never fully solve the puzzle, because the landscape keeps changing. Like you said, there's kind of that initial step of education. And if you go back to the 1990s, we didn't always educate people that bribery was illegal, or what it looked like, or how it happened. We didn't always educate people what insider trading was, and that they had to pay attention to when they had company information that could move the markets. So job one was letting people know. But once you

6:40accomplish that, and the vast majority of companies out there of any size have accomplished that, so great for them, that's a great first step, then things start to change, right? What laws matter change. There were many, many years when the U.S. government was very vigorously enforcing bribery law. That was the number one thing companies were worried about. They went after companies that were involved in bribery, especially foreign public bribery, bribing government officials outside the U.S., which sounds like it should be obvious, yes, don't give somebody a suitcase of money,

7:13but lots of things are bribery, including very subtle things like doing someone a favor, helping somebody's kid get into college, giving someone a free internship, right? So anyway, there were many years where companies were really thinking about bribery because the U.S. was really

Sanctions and Risk

7:28enforcing it. Now we have an administration who came in and said, we're not actually that worried about bribery. We're going to really focus on fraud. And the Russian war started, and suddenly sanctions mattered. And so what's interesting is compliance professionals have to think about this range of topics, but what topic matters depends on what's the government doing, what's the state of the world, what big cases just happened. And then their people change too, right? Their audience maybe goes from less educated to more educated. Their company goes through changes that change their risk profile.

8:03And then one thing I think a lot about is the way humans communicate have changed. In the early 2000s, if you could put up a rudimentary web page, that was cutting edge, right? But 10 years later, it looked dated, it looked old. And what we focus on, which is compliance training and communication materials, it kind of has to look like what people see outside of, you know, the office. Like right now, where do people go online? They go to TikTok, they go to Instagram, right? They go to podcasts,

8:35they go to really interesting web pages. If compliance training looks like something that was created 10 years ago, 15 years ago, 20 years ago, that kind of sends a message that, I don't know, we're not investing in this, it doesn't matter as much. So to wrap it all back,

Building Buy-In

8:50Morgan, it's so interesting, because yeah, you can set that level. But then things keep moving. When I was in college, I played rugby. And the thing that is fun about rugby compared to football is play never stops. Like in football, you run a play, and then it stops, and you reset, and you run another play. In rugby, there are these 40 minute halves, and play almost never stops unless the ball goes out of bounds. So you run a play, and then you just keep moving, and you have to respond to the events on the field. And that's kind of analogous to a compliance officer's role. Yeah, great extended metaphor, Kirsten. We actually use

9:26them all the time. I think it's the number one way to really help people understand. And I could honestly build on that. It's, you say, in rugby, the only time is if it goes out of bounds. Well, maybe that relates to compliance in the sense of when a law is enacted, but then gets stalled for some reason, because of, you know, some argument against it after it's been enacted. Like that would be the rugby, I guess, continued metaphor. It would be. And actually, your comment was making me think about it. Only a couple times does something come along that really resets your compliance program.

9:59But when it does, it does it definitively. And one thing that on the one hand, compliance officers hope never happens. But on the other hand, is like the best time in your career to be a compliance officer is when your company did something wrong, and the business needs your help to address it and to bring the compliance program to the next level. Most compliance teams, the businesses know that they're important. They know that they have to do it. But there are competing priorities, right? There are lots of things that business could spend its time and money on. So most compliance teams feel

10:30under-resourced. Not enough time, not enough attention, not enough resources. There's so much more they want to do. The best thing and the worst thing, but the best thing that can happen to your career is to have there be a big misconduct happen at your company that had nothing to do with you and that you didn't drop the ball on preventing. Because all of a sudden, you have authority, you have resources, you have the attention of the business, and you can do a lot more. So it just made me think, like, what's the equivalent of a ball going out of bounds? And that's one of them. Yeah. Yeah, that's really, that's interesting. I was kind of not giggling, but laughing a little bit.

11:02I can remember, to your point, about kind of 10 years ago or so, when there were some big bribery things happening. I can think of specific moments. And like, to your point, not big, you know, suitcases of money. I, you know, so we don't have to go down that path. But I definitely, it changed the game. And I think that what I'm hearing you say is that you really have to be on your toes, right? And it's not just what has happened or what has been enacted, but what is the possibility of what could be enacted? Yeah. It's exactly right. And I think it's,

11:36it's interesting, because compliance isn't necessarily intuitive as a mindset. To those of us who work in compliance, it seems so screamingly obvious. But if you go into, let's say, a high growth startup company, right? This company is successful, they have product market fit, they're growing, they're global. What is the leadership team focused on? They're focused on how do we keep this growth up? How do we extend operations to serve all these people? How do we get the financials right? Because we either have to raise money or think about exiting. And they're

12:10in go mode, right? Everybody is so busy and so focused on growing the business. And along comes compliance, who says, hang on, I'm not sure we should go into this country. Are you aware of whatever? And it just is not normally where people are at. And quite frankly, that's why I think the government has done all the work it's done to kind of put all the requirements in place. So businesses have to have compliance, because it's a blind spot that companies have even even well meaning ones. And same thing with employees. You know, companies are lucky if you're trying hard to do good at your

