It is one thing for companies to have a compliance program that contains the policies, procedures, and controls needed to help prevent and detect misconduct (such as violations of anti-corruption laws like the US Foreign Corrupt Practices Act or the UK Bribery Act 2010). It is quite another to successfully create and maintain a culture of compliance that personnel at all levels of the company buy into. An important aspect of a compliance-oriented corporate culture is that individuals at the company feel comfortable asking questions and seeking information.

The US Department of Defense (DOD) calls this a “questioning attitude.” In September 2015, the DOD issued a strategy document on how it intended to foster a better cybersecurity culture in-house to protect the US against cyber threats. It explained,

A Questioning Attitude is empowered by knowledge. It means following warning signals to the source and using experience and level of knowledge to take action when there are indicators that something does not seem right. Its friend is mental discipline; its enemy is mental laziness. It means interpreting what we see—such as a suspicious e-mail or unusual . . . behavior—rather than just accepting it. It is checking our work, remaining alert, and never being satisfied with an answer that is anything less than rigorously analyzed.

Imagine how many compliance infractions could be avoided if more employees adopted this outlook.

But it is not always easy to seek advice. Here are a few ways compliance officers and other corporate leaders can encourage personnel to seek advice before issues arise.

First, acknowledge that no one has all the answers. We have previously discussed the importance of leading by example in terms of complying with company policies and procedures. But what about leaders asking the tough questions that need to be asked? When a local employee sees that her manager is not ashamed to ask the chief compliance officer (CCO) a question, or when a local manager sees that the CCO is not ashamed to say, “I don’t know – Let me do some research (or ask our lawyer) and get back to you,” these employees will also be less hesitant to ask their questions. CCOs, GCs, CEOs, and other corporate leaders are not omniscient. Creating a culture of compliance does not mean knowing all the answers; it includes being willing to look for and come back with answers to the tough questions.

Second, make asking questions easy. Many companies invest in compliance hotlines or other confidential systems for asking questions and raising concerns. But do not forget the personal touch – employees feeling comfortable picking up the phone to talk to a supervisor or compliance officer. When managers and compliance officers are aloof, distant, or simply not present, this hurts not only the ability of employees to obtain needed guidance, but also the ability of company leaders to understand what is happening on the ground. Good leaders will interact regularly (and in a friendly manner) with employees at all levels of the organization. As we noted last week, participating in on-site training sessions is a way compliance officers can build relationships of trust with company personnel and learn about the issues they face.

Third, respond appropriately. Individuals are more likely to ask questions if they feel doing so will lead to a positive result, that is, serious consideration of their request and some form of action. Responding appropriately to questions about compliance includes four components:

1. Respect for the individual. If employees feel like their questions will be scoffed at or won’t be taken seriously, they won’t ask. As the saying goes, “There are no dumb questions.” This is certainly the case in the world of compliance, which often involves complex legal and regulatory frameworks, along with the nuts and bolts of a particular company’s compliance program.
2. A complete answer to the question. The “rules” that make up a compliance program may not be as intuitive to certain individuals as they are to the compliance team. In addition, it is easier to buy into a rule you understand. So take the time to respond professionally and in an understandable manner to questions, however simple they may be.
3. Appropriate follow-up. If concerns requiring further investigation are raised, take the time to look into them and (if appropriate) let the person who came to you in the first place know the outcome, to the extent possible.
4. Protection of confidences. Individuals should feel safe raising issues of concern. This may mean allowing for confidential reporting, if possible. Protection from retaliatory action is paramount, of course, for a variety of legal and business reasons.

When personnel at a company have a questioning attitude, they are more likely to slow down, take notice, and carefully consider the facts before them. By asking the questions that need to be asked, they can help support a culture of compliance.