European Compliance Programmes: Five Data-Driven Insights for 2021

It’s no secret that Euro­pean organ­i­sa­tions must adhere to strict rules and reg­u­la­tions when it comes to key ethics and com­pli­ance issues such as anti-cor­rup­tion, data pri­va­cy, and risk man­age­ment.

Yet, cer­tain com­pli­ance risks will be more preva­lent for Euro­pean oper­a­tions than in oth­er regions. Pro­gramme man­agers must be aware of such risks and the threats they pose to the busi­ness in order to ensure they are not over­looked. Tai­lor­ing your ethics and com­pli­ance pro­gramme to the organisation’s unique risk pro­file will help mit­i­gate such risks.

Based on insights from pri­ma­ry research under­tak­en by NAVEX Glob­al, who ques­tioned 130 ethics and com­pli­ance pro­fes­sion­als in Europe, here are five essen­tial pro­gramme insights that Euro­pean busi­ness­es need to be aware of in 2021:

1) Focus on the key compliance concerns

No organ­i­sa­tion has unlim­it­ed resources to erad­i­cate every poten­tial risk it faces, but reg­u­la­tors still expect you to pro­tect against the biggest risks – no mat­ter how small your busi­ness is.

Data pri­va­cy, cyber secu­ri­ty and GDPR have shot to the top of the list of com­pli­ance con­cerns, both in Europe and world­wide, in recent years. Major data breach­es at Euro­pean-based busi­ness­es have gen­er­at­ed news head­lines and height­ened aware­ness across the globe. 

Research con­duct­ed by law firm DLA Piper in 2020 high­lights that since the intro­duc­tion of GDPR more than 160,000 data breach­es have been report­ed across the EU. At the time of writ­ing, 481 fines and penal­ties have been imposed under the reg­u­la­tion cost­ing Euro­pean firms €273m.

Dr. Tobias Sche­lin­s­ki, part­ner at glob­al law firm Tay­lor Wess­ing, adds that, “in the Euro­pean Union, we will see many more con­sumers mak­ing use of their data pro­tec­tion rights grant­ed under the GDPR and local data pro­tec­tion laws. This will include an increase in dam­age com­pen­sa­tion claims. You could say that pri­va­cy law will be the new con­sumer pro­tec­tion law.”

With the mass shift to home work­ing trig­gered by the coro­n­avirus pan­dem­ic, and the like­ly poor cyber hygiene of staff using devices away from the office, the risks of a data breach, and the mis­use of per­son­al infor­ma­tion, will only increase in 2021.

Anoth­er key area of con­cern for Euro­pean com­pli­ance pro­fes­sion­als is abid­ing by anti-bribery and cor­rup­tion (ABC) leg­is­la­tion. Despite the EU sit­ting atop Trans­paren­cy International’s Cor­rup­tion Per­cep­tions Index, there is a long-held scep­ti­cism towards the effi­ca­cy of exist­ing anti-cor­rup­tion poli­cies among Euro­peans, with 71 per cent of indi­vid­u­als believ­ing that cor­rup­tion is already present in nation­al insti­tu­tions, accord­ing to the lat­est Euro­barom­e­ter report on cor­rup­tion. Fur­ther con­cerns are root­ed in a lack of trans­paren­cy around both the expen­di­ture of pub­lic mon­ey and the close rela­tion­ship between busi­ness and pol­i­tics.

Our research also high­lights that Euro­pean organ­i­sa­tions need to place a greater empha­sis on mit­i­gat­ing harass­ment and dis­crim­i­na­tion risks. Too few are acknowl­edg­ing that these risks exiswith­in the work­place — espe­cial­ly com­pared to North Amer­i­can busi­ness­es – despite a 2019 report by the French Insti­tute for Pub­lic Opin­ion (IFOP) that found 60 per cent of Euro­pean women had expe­ri­enced work­place sex­u­al harass­ment or vio­lence. 

Addi­tion­al insights from NAVEX Global’s annu­al whistle­blow­ing report also shows that there is a high­er per­cent­age of whistle­blow­er reports cat­e­gorised as harass­ment and dis­crim­i­na­tion at Euro­pean organ­i­sa­tions than in US organ­i­sa­tions. Clear­ly, harass­ment and dis­crim­i­na­tion is a com­pli­ance gap that Euro­pean firms need to act upon.

Many firms are help­ing to address such con­cerns through employ­ee train­ing. In Europe, Navex Global’s research shows that the four most com­mon com­pli­ance train­ing top­ics are data pri­va­cy (83 per cent), bribery and cor­rup­tion (79 per cent), con­flicts of inter­est (70 per cent) and cyber­se­cu­ri­ty (69 per cent). How­ev­er, key train­ing gaps remain, such as sex­u­al harass­ment (54 per cent), dis­crim­i­na­tion (53 per cent) and diver­si­ty and inclu­sion (49 per cent).