12:44job, right? Companies want high performing employees and not every single one is. But the high performing employee, what are they thinking about? What's my career path? How do I bring value to this organization? How do I represent to people that, that I'm doing a good job? How do I level up? How do I show that I'm moving mountains and write all that stuff? They're not thinking, what laws could I break when I'm doing this? And what should I be on the lookout for? Right? They're not thinking of that as explicitly as they could. And it's, it's funny, people are more exposed to risk than they sometimes

13:19realize. So, right. It's interesting. It's just not a natural mindset. Yeah. Yeah. Well, and that would actually lead me into the next question. Obviously, you approach different individuals in an organization

Approaching Different Audiences

13:30in varying ways and varying capacities, depending on, you know, what affects them regarding compliance. So how would you say that you'd approach building buy-in from an employer versus a manager versus, say, like a regular employee at an organization? Yeah. That is such a great question because different people kind of have different motivations and different things will make sense to them or get traction with them. I teach a two-day workshop in my industry called Creating Effective Compliance Training. And I literally just taught it yesterday and the day before. And the very first section in it

14:05is called the need for and the value of training. And we go over what's the case for training, because in some cases, you know, we have compliance professionals attend from all over the world. Some of them are in organizations where the organization is bought in, but some of them are in organizations where it's, they're, they're lucky there's a compliance department at all. Do you know what I'm saying? And they really have to make their case. And so I'll kind of take each audience because buy-in at the top helps with buy-in everywhere down. As I say, there are organizations that are bought

14:40in at the top. And I, I know a woman who was at a company where the CEO was super into compliance, like talked about it at the town halls, like very naturally and very organically talked about how we're not just here to do a good job. It matters how we do it. And like, we want to win in the right way. And that person like believed in, in compliance, funded compliance and imbued that through the organization. And he was not only a CEO at his own organization, but he sat on a number of boards and he advocated for compliance on those boards in ways that were really impressive. He sat on a

15:15board at a company that brought forward a code of conduct because boards have to sign off on codes of conduct. And he looked at that code and he said, it's not good enough. That's not world-class. Go learn what a good code is. So I say that to say, that's an example of when you really have a champion, but when you have leadership, who's not thinking about that as a compliance officer, you have to try to get their buy-in. I know one that did, that had a really effective approach to it. He got to present, this was a company where they were all in the same place.

15:45They weren't spread out globally, which you sometimes have, but he got to present to the leadership team once a quarter and it got about an hour of their time and he would give them a compliance briefing. And he just didn't feel like he had their buy-in. So this is what he started doing. He would take a real case that happened, maybe in their industry or an industry like it. And ahead of the meeting, he would write it up and send it to them and say, company X is in this situation. Here's what's happening. Here's these things that are happening. And then he'd give them a multiple choice test. Which of these four things would you as an

16:18executive do? And it was anonymous. So he didn't know who answered what, but they were all cases where corporate misconduct had happened and where there had been severe penalties. Eventually these people caught on. But when he first did this, he walked into the executive leadership meeting and he said, congratulations, three of you are going to jail. And he really got their attention. And so one way to tell leadership that it's important is to draw their attention to things like that. The other thing that kind of structurally compliance has going for it is that boards of directors by law are actually

16:50personally liable for whether or not the organization has implemented a compliance program. So if you're a CEO, your boss is the board. If your boss is personally liable for the compliance program, you should care. And if you don't, the compliance officer can help make you care to a degree, right? These things aren't perfect. That's about managing up and leadership. And you know, I mean, you guys, you work with organizations, influencing at the very top of the organization is a high level skill. So the better compliance officers are at it, the better. I'm going to skip middle managers

17:26for a second and go to employees. For employees, you can do a lot of broadcast communications. If you have buy-in from the top, you can do training that goes out to everybody via an LMS. You can do emails from the CEO. You can have a code of conduct that gets sent out to everybody. Once you kind of have buy-in and backing for a program, you can communicate with employees in a very broadcast manner. And they more, I mean, well, some of what we'll talk about is buy-in and how you get people to know that you're serious. But if you do a good job, they'll, they largely come along with you. Then the third thing you have

18:00to tackle is managers because you can't just do a broadcast communication to managers. You have to get them involved. So typically when people are putting compliance programs together, it's tone at the top and setting up the program kind of governance. It's bringing employees along, including managers and senior managers. And then kind of the extra credit or expert level or, you know, 201 step is to get managers involved in compliance messages because that's much more complicated. You can't, it's not a one and done. It's kind of an ongoing large change management project.

