Corporate policies serve as a tangible manifestation of a business's core values and ethical standards. Rich John, adjunct professor at Cornell Law School, explains how a company’s rules and policies directly connect to what they value.
Corporate policies serve as a tangible manifestation of a business's core values and ethical standards, and these policies can help to cultivate a cohesive organizational culture that aligns with those values and standards. For instance, transparent communication policies can build trust within the workforce, encouraging open dialogue and collaborative problem solving. Company policies related to political and economic changes can highlight a company’s core values as well.
Join Rich John, adjunct professor at Cornell Law School, as he talks about how a company’s rules and the policies they implement have a direct connection to what they value. Professor John will also look at past precedent and discuss why more and more companies are defining their political stances in their employee handbooks.
The Cornell Keynotes podcast is brought to you by eCornell, which offers more than 200 online certificate programs to help professionals advance their careers and organizations. Learn more in our law and human resources programs, including the Compliance Systems certificate authored by Rich John.
Did you enjoy this episode of the Cornell Keynotes podcast? Watch the full Keynote.
Chris Wofford: Today on Cornell Keynotes, we look at company policy. Now, sure, we know this topic doesn't offer illicit excitement, but company policies are absolutely critical. They're how we communicate. They're how we set standards and actually embody our values. And after today's conversation, we hope you're able to view company policy through a fresh new lens.
In the episode, we look at how decision makers at high performing companies establish company rules and develop compliance systems, and most importantly, how they communicate them effectively. Our guest, Cornell Law Professor Richard John, does a very good job at giving us a new perspective on how to think about our company policies, how to infuse meaning and live our core values and ethical standards in a real, genuine, and meaningful way. This is good workplace culture. We also learn how company policies can help us endure challenges and overcome turmoil, and in the end, correct our course if we've lost it. There's lots of insight to be gained from this episode, so be sure to check out the episode notes to learn about Professor John's Compliance Systems Certificate Program from eCornell. Here’s the conversation with Richard John.
Nicholas Phillips: So what comes to mind when you hear the words compliance system? So for me, I think of just, you know, HR policy, but is that kind of pigeonholing it a little bit?
Richard John: It is. And I think a lot of people, when they hear compliance systems, they're just, they turn and run in the other direction, but compliance can mean a lot of different things.
And certainly, for some companies, compliance is what their specific compliance department does. For purposes of the class I teach, it's far broader than that. It's an examination of rule systems. Like, why do we have rules and where do they come from? How do you make them? And once you have rules, how do you make sure they're working?
And if they're not, what do you do? And so it entails all of that. And of course, we're going to be talking about, you know, values and culture today. But I find it really interesting how rule systems can sit next to values and culture and help or hurt. And, so yes, it's a broad approach. And one thing I'll just add is that I say in my course that it's pretty easy to make bad rules.
But a good rule system, a compliance system that is well-designed. It can do tremendous good work inside an organization, and that's kind of what I mean when I'm talking about compliance. I was trying to talk about the good ones. And you mentioned, you know, value systems a little bit, so, you know, what connection can we make between a company's, you know, compliance systems and the policies that they make and kind of how that can reflect what they actually value?
Richard John: Sure. You know, there's that old saying about how culture eats strategy for breakfast. Culture will eat rules for breakfast. That you, you want your rules to support your culture, but rules are going to follow culture, and if it comes to a head-to-head fight, The rules are going to lose, you know, that culture is incredibly powerful inside organizations, where compliance systems can make a difference.
And what I think we'll end up talking about is how when you have rule systems that are well-designed, they can reinforce your culture or help steer your culture in a direction you want to go.
Nicholas Phillips: And, you know, in what ways can some of these, you know, corporate policies really serve as a tool for, you know, promoting maybe some social responsibilities in line with a company's values.
Richard John: Lots of different ways. I mean, your rule systems serve a lot of different purposes, and one of the first things you want to do is figure out why. You know, what is your purpose behind your rules? And a lot of it is not value based. It's, say, risk management is a big factor in why you have rules, that any organization is trying to do something.
