5/7/2018 9:29:00 AM
Start with asking why
We’ve all heard the saying, “To err is human.” It is true that we all make mistakes, but it is also true that environmental situations, poor procedures, and systems can fail people. We all need to be careful about jumping to conclusions or being too hasty to fix an issue without having all the facts, and refrain from seeking to blame someone. Instead, we should seek to understand why an incident occurred.
Uncovering root causes of misconduct and incidents of non-compliance helps eliminate patterns of wrongdoing that may harm our customers or coworkers and helps us avoid placing the organization’s mission and reputation at risk. Additionally, finding the cause (also known as root cause analysis) helps demonstrate that an organization has an effective Compliance and Ethics program.
Recently, the U.S. Department of Justice (DOJ), Criminal Division Fraud Section, published a document outlining topics and sample questions that companies should consider when addressing misconduct and non-compliance (https://www.justice.gov/criminal-fraud/page/file/937501/download). The Fraud Section has frequently found these topics and questions relevant in evaluating a corporate compliance program. One of the areas addressed is how and why a root cause analysis (RCA) is used, whether systemic issues were found, who was involved in the RCA, and what changes were made to reduce the chance of similar risks from occurring in the future. Many other oversight entities have published guidance regarding RCAs strategies that organizations can easily adopt. RCAs are often reserved for more serious incidents, and organizations have to determine what those thresholds are.
Part of the process is forming an RCA team that includes subject-matter experts, people who are affected by the incident, and leaders to ensure there are no barriers to successfully finding out what went wrong. The RCA team members collect and evaluate data and conduct interviews to help understand the events that lead to the incident. Ground rules are essential to help set aside bias and egos and create a safe environment for everyone to be honest and have an equal voice. One method used to find the cause is called the “Five Whys.” The idea of the “Five Whys” is to ask a question and each response helps form the next “why” question. This process is repeated unit the root cause, or causes, are identified. Then they can look for opportunities to make corrective actions.
Although many of us may not have the opportunity to participate in the RCA process, we all have a part in remaining knowledgeable about the requirements we need to meet, identifying the risks, taking precautions, and promptly reporting errors or concerns that may lead to non-compliance. Early detection and response is important to ensure timely correction of the situation. Speaking up and reporting demonstrates our commitment to doing the right thing, even when it’s difficult because we are embarrassed or afraid. Reporting demonstrates our integrity and commitment to keeping customers and coworkers safe and protecting the organization’s reputation and mission. If we see something, we need to say something.
Deann M. Baker, CHC, CCEP, CHRC
a compliance and ethics newsletter from the Society of Corporate Compliance & Ethics
ISSUE 25, April, 2018