18:34Yeah, that's, I love how you described that. And I'm hearing you talk about it again, not coming from a compliance side necessarily, but just change management. And, and I'm just, I'm thinking about it as kind of that trickle down effect, you know, when you do have that at the top. And I think that's true for a lot of different areas in IO psychology and business, right. Is that buy-in at the top is, is really important. And it's also making me think a little bit about just culture and how the

19:05environment changes as a result of, of this, right. And to your point, like, you know, if there's laws that are out there, not everyone wants to sit down and read the laws and consume them and understand them in that way. And, you know, how, I guess from your experience, you know, like what, how does culture change as a result of work that you do as a result of, you know, the work that good compliance officers kind of that they do in their, in their role? Yeah. Well, I'll say, you know,

Compliance and Culture

19:36as kind of compliance practices evolved about 10, 15 years ago, compliance realized that if we plug into culture and if we harness culture, that's already there. And if we kind of make compliance feel like a natural extension of the culture, we'll get a lot further than if we're over here in a little silo telling people that there's rules. And so one place you see that a lot is almost every company out there is required to have a code of conduct. A code of conduct is not an

20:07intuitive thing. It literally is the company's shortlist of these are the top legal, ethical, reputational risks we need to think about. And there's no reason these things should go together except for that's the filter, right? And it covers things like bribery, conflicts of interest, harassment, insider trading, sanctions, the environment, you know, whatever. To a compliance person, that's like your, that's like your table of contents, right? But for employees, it's not obvious why these things all go together. And the earliest codes weren't that effective because they

20:41looked like contracts and they just read like a bunch of rules. It was like a really boring handbook. It was like, here's a lot of stuff, you know, where employees were like, what does this have to do with me? And around 2010, 2011 was when I started working on them. Companies realized, boy, codes would be more effective if they looked more like annual reports. Companies are required, the New York Stock Exchange companies listed on there have to have a code of conduct and it has to be on their website because of that. And I think other listing exchanges have it too. It's become a

21:12default for companies to put their code on their website. Well, once they put their code on their website, it's compete, it's kind of in there with other company documents. So a Microsoft Word numbered paragraph contract written thing doesn't really sit well with like your sustainability report and your annual report and your marketing materials. So companies started rewriting codes that looked more like an annual report, a sustainability report. They're in, you know, PDF and now there are digital formats too, but they have beautiful photos and they're written in more of a marketing e-way. And it

21:46was at that time that they realized, I mean, in my view, they realized, yeah, we can harness the company's culture for this. And so you started seeing things like, for instance, I worked with a hotel chain to take their Microsoft Word document thing into a PDF. And within the business, so what you do when you try to harness culture for a code is you look what people are already saying in the business and inside their business, they had a phrase doing what's right. And they said that all the time. And we realized, well, that is a perfect phrase to be the foundation of why do we have a code? We have

22:20a code because we want to do things right. You hear this, you hear the CEO say this, you see it in all our materials. Like this is a phrase that's very familiar to you. And now it's being applied to this one thing. And so to answer your question, the way that I see it happening, or the way that I kind of see culture and compliance coming together is when they try to paint in a natural and not forced and not cheesy way, that compliance is really a natural outgrowth of what we're here to do. Now, the whole second part is, is it true? And are you influencing culture and stuff like that,

22:53which I'm sure we can dive into, but that's kind of where I started to see compliance and culture coming together. And, and, and that is more the norm today than not. Yeah. I just want to throw one thing out there really quick, if that's okay. Cause it made me think of it. I worked at Outback Steakhouse like long, long, long, long ago. Right. And previously, and I don't know if it still is this way, but they always had the tagline of no rules, just right. And even from a compliance training for me as a bartender and all that, you know, when I was in school that, that, that tagline

23:27was used regularly to try to understand what client compliance means, because it's not about no rules. Right. You know, it was, it was about making sure your customer gets what they need, but that you're maintaining your own standards for all the things that we do. And I, I just, I think about that because I, what you, I guess the tagline you used, it made me think about that. Um, and I, at the time I didn't realize that's what was happening. I love that idea too, because you understand it in instinctively, you know, what no rules just right meant in terms of guest service. And it translated very naturally to doing the right

24:02thing. Cause it's about, it's not about rules. It's about personal standards. And that's a great way. And honestly, the best compliance materials out there, they kind of say, yeah, there are rules, but we're doing this because it's the right thing to do, right? It's the way we want to do business in the world. And quite frankly, some of the most persuasive compliance materials come at it from that perspective, not like we got to follow the bribery rules. Cause otherwise someone will go to prison. Like that's not that motivating. It's like, why is bribery illegal in the

24:32first place? Bribery is illegal because it's really terrible to live in a society where bribery and corruption are rampant. It's not fair. Um, people really struggle, you know, and we can all like by the everyday choices we make, we can influence the kind of world that's out there and that matters. Um, and that's way more motivating as you can imagine for like getting people's attention and changing their behavior than just the rules. So no rules just right. That's perfect example. That's like the idea of building business ethics, business ethics into your culture. And so funny

25:04enough, Kirsten, I actually had, I was on a podcast, um, that's all surrounding compliance and the conversation was specifically honed in on parting compliance and part of culture. So, um, that is because of the gap analysis that we ourselves do in these change management roles. It's so natural to apply it to culture because that's how, you know, it'll continue. Yes, that's a great point. There is a great book out there that I read very early in my career called influence without authority. And the whole message of the influence without authority book is

25:40you can make things happen without authority. And in fact, authority is sometimes the weakest persuasion because authority is do this or you're going to get in trouble. Well, the minute that threat goes away, you're going to do whatever you want, you know, and, and this book made the point that it's far stronger to influence people to want to do things versus just force them. And to your point, when you can embed compliance into the culture, it has a lot more staying power than just like, here's this rule and you better remember this rule and you're going to get in trouble if you don't do