There's risks to that mission or the goals or whatever else. Rules can help control the risk, limit it, eliminate it in some cases, but rules can also be used to help set boundaries and set direction. And of course, if you're trying to establish and direct culture, you need boundary and direction.
So real systems are secondary, but they can really make a difference. Yeah.
Nicholas Phillips: And you know, what are some examples where, you know, corporate policy, corporate policy was kind of set and kind of aligned with a company's values. So for example, I'm thinking of you know, a couple organizations on Wall Street, you know, one of the policies they said was, you know, you have to go back into work five days a week and it's like, yeah, it would be, you know, nice to have them back in the office dealing with the money.
Are there examples or just kind of some that come to your head where it's like, wow, that was perfect for that organization or company?
Richard John: Well, that is a good one to talk about, I think, because we're right in the thick of companies struggling after post-pandemic with a lot of employees who say, no, I don't want to come back.
And for some businesses, that, the rules about remote work and in-person work aren't critical. Maybe, maybe you, you know, the things you’re doing, the goods or services you're producing or the mission of the organization are such that you don't have to be there. But say if a corporate value is team, you know, and, and trust that you need to know who you're working with and that you can rely on them.
And there's lots of, you know, you know, businesses where that's pretty, pretty critical. Remote work isn't just, it just isn't gonna work very well if you don't know the people. The good and the bad, the bad of them. Now, with that said, I think a lot of companies are finding a mix that, you know, they're coming to some compromise position on how much remote work is okay or in-person work is necessary.
And that the rules around that will support the values that the institution or the company is trying to achieve. And you know with that in mind, how often do you know the folks who, you know, kind of write the policy, take a step back and say, okay well, what is our company value first before we kind of write this policy out?
Richard John: I think that goes back to my comment that it's easy to write bad rules, right? That, if you just say okay, I think we need to do something and you develop some rules. Without doing the groundwork first of saying, what is the purpose, you know, where are we seeing issues like, is there a risk, for example, or is there a values goal?
Are we deficient in some way? You know, is there something we're trying to achieve that's critical to our organizational success? Then you start thinking about, can rules help? And sometimes rules can't really help. You know, sometimes it's just. You need something else. You know, you need somebody just enforcing it.
It's management, direct management. It's not rule systems. But sometimes rules can, as I said, set boundaries and give direction.
Nicholas Phillips: And with that, do you find that a lot of organizations with the risk factor are slow or kind of quick to react as far as kind of setting up some of their rule systems?
Richard John: Well, company to company. Some are going to be far better at it than others, you know. And that's, do you have effective, you know, responsive management?
That's the people. But if you're not reacting to the needs of the organization, you know, the business just isn't going to do as well. So yeah, you, you want to be constantly thinking about that. Are there rules that can help us get where we want to go? And you, you know, you got to be slow, you got to be thoughtful, but yeah, it's an ongoing process, or should be.
Nicholas Phillips: And you know, with that in mind, why do you think organizations are kind of slow to react to, just, kind of public opinion. So in general, so, for example some of the stuff going on, you know, politically and things like that and free speech. I feel like some organizations I see in the news, like, okay, you know, we're going to take a stance on, you know, kind of limiting free speech on social media. Others aren't. Why do you think there's that kind of delay?
Richard John: I think there's a few different reasons. One, organizations are generally, at least initially, inward facing, that they need to be organized, they need to work on their structure, and they're producing a good or service, they're doing something together and cooperatively, and that, that is an inward focus.
Trying to project that out into the, what does that mean in the greater context of the whole world, is not where they initially look, and I think the second issue is, it's really hard, tight? That, if you're trying to have your company react to everything that's going on in the world, what do you pay attention to?