2) Use employee feedback to identify gaps

Busi­ness lead­ers should keep in mind that the end-users of an ethics and com­pli­ance pro­gramme are their employ­ees. Gath­er­ing employ­ee feed­back is cru­cial for an effec­tive pro­gramme. Per­cep­tions of man­age­ment may be a nice-to-have, but it is the employ­ee view that offers the best insight into the effi­ca­cy of the programme’s activ­i­ties. Yet there seems to be a dis­con­nect between employ­ees and man­age­ment when it comes to the per­cep­tion of com­pli­ance pro­grammes.

While 50 per cent of Euro­pean man­agers see their risk and com­pli­ance pro­gramme as a strate­gic invest­ment, only 28 per cent of employ­ees feel the same. In fact, a third of employ­ees say they view com­pli­ance as ‘a nec­es­sary evil required by the reg­u­la­tors’. There­fore, it is cru­cial to gath­er and act upon employ­ee feed­back to ensure the pro­gramme serves them cor­rect­ly and deliv­ers activ­i­ties that best fos­ter a more eth­i­cal and com­pli­ant cul­ture. 

It is one of the rea­sons why the upcom­ing EU Whistle­blow­er Direc­tive, which will be intro­duced in Decem­ber 2021, should be wel­comed – because whistle­blow­ing reports are arguably the best form of employ­ee feed­back and com­pli­ance infor­ma­tion. This pri­ma­ry data is invalu­able to dri­ve trans­paren­cy, expose poten­tial issues before they become crit­i­cal, and pro­vide real time insights into the effec­tive­ness of the com­pli­ance pro­gramme.

“It is in the inter­ests [of busi­ness lead­ers] to know whether any­thing bad is hap­pen­ing with­in their com­pa­ny, and encour­age whistle­blow­ers to engage with them,” says Jan Tadeusz Stap­pers, senior man­ag­er of part­ner­ships at NAVEX Glob­al. 

Yet Europe has the low­est num­ber of whistle­blow­ing reports sub­mit­ted per employ­ee – on aver­age in 2019 five whistle­blow­ing reports were made for every 1,000 employ­ees at Euro­pean organ­i­sa­tions, com­pared with 15 reports per 1,000 employ­ees from North Amer­i­can organ­i­sa­tions¹. Com­pli­ance pro­grammes in Europe must work hard­er than for oth­er regions to encour­age employ­ees to speak up about their con­cerns.

Look to estab­lish mech­a­nisms to cap­ture employ­ee feed­back in your pro­gramme. But not only from whistle­blow­ing reports. Exit inter­views and cul­ture sur­veys can also help you gain the insight of your employ­ees and bet­ter under­stand what gaps — or inef­fi­cien­cies — you may have.

3) Embrace the role of the audit and risk functions

Risk assess­ments are cru­cial to devel­op­ing any com­pli­ance plan, espe­cial­ly in Europe, where sup­ply chains are more com­plex and trad­ing across mul­ti­ple juris­dic­tions is com­mon. As such, it’s no sur­prise that NAVEX Global’s research finds that 82 per cent of Euro­pean organ­i­sa­tions are pri­ori­tis­ing com­pli­ance risk assess­ments as part of their pro­gramme. Exec­u­tive teams are increas­ing­ly ask­ing for a more holis­tic approach to com­pli­ance analy­sis and report­ing to bet­ter under­stand where the risks lie across the busi­ness. For larg­er firms, the com­pli­ance func­tion should form close part­ner­ships and col­lab­o­rate with audit and risk teams while also lever­ag­ing the input of inter­nal risk experts and stake­hold­ers. For small­er busi­ness­es, learn­ing how to under­take reg­u­lar ethics and com­pli­ance risk assess­ments is key to devel­op­ing an effec­tive pro­gramme.

In addi­tion, as a func­tion that has a com­pre­hen­sive view of an organ­i­sa­tion, inter­nal audits can play a cru­cial role in eval­u­at­ing com­pli­ance. With an urgent need to ensure com­pli­ance activ­i­ty keeps pace with cur­rent reg­u­la­tions — and with so many reg­u­la­to­ry ter­ri­to­ries to deal with in Europe – audit­ing the com­pli­ance func­tion can be a big­ger chal­lenge in Europe than else­where. 

They can go fur­ther too. This is par­tic­u­lar­ly impor­tant for Euro­pean organ­i­sa­tions, where the com­pli­ance audit should also review exter­nal risks to ensure the appro­pri­ate due dili­gence is being applied through­out the organisation’s sup­ply chain.

4) Establish a proactive approach to policy management

Our research shows a major­i­ty (93 per cent) of Euro­pean organ­i­sa­tions focus their pro­gramme on reg­u­la­to­ry com­pli­ance and base their deci­sions around not falling foul of relat­ed laws. Yet NAVEX Global’s find­ings sug­gest Euro­pean organ­i­sa­tions are those most like­ly to fall short in both dis­trib­ut­ing risk and com­pli­ance poli­cies and pro­vid­ing ade­quate pol­i­cy train­ing – with­out which firms will strug­gle to devel­op a pro­gramme that ade­quate­ly pro­tects against reg­u­la­to­ry risks. 