26:13this. So. Yeah. It's like authoritative leadership versus authoritarian leadership. When you have authoritarian leadership, you naturally allow the team surrounding you to, to have opinions, to have questions, to, to be, to have a stake in the solutions being developed. Right. And so naturally when someone has a stake in the development of something, they are more likely to buy into it. You know, I, I put it as simple as, you know, when you're developing goals for, for an employee for their next year of employment, then they get to help develop those goals. It's not just the manager

26:45doing it. So I put it on that really simple term just to show that you can apply that elsewhere, including compliance. I love that. I love that. And you know, I think it's important to remember at all times that we're reaching adults and they're capable people who are running their own lives and they have, they have valuable input, right. To bring to this. And in fact, you know, you can tell them the rule, but they can help you see how it applies in their area. So what you're saying is bring them in as a participant in this. It's not just about dictating rules from on high. It's saying

27:20together we're trying to accomplish these goals. Your part in it is really important. And let's kind of equip you so that, you know, so we're all on the same page or, or whatever it is, but to get the right outcome. And I have to say, as my, our listeners hear me say it a lot, but the asymmetric information bias, you do not know what your people on the floor know about their area as well as they do. And so it's so important to involve them and have them be a partner. No, they're not necessarily going to be involved on the overall business strategy of why this is being connected.

27:50to the company or applied to the company, but you have to involve them because if not, you don't know how well it's going to be adopted or applied into the culture. Totally. Totally. And you know, people know, I don't know, people have all kinds, there's a whole spectrum of how much you participate in something, right? There's everything from enthusiastic participation to like participation and name only. And of course you want more enthusiastic

28:22participation, not people like doing the bare minimum so that they don't get in trouble. And how do you, how do you get that dial moved in the right direction? And I think a lot of what you're talking about is a big part of it, right? It's treating people like participants, not just receiving the rule and, you know, being told what to do. Yeah. Yeah. Now you did talk about previously, you know, a co-part of yours who had a very creative approach to lead to executive leaders who we didn't feel were taking it necessarily seriously. And I feel like that creative

28:58approach is so critical, no matter the situation. And it's always, you know, it's always filtered to that specific organization or department, et cetera. Your work often incorporates storytelling and even creative approach poetry. So how do concepts from persuasion and marketing psychology improve compliance communication? Do you? Oh, that is such an exciting area to dive into. Yeah. What's, what's really cool about being in the compliance area, I really believe in the

29:28mission of compliance. I really think it makes for better companies and better societies, right? It's a, it's setting up a framework to get people at scale to often do the right thing. So I believe in the mission. And then what's interesting about compliance is it's usually behind other forms, other, other fields. And so in learning, regular learning tends to evolve faster than compliance learning. Regular communication tends to evolve faster than compliance communication. So what that means is actually what you want to do is look out in the world and see

30:02how people are communicating. And then think, how do I do that from a compliance perspective? And you name some of the things that we've done. So we came across a British, like a viral video guy who wrote something called lookup about not being on your phone. And it went to like 60 million views. Like it just went viral. And we thought, well, we have nothing to lose. We're a, we're a new company. And we were actually trying to figure out how to talk to people about harassment and respect. In the aftermath of me too, when we were going from it being a more legal thing, like do not harass people, here's

30:36legal standard to the whole world kind of realizing, like we're thinking and talking about this differently. We're talking about power dynamics. We're talking about stuff like that. We can't, we, you know, we have to get into the people side of it. So anyway, we got this, we called him up and we said, we want to make this anti-harassment spoken word video. We'd love to work with you on it. And he did. And we made this great spoken word thing called don't stand by. And it was so compelling. We would play it. People cry a little bit in meetings. So that's one example. And then

31:08he went on to make a couple more of those for us, but we'll also find commercials. You know we, we won your, I'm a big fan of Google's year in search because it, you know, it kind of shows you what happened over this last year. And it's like the high points and the low points and it's very emotional. So we made a video called never stop searching, which is all about the concept that humans are able to seek their own information, but compliance is here to help you to edit. And it's a great video because it goes beyond compliance. It's, you know, people asking about

31:40babies and tornadoes and wildfires and whatever, but also about what if I saw something at work that was wrong? What if, you know, whatever, whatever. So yeah, so we like, and you know, Superbowl commercials. The bad bunny halftime show actually has inspired a video that we're working on because we think if there's something out there in the world, that's really moving people, what can we learn from it and how can we naturally plug compliance in? And I guess the final point I'll say about that is the reason it works is because at the end of the day, although it's not always

32:12presented this way, compliance is about humans. It's about humans making decisions. It's about humans making bad decisions, having blind spots, facing consequences, or the opposite, doing the right thing even when it's hard, doing something courageous. And so you can find stuff that motivates people. Like you can find stories and, you know, situations and make videos that inspire and move people just as much as those Superbowl commercials about compliance topics if you can find your way into it. Yeah. You know, you're making me think about just storytelling in general. So I