You know, what are the critical things? And is there consensus within the organization on these external factors? And then, is there anything we can do about it? You know, in preparation for this interview, I went back and I watched the video of George Floyd. And this was the man who, for those who don't remember this, it was in the middle of the pandemic and he was basically killed on the street in Minneapolis by a few police officers restraining him.
Really painful, but that did something in our country that took an external factor and pushed it into lots and lots of organizations where they said, this is so awful, we need to do something about this. And it went directly to culture. And, you know, we're seeing a lot of questions now, and a lot of organizations, were the systems we set up, the rules we set up, were they the right things for our organization?
And some are terming that a backlash. And maybe it is, but to some extent, I think it's kind of natural that there was this visceral reaction to say, we need to react to what's happening in the world inside our organization. And a lot of things were done immediately because you want to act, you want to respond.
And, and I think there should be, or will naturally be a, sort of a response saying, did that work? Can we do it better? Can we do it differently? Can we do it less expensively? Always in a business.
But, you know, you look at that and that's a great example of where companies couldn't look away. You know, they want to focus on, we're making cars. Just go away. We're gonna make cars but at that time and place in our country, you couldn't, you just couldn't look away. It was just compelling. And, and I think there was good stuff that came out of that, but it also demonstrates, I think, just how hard reducing cultural values into a defined pathway and then reducing it to rules can really be a huge stretch.
Nicholas Phillips: And you know, you mentioned George Floyd and obviously, you know, the pandemic with it, but in general, how do some of these, you know, external factors maybe influence the way companies adapt their policies in line with their values? You know, obviously with those two major things, it's like companies acted very, very, very quickly. Is that often the case?
Richard John: No. That's a good joke. Usually, I mean, usually companies are pretty slow to react to, to change. The culture around them, because they're not designed to be very good at it, and trying to achieve consensus within your employee base, for example, can be really hard. And how much time and effort are you going to take away from your core functions to do something like that is an open question.
Just, it's really difficult. One of the companies I was just reading about in preparation for this interview is Disney. And they actually have integrated a lot of these principles of cultural values really well, and they have reached out, and you talk about trying to reach diverse audiences, and you think about it, it's really good business, you know, entertain everybody but the time and effort they've put into it, I think, puts them in a different category than a lot of other businesses who say, yeah, this is important, but here's, here's what we're supposed to be doing, and, and they don't.
I think Disney has the advantage that it helps them financially to really go after it.
Nicholas Phillips: And I just have a very, very quick question from Liz. So Liz submitted a question kind of along the lines of what we were talking about before with, you know, remote work and the folks in the financial industry.
She had said, is there any advice you might have for us remote leaders that will allow us to confirm productivity, but still show them we trust them? So there's a lot there.
Richard John: Yeah, I mean there's an essential contradiction. You know, if you're saying we trust you, it means we're not watching you. You can argue it that way, but of course a business can't function that way.
You have to know what your people are doing and you have to have some accountability. Striking the appropriate balance, I wish I had a great answer for that but you have to reach it. You know, and certainly one of the things we talk about in the compliance systems course is how do you police and, and policing being, all the work you do to figure out are the rules working?
Are we properly, you know, are people following the rules? And, and you can do it in a very open way and say, you know, we're going to, we're going to light up your camera on your computer and we want to see you sitting in front of your computer, right? That's a non-trust based system, but it's pretty, you know, you're there, you're there.
But there's also all sorts of elements of policing that are not apparent, you know, if you're doing, say contacts, at random times with your employees. You know, you say, well, that's a little manipulative, but you should be able to check in on a regular basis with your employees and they should be there.
You know, I heard recently that with remote work, there is a problem with people taking more than one job. You know, there, and you say, how could anybody ever do that? Well, remote work allows, you know, far more independent action and for some people that entails the temptation to do something really bad. So you do need to watch, but how you watch matters and you know, yeah.
Nicholas Phillips: It's definitely not an easy question.
And is there, I guess, a right way or a wrong way? So is it, you know, checking up on employees every once in a while or like, you said, you know, opening up their cameras to make sure they're working. Like is there a right way or a wrong way or does it kind of depend on the employer?