Giv­en the com­plex reg­u­la­to­ry land­scape in Europe, pol­i­cy man­age­ment, and the cus­tomi­sa­tion and com­mu­ni­ca­tion of poli­cies across regions and lan­guages, can be chal­leng­ing and is often a com­pli­ance gap. It may be worth­while in cer­tain cir­cum­stances for Euro­pean organ­i­sa­tions to sim­pli­fy such com­plex­i­ty by default­ing to the strictest ver­sion of a par­tic­u­lar reg­u­la­tion, or com­pa­ny pol­i­cy, and adher­ing to that inter­pre­ta­tion glob­al­ly.

Proac­tive­ly review­ing poli­cies rather than wait­ing for changes to hap­pen, and ensur­ing eas­i­er access to up-to-date poli­cies for employ­ees – anoth­er area Euro­pean com­pa­nies can strug­gle with — not only makes it eas­i­er to stay on the right side of new leg­is­la­tion but can pro­vide a strong legal defence for poten­tial inves­ti­ga­tions when non-com­pli­ance does occur.

How­ev­er, sim­ply devel­op­ing your pro­gramme as an insur­ance pol­i­cy against reg­u­la­to­ry infrac­tions may not be enough in the long-term. Pro­gres­sive organ­i­sa­tions must look beyond com­pli­ance reg­u­la­tions. This requires a mind­set shift from busi­ness lead­ers who need to refo­cus on build­ing a val­ue-based pro­gramme strat­e­gy that will improve employ­ee cul­ture and behav­iour. Doing so, and embed­ding an eth­i­cal cul­ture, will make employ­ees more like­ly to do the right thing and make the right deci­sions in any giv­en sit­u­a­tion.

5) Protect against reputational risks

Trust takes years to build, sec­onds to break, and for­ev­er to repair. Organ­i­sa­tions fined for fail­ing to com­ply with reg­u­la­tions will con­firm that a tar­nished rep­u­ta­tion can be more cost­ly to an organisation’s bot­tom line than most finan­cial penal­ties. Accord­ing to the Volkov Law Group, organ­i­sa­tions typ­i­cal­ly under­es­ti­mate the long-term impact of rep­u­ta­tion­al dam­age, which on aver­age costs the com­pa­ny more than four times the reg­u­la­to­ry fine imposed.  

A rig­or­ous ethics and com­pli­ance pro­gramme can help to pro­tect your com­pa­ny rep­u­ta­tion against inap­pro­pri­ate employ­ee behav­iour. Estab­lish­ing a clear Code of Con­duct with your employ­ees and stake­hold­ers, and keep­ing it fresh and rel­e­vant, helps to define the eth­i­cal val­ues that your employ­ees are being asked to live and breathe on a dai­ly basis. How­ev­er, only 42% of Euro­pean organ­i­sa­tions stat­ed that they plan to update their Code of Con­duct over the next 12 months.

Our research sug­gests there is still fur­ther work to be done. Employ­ees in this region report less con­fi­dence in the eth­i­cal val­ues of their com­pa­ny com­pared to else­where – only 1‑in‑4 Euro­pean employ­ees say their busi­ness is com­pli­ant ‘all of the time’ com­pared to 38 per cent of employ­ees in North Amer­i­ca. Com­pli­ance lead­ers must ensure that the com­pli­ance pro­gramme fos­ters eth­i­cal behav­iour through­out the organ­i­sa­tion 24/7/365. Being eth­i­cal ‘some of the time’ sim­ply doesn’t cut it – it takes only one mis­take or bad deci­sion to ruin the rep­u­ta­tion of a com­pa­ny. 

Conclusion

Ulti­mate­ly, every organ­i­sa­tion needs an ethics and com­pli­ance pro­gramme – and any such pro­gramme must be tai­lored towards the spe­cif­ic risks of the busi­ness. Firms should also pay atten­tion to what oth­ers are doing with­in their region. Bench­mark­ing can help to shape and under­pin the programme’s goals.

To be effec­tive, exec­u­tive lead­er­ship teams must play an active role, not just to improve board over­sight of the pro­gramme, but to estab­lish a top-down cul­ture of engage­ment among employ­ees, and to align and dri­ve the objec­tives of the pro­gramme with the objec­tives of the busi­ness. 

“Healthy com­pli­ance prac­tices are good for busi­ness,” points out Dyann Heward-Mills, Chief Exec­u­tive and Founder of UK-based data pro­tec­tion con­sul­tants Heward­Mills. “You need to empow­er peo­ple. Hav­ing ethics and com­pli­ance cham­pi­ons in a busi­ness attracts not only cus­tomers and bet­ter employ­ees, but it also, in turn, attracts investors and facil­i­tates inno­va­tion.”

Down­load NAVEX Global’s com­pre­hen­sive guide to learn every­thing you need to design and devel­op an effec­tive ethics and com­pli­ance pro­gramme — from gain­ing board buy-in, to plan­ning and imple­ment­ing your activ­i­ties.

---