32:48think I've said it on the podcast before, but I decided to go back to school and get my MBA just because I work in business and I think it'll help me speak the language a little bit better with my clients. But I'm taking a class right now that's around communications. And again, not specifically tied to compliance, but it's making me think of kind of breaking down a story and the importance of knowing your audience and who you're talking to. And I think that goes maybe back even to what we talked about before, the way you talk to the board or the executives may be very different

33:19than the way that you talk to, you know, the production employees, for instance. And I'm seeing you nods. I'm guessing you agree with me there. But there is a really good book and I'm not sure if you've read it, but it's called Storytelling with You. And there's an associated podcast called Storytelling with Data that I never would have maybe found had it not been for this class. It like breaks down a story and breaks down how you can, you know, tell a story in this way. So I'm offering that to you and to our listeners because I've actually really enjoyed the book,

33:53even though I maybe would have never found it otherwise. But it does make me think a little bit more about those creative approaches to things that I think historically have been kind of dry, you know, to person. That's, it can be pretty dry at times. It can be pretty dry. Yeah. Right. Well, it makes me think that, you know, somebody once said to me, they were kind of looking through our catalog because our business, we have a library of compliance material that clients can take and then customize to themselves. So put in their logos, their guidance, their reference, but they're not

34:27starting from scratch. These laws are 80% the same across companies. The 20% matters, but they can focus on just the 20%. But somebody was looking through our catalog and it was someone I'd known for a long time. And they said, I'm embarrassed to say this, but it never occurred to me that compliance training wouldn't be cheesy. And they were like, you know, it never occurred to me that it could be good. But what I would say is probably in any area of business and in your fields, the more creative you can be often, the more effective the solution. I was, before I got into this field and before I

35:04started this business, I was a writer and I've spent, I had stories published and essays published and I was a journalist. And at different times I've taken, there's a really terrific, like kind of master novel writing workshop here in Boston that I've been fortunate to plug into. Those guys are so talented. But one of my friends who I met in there, cause I'm not working on a book right now and I'm not trying to publish books. They all are. And he said to me, you know, don't you miss writing? And I said, honestly, right now, business is my creative outlet. I'm always trying to solve

35:35things. You know, how do we, and in our case, we started our business. I won't get too far into this because this is about organizational psychology, not business strategy. But, um, when I started the business, okay, don't worry. Okay. I just don't want to take us too far afield. But when I started the business, it was to say, I think, because I, I came from, there's like four big companies in the field and I came from one of them and I was there when they started and I was there when they grew and then they kind of stagnated in terms of evolving in terms of communication styles and product

36:07styles. Um, but also they pulled back on customization and service. And so I kind of had a business problem to solve that that's been a really cool creative problem, which is, this is how, this is actually what clients want to buy. They want to buy modern training and they want it with a lot of service and they want expertise and they need customization, but they need to be able to customize in a cost-effective way so that when they translate into 17 languages, they're not paying an arm in a leg and it doesn't take six months. So I started this business with kind of this vision

36:38that clients are asking for more from a company like ours. I know it's possible, but I don't know how to get there because I know how these other four businesses solved it. We're trying to move the needle and do something different, but still kind of have, have the same financial targets. And how do you get there? And it's been an 11 year creative problem. That's been a lot of fun to work on because it has a million facets, right? You fix one thing over here and then you think, now, how do we fix our, like, how do we adjust our margin and how, you know? So it's been a lot of fun to figure out.

37:11But I think, I think almost anything can be, if you're, if you, if you approach things with a creative idea, you can get really far in a lot of fields. Yeah. I, that's so important to say because, you know, creativity is what allows us to modify those blueprints that we get about compliance or about organizational initiatives or change management processes and then customize it down to the organizational level. So that is the biggest piece is creativity behind what we do.

37:43Yes. There is a level of, um, scientific backing of what types of creativity we would use necessarily, but again, you need to have an understanding of all these different intervention methods to best choose and connect it to that organization. Um, all in all. Now, compliance sometimes be seen as a, more so of a cost than anything to organizations and thinking about the application of it and involving it within culture. So it doesn't just seem like an outright cost, but what would you say

Benefits of Compliance

38:17are the benefits of applying compliance to culture? Have you seen it improve, say the, the end financials of the company or the productivity levels of the organ or the departments? Um, can you take us a little bit into that on the backing of compliance as a motivational factor towards business? Yeah. Since the early days, people have been trying to capture the ROI of compliance and there are different studies out there that, um, have taken different cuts and do show things like

38:49better employee retention at companies with a stronger compliance culture. Um, or, you know, I mean, certainly, certainly one big ROI is missing misconduct, right? Because if you didn't get an $800 million fine and have to defend your company to the department of justice, that's important. So there's a lot of people trying to say that stuff out there and there are studies that show it. Um, but, but I'll bring it down more to a grassroots level and to say for about the last six years compliance has been trying to get its head around. How do we, how do we use data and analytics to measure

39:24this stuff? How do we generate the data in the first place from our own programs and get it from other places in the organization? And then what's it going to show us? And so if we go back to about six years ago, we started offering clients ways to collect data through their courses. Cause if you roll out a compliance course, it often goes to every single person in the organization. If you can embed some culture survey type questions, some sentiment collections, some self-reporting, like, did you use the code of conduct last year? Were you involved in an

39:54investigation? Did you feel treated with respect? If you can embed that stuff and get it back, you just took a survey of the whole organization that you have data about, which is great. And same thing with the code of conduct. If you can make a code of conduct that's digital, then every time somebody interacts with it, we, we don't collect data on individual use. Cause it's not that important to know that Morgan visited the code on Tuesday and read the insider trading section. You want to know like the aggregate patterns. So we've been measuring this stuff. And when we started measuring it, I, we said to our clients, nobody's really measured this stuff.