Richard John: I think it will depend on the employer and the type of work, you know, and, and as, as you indicate, there's lots of wrong ways.
I mean, if you're telling your employees you're going to watch them on camera all day, that's not going to create a work environment that anybody's going to be really happy with. And if one of your institutional values is trust, that probably isn't the way to get there. You know, you can certainly measure, use productivity measures, to figure out while they're sitting home, are they doing anything? You know, are you seeing work product and building a system that correlates to say, yeah, stuff is coming through the door from them that shows something's happening, that there's a pulse. But yeah, I think you have to, you have to design your system from that direction of doing it in a way that allows you to find out what they're doing without being real ham handed about it.
Nicholas Phillips: That's good to know, thank you. And Peter checked in with a question. Peter just wanted to know similarly about our conversation about corporate culture. Peter wanted to know when companies stress culture, I found that the only culture that thrives is a culture of leadership. What other company cultures have you seen that thrive? Can you talk about a culture of leadership? It’s very broad.
Richard John: Yeah, you know, and, and I should be able to jump in and use lots of buzzwords to talk about leadership, but I think that's a pretty vague concept. What is leadership? You know, basic management, you know, being responsive to your employees, demonstrating that you're going to put in the hours if you're asking them to, leading by example.
You know, those, I think, matter, but I, I, I worry that we get into some, some vague areas with a buzzword like that. But to give another example, say, if you want to, if you feel the company needs a value of respect, for example, well, that's great. You know, what does that mean? Well, how do you reduce that to rules?
You know, and frankly, if you have a boss who's a screamer and is just a tyrant, you can talk all day about, you know, that's one of those instances where your rules aren't going to do anything about that culture. But if you have an environment where you really can tweak the system, say you say, we're going to create ground rules for meetings.
You know, so that this is an opportunity to run a meeting well, but it also is a ground rule for treating each other with respect. That you show up on time, you know, you show up prepared, that it's clear what the agenda is, that there's somebody running the meeting. It's not a free for all, that people are given a chance to speak, that you don't, you know, interrupt, but you guide, and you don't let somebody take over the meeting.
And, you know, that you do it in a civil way. That if there's yelling or, you know, fighting in the meeting, that has to be responded to. And you set out those general rules. Here's how we're going to run a meeting, if you follow those rules and you enforce them, and you know, you're, it is your compliance system around those rules, you're going to have a respectful meeting. And you know, it is really that granular, inch by inch, way to build culture through rules and it can't do it by itself. As I said, if the boss doesn’t buy it, yeah, it seems like it has to be kind of from top down and everybody kind of, yeah, comes in with that.
Nicholas Phillips: Just very very quickly. I wanted to kind of touch on, you know, obviously, you know, just with culture now, everything is super, super heightened, especially with, you know, the election going on and just kind of, you know, political topics as it, as it is now. You know, how should corporations and companies think about, you know, the idea of, you know, free speech in the first amendment when, you know, setting up their policies?
So, we had mentioned, you know, before the interview, there was a law firm, I think in New York City that said they weren't going to hire anybody that protested or demonstrated or something like that. How should companies think about, okay, we want to, you know, support everybody's free speech, but at the same time, we want to have policies around that?
Richard John: Yeah. It's a very, very big time. Well, free speech rules, you know, they’re rules, right, about when can you say things and the constitution allows reasonable time, place, and manner restrictions on free speech, which makes sense. You know, the old adage about yelling fire in a crowded theater. But inside a company, you're allowed to have far more refined restrictions on speech that you don't want huge political arguments in your business.
You know, you don't want to tell people you can't have political opinions. You can't argue about them. And frankly, my view is that you benefit from having people with diverse views. We are, we still are a country. And despite our arguing with each other and really having a lot of anger right now, I think you're right we have to find a way to get along.