40:29So we don't know what this is going to show. And the numbers may be horrible. Well, you may do a new code of conduct and send it out. And it might be that a hundred percent of the people sign, I've seen the code and read it and really 8% visited it, but at least we'll know, because at least if you know your gaps, you can address them. And I have been incredibly pleasantly surprised to see how good compliance analytics are. And I'll give a couple of examples, but across many companies and many projects. So the, we rolled out two codes. The first two times we did this,

41:05and now we're back in like 2020, 2021, um, we rolled out two codes and one was to a giant, like over a hundred thousand person manufacturing company. And we've had contact with them for almost two decades, um, across like my previous employer and this one. So we're familiar with their program and they've been doing the bread and butter work of compliance for a long time. And not everything they did was fireworks, right? But they kind of put in the work. They rolled out their code of conduct and they sent out an email to everybody saying, we have a new code of conduct. We're going to ask

41:37you to read it. We're going to ask you to certify to it. We could see page count, something like 94% of the business. So virtually every person there, cause you have people on maternity leave and people with the national guard or whatever, um, not only entered the code, they clicked through almost every page. And the vast majority of them spent 24 minutes in the policy reading through every page. I was blown away by that because like that company, as I say, was putting in the hard work. They were

42:08doing them. They were doing all the stuff that you're supposed to do, but you know, sometimes you don't know how that's going to pay up. So I was blown away. And then the second company was a Silicon Valley company, about 40,000 people globally. And they rolled out their code and their stats were almost identical. And I was so surprised. Like, I guess I was more of a cynic. Um, but that like little temperature check and the ones that followed made me realize that sometimes compliance officers feel like they're shouting into the void or they roll out a bribery course and think, God, that could

42:40have been better. Or like I could, I could communicate like they can always see room to improve, but we've collected a lot of data on, I mean, we have, we have close to 200 clients and I don't know how many are using data, but it's across dozens of companies in different industries. And I've been really surprised by how high the marks are. And when you ask things like, do you think, do you think this is a company that values integrity? Um, and more than 85% of a very large population say, yes, definitely. Or is this a place where you feel comfortable speaking up? Like if

43:14you knew there was misconduct, you know, would you speak up? Companies routinely get very high marks on this stuff. And I, and I think people tell the truth because you see variations across, across businesses, across industries, across whatever. So I think you're by and large getting a sampling of the truth. It's usually anonymous. Um, so people know they're not going to get in trouble for it. So long story, because when you ask me, like, what do I see about compliance and culture, um, and the ROI of it? Um, as I say, you can speak to the high level stuff and people

43:45are always after that. But my on the ground view is that like, I don't know how to say it, but like the state of global business today is pretty compliant. People do what the compliance program asks them to. They generally give their companies and compliance programs, high marks, and that's a pretty cool human achievement. So. It's amazing. Like that's just impressive. Again, like data as a data person, like to be able to see that. And I'm so happy that you brought that up and talking about data and bringing that into it, because I think that's one of those areas,

44:18just like in other areas of business, it's, we don't always think about what data can we actually use or, or, or what questions can we ask? Right. It feels less tangible. Um, if you will, than say, you know, your income statement or something like that. So I, I really appreciate you incorporating that and I'm got, I'm blown away. I don't even know what these companies are and I'm blown away. So that's amazing. That's great. Yeah. As you were noting, sometimes the ROI can be hard to measure. Um, and that's on any change management platform. That's not just compliance

44:52based, but yeah, compliance. We, a lot of organizations see it more as a cost and they don't, they see it as a cost necessary to avoid legal action or legal issues. They don't necessarily see the actual benefits that they're receiving as well. You know, we could measure retention. I would argue we can measure the ability to recruit. Is it easier? Is it harder? Is the turnover faster? Customers do care about integrity as well. Customers don't want to work with a company that has bad ratings or, um, also if there's lack of integrity with the employees,

45:24there's going to be lack of integrity with sales. Um, so not only does it help avoid those legal issues, but it builds recruitment capabilities. It builds, um, customer retention. It builds retention of employees. And then you, it also, the investment of time into compliance saves you time on the backend if there were to come about. Um, number one, super easy thing to think of is say you got an unemployment claim, right? As an organization, you would already have a paper backing of why this

45:55person was terminated and you would have the proof surrounding it so that there is just no circumstance or there's no circumstances where you're trying to find paperwork. You simply already have it. You followed the rules and despite the biases of managers, um, that might have affected it. If you have a compliant framework, then they're required to follow a step-by-step process in order to take certain actions. Um, and that'll prevent biases from opening your company up for compliance concerns.

46:26I love that. Well, yeah, that's an amazing rundown. Um, and as you said that, I thought of two things. One is a story. So there's an organization in our industry. I don't have anything to do with it, but it, every year it means a list of the world's most ethical companies. And there was a company where there had been a major, very public issue. Um, and they got on, then they did a lot of work on their compliance program and they got on the world's most ethical companies list. And I heard a story that a salesperson reached out to compliance and said, can I get that world's most ethical logo?

46:58And they said, sure, but what are you using it for? And he said, I'm putting it in my email, um, signature. Cause I want, when I reach out to a prospect, I want them to know our company takes ethics seriously. And I thought that was so interesting. So, and then what was, oh yes. And then as you were talking about managers working through framework, it just, I was listening to you and it occurred to me one value that compliance programs bring, and that's more about proving a negative is that they identify really unethical people better than if we didn't have them. And

47:28those people don't as much get to rise into levels of management, right? It, it, to a degree and everything's imperfect. It's identifying people who are doing the wrong thing and screening them out before they can hurt the organization at a higher level, which I think is interesting. To that, it also removes those people from the organization before they can cut damage to just like the general employee. You know, you can get bad apples here and there. It's, it's super, it's, it's true. You can get a bad apple. You know, you can do all the right things with hiring and still sometimes end up with the bad person. Obviously there's Elizabeth and I have had

48:02conversations. There's a lot you can do to try to prevent that, but all in all, sometimes it simply happens that they are a bad hire. And when you have those programs in place, you can get this person out of the organization before they can hurt the morale of even just a singular department. Because once hurt by one person, it hurts the next person. It hurts the next person. In fact, there was an organization I worked with and there was one person that came in and call them a bad apple. They were a bad apple, unfortunately. And then they created another toxic employee. So even

48:37though that person was gone, now this next person was affected by this individual and became a little bit toxic in and of themselves, which then affected another person. And so this, this department specifically was dealing with turnover. Only this department though, nowhere else in the organization. And so finally the leaders were taken, were taken in and said, we need to be a lot more clear. And you need to also know that when there's a people connection and there's one bad apple affecting the next, that you have to somehow also protect your current team. If a bad apple comes

49:10about, right. Very basic idea. But when you have compliance, not only are you stopping people from rising in an organization that lack ethics, but you're also preventing people from staying in an organization. Yeah. Yeah. And spreading bad ideas about shortcuts and unethical approaches and everything. Yeah. I love that. Yeah. I, I would love to even just study or, or, or look at it and look into it of the, what the effect on say an individual employee is from a bad apple. And then the length

49:44of time it takes to kind of reconnect that employee to the organization. There's another circumstance I can think of with another organization recently. And, you know, they had a, an employee had a bad manager and then the employee. So, you know, manager automatically came in, um, at this organization and then the employee, um, actually was lied to, unfortunately, something that happened wasn't, wasn't reflected. And then the employee has had a sour taste in their mouth for about, you know, over six months now, almost a year. And this organization has taken so many efforts to connect

50:18with this person, but there was simply that bad taste in their mouth to this other non-ethical person had compliance issues. The person was let go because of compliance issues that ultimately the employee, it took, it's, it's taken eight months at least to get this individual back into feeling appreciated, feeling valued, feeling like this organization has integrity, right? What does that, um, timetable look like from when someone doesn't think that organization has integrity to when they do

50:49think the organization has integrity due to a singular person that have integrity? Yeah. It makes me think when I got into this field, I was employee number eight at a startup company that was kind of inventing the compliance training industry. And there was a guy who worked there who was the head of sales and he had lived in Alaska in the sixties. He and his wife had, you know, lived at some remote camp doing the hippie thing. And his job was to go hunt with the people during the day. And her job was there was this giant stew pot and he, her job was to stir the stew.

51:20And every day they brought back whatever they foraged and hunted and they put it in the stew. And what he said is when something that tasted bad went into the stew, it took a long time for the stew to stop tasting bad. And that's kind of what you're saying. Once people have that influence, it's hard to get it out of the culture. It takes time. Another great metaphor. It is. I really, I like that too. Yeah. It's, it's so interesting. I feel like sometimes my, the conversations I have with people just kind of all come together. I was talking to my insurance

51:52friend yesterday about, you know, or errors and omissions policies and how their culture at that insurance company is so different than other ones she's worked at. Just from a transparency perspective, you know, even if their clients don't love what they're sharing with them in their policy, that transparency is a part of their culture because they want them to know all the information they need to know to ensure they remain compliant with the laws, the regulations, all of it. And I just, so I was having a long conversation with her about that yesterday. And I, so I think it, it probably this compliance conversation applies in a lot of different ways

52:26and a lot of different areas. Yeah. And I really appreciate it. And I feel like you can't affect what to look at compliance no matter the action you're taking in an organization. Um, whether that be the employees, whether that be a process improvement, whether that be the installation of a new machine or, or the creation of a new product line or service line, right? You still have to look at compliance. It's not just what affects the internal organization, but it's what affects external. Like you talked about bribing Kirsten. Um, and so it's, it's external and internal compliance needs. And then on, not only are there federal regulations and then

52:59there's the, you know, obviously country-based regulations, but there's also state-based regulations in the United States. So there are so many layers to compliance, which makes it hard as an employer, as a, as an organization to make sure you check off all the boxes, unless you're a employer with all, with a say compliance department. And even then a compliance department, though they're meant to look at tomorrow's compliance needs, they might not have as good of an understanding as if you worked with a consultant. And then even then smaller organizations usually

53:34don't have the option what to work with a consultant simply because they won't have the capability to bring on a full-time compliance individual. Yeah. Yeah. Yeah. All that is exactly right. When companies are getting started in compliance, it's either an extra hat that someone in HR wears, or they bring in somebody from like my organization or a consulting to like staff fog, but yeah, it's, I don't know. Yeah. It was, it's hard to be in a position where you're standing this stuff up. You know, it's especially really hard too, is to be at a smaller organization in a

54:05very regulated field. Something that didn't exist as much 20 years ago, we're almost like startup pharmaceutical companies. People, they're, those companies used to make research and then sell it to Pfizer to bring to market Johnson and Johnson, Merck. But there's been a trend of institutional capital, private equity, typically funding drug developments to bring them to market. But you wind up with these 500 person, very fast growing pharmaceutical companies who have to follow all the rules and have the compliance program on a par with Merck, Johnson & Johnson, whatever. But they've

54:41got half a person and not as much budget and they're, and everything's moving fast. And so, yeah, compliance isn't easy. It's not for the faint of heart. It can feel very daunting for sure because there's everywhere you look, there's another rule. But it needs to be applied to your organizational strategy right off the bat. And, you know, it's funny you bring up some of those smaller pharmaceutical companies. I'm actually connected with a lot of them in the Massachusetts region because I work within the lean field as well. So lean methodology is the idea of, you know,

55:14trying to move things on the most productive standpoint, but also doing it in a way that is healthy for the individuals and healthy for the environment, keeps the environment safer. But not only in keeping the physical environment safer, it actually lean does connect to compliance because it identifies everything as almost to a T of what is specifically needed and what is not needed and what needs to be avoided. And so compliance does apply to lean methodologies and organizations too. A lot of those smaller pharmaceutical companies are involved in

55:47lean processes. And so I would argue that's how they get involved in compliance, but they still need an expert in compliance to help. They often do. It's true. Yeah, it's true. Yeah. Cause those that focus on lean don't always focus on compliance. Exactly. Right. And compliance is a whole body of knowledge to know. And sometimes they'll bring in somebody who worked at a bigger company to help them. Sometimes they've got somebody who's learning compliance as they go. And honestly, the best approach is to start and figure it out. But

56:20yeah, it's a, it's a big challenge. And a lot of the answer is not dissimilar to what you said about lean. It's priority setting, right? It's, it's looking out at that whole network of all the things you have to be compliant with, and then being ruthless to say what matters the most now. And then doing that and then figuring out the next thing. So. And with what matters the most, what's the financial impact and what do you need investment wise to, and to put into that? Yeah, exactly. Well, this is an awesome

56:56conversation. I, I'm wondering if we can do a part two. What do you guys think? Would you be up for that? Yeah, I'd be happy to. I think there's so much more we can dive into just on the people side and all of it. So I would love to do a part two, if you'd be up for that. Yeah, I'd be happy to. I love talking about this stuff. So yeah, it's so cool. And to your, to your point about the half person, I was the half person before. And I was like, I mean, I'm doing my best here, you know, but it was always and to Morgan's point about state by state. For me, I remember just saying,

57:32well, we operate in Illinois, we operate in Minnesota, we operate in Wisconsin, like all of them have very different rules. And so it was, well, what are we going to do? And it was a what's the most strict, we're going to just do that, you know, because I did. I mean, again, not my forte, I could have used someone like you in my life at that time. But I did the best I could. So thank you so much for being with us. I really appreciate it. This is a great, awesome conversation. Yeah, thank you. I really appreciated you guys having me on. And I look forward to continuing

58:05the conversation. Yeah. Yeah, thank you. Kirsten, is there anything that you want to, you know, if you want anything to resonate with our listeners, what would that be before we log on? I guess what I would say is, to the extent you work at companies, give some thought to the compliance program there. Sometimes people notice it. And sometimes people don't, right? Sometimes the only time they think about compliance is when they get their boring annual training, like, oh, God, my boring annual training. So but I think compliance is such an interesting part of a business,

58:41because if you're in any size of business, it is a department that has the ability to contact everyone in the organization, they have the ear of the CEO, and they report to the board. And most people don't think of compliance as that kind of important nerve center in the organization. So it's kind of hidden, I think, and invisible to a lot of people. So what I would say is, especially if people are listening to this podcast, they're interested in organizations, they're interested in organizational change, look at the compliance program around you and see what you can learn and notice about it.

59:18Well, thank you so much. We will have a part two with Kirsten. Another time, we'll let you know when that's coming, you listeners. But for today, this concludes another intriguing episode of Organizational Sherlock's. I'm Elizabeth Fleming. And I'm Morgan Ashworth reminding you that the journey to success is an ongoing investigation. Remember to stay curious, stay strategic, and keep utilizing insights to decode your business mysteries. Join us every Friday if you're next whodunit. This is Organizational

59:49Sherlock's closing today's case. We will see you next time.

1:00:03Thank you.