And if you're in a business or an organization that has a, you know, a common mission, which it is, that's what it's about, is doing something. You got to find your way through to accomplish that and if you're just saying let's have a free for all on free speech and let's argue all the time, you're not getting it where your work done, you know, so the business has to be able to strike a balance there. Say, I think it's perfectly appropriate for businesses to say, you can't put up flags in your office, you know, you, If you, you know, you can't be chanting. Yeah, but how far along do you go? Say, I think that law firm that said if you protested about Palestine, you know, we don't want you here.
I think that's just wrong because it's how did you protest, right? That, did you, you know, were you civil? Were you respectful of others? You know, were you, were you screaming? Were you just going on and on and on? Did you take over buildings? Whatever, whatever. That's in a different category than I disagree with you.
You know, we have to be able to disagree and companies have to find the balance to say, you can disagree, but when you're here, here's what we're doing together, and, and making rules around that. I know I'm being a little bit vague because I, I'm not designing those rules, but that's the work before you, if, if you're trying to figure that one out and, and none of it's easy.
Nicholas Phillips: Yes, very much so. And you know, this is my last policy question, I promise.
Richard John: No, have at it, have at it.
Nicholas Phillips: How do companies, maybe, update their policies or, you know, make small tweaks to their policies. So I'm thinking about drug testing for example. So a lot of states, obviously, have made marijuana legal. So how do companies, based in those states, maybe, update their policies or change their policies to reflect the kind of ever changing laws on the books? It seems like laws change constantly.
Richard John: Yeah, you're absolutely right. And well, a couple observations. One, I worked for a long time in a law firm and then I went in house. So I was the general counsel at a large commercial testing laboratory. And that was one of the things that struck me was, inside the business, how often things are deconstructed and put back together again. That this seems to be a constant process of re-evaluating and saying, okay, we did it this way last year, but now, you know, let's try something different and, and always trying to tweak and, and process to build it better.
And that's going to carry over into all your rule systems, too. More specifically, we had exactly that issue, because we had a laboratory in Colorado when they legalized marijuana. And the question arose, does this change our policy there? You know, and we had to evaluate that. Are we going to change our rules in response to the change in the law there?
And in looking at it, you know, we decided one company, across the country and across the world, we need, you know, a uniform system. And we also need to be able to move people lab to lab and as a laboratory, a commercial laboratory, you're selling reputation. The idea that anybody could be using marijuana and working in a lab was a non-starter, so it ended up being a fairly simple response for us, saying, same rules, same rules, keep them. But we did go through those steps.
Nicholas Phillips: With that in mind, how often should companies or do companies rather, you know, just make small tweaks to their policies? Should they do it? Not necessarily, you know, once a year, but should they, you know, kind of roll it out once a year? Take a step back, see if this is working, and then make tweaks? Or how often should they change, make tweaks or changes to policy?
Richard John: Well, they should. But more specifically, you absolutely want to be looking at your policies, your rule systems when you have an incident, because that's a signal, right? That's an indication, something happened, say you, you have a major violation of your rules. How did that happen? You know, did the people not understand?
Did they, you know, find a way to just skirt the rules? Were they easy to skirt? Was our policing system not adequate to understand that they weren't following the rules? Did we have appropriate investigative capacity? You know, all of those things should be questions you're asking when you have a major violation or an incident to say, can we do this better?
And again, this is what a nimble company, an effective company really should be doing. With that said, if you don't have a major incident, you still should probably be looking at your rule systems on some periodic basis. There's, every company has some policies that have been sitting on a shelf and have just gone completely out of date and aren't being followed.
And they just haven't looked at them. They haven't, you know, paid attention. It's probably, they haven't had a major incident. And, but the actual practices have migrated away from the rules or the policy and nobody's taken it up. If you're not paying attention to that and doing a periodic assessment, you really run the risk of, you know, saying, well, what?
Yeah, well, yeah, you get this huge divergence between what your rules say and what the practice is. And that, of course, has consequences within that specific rule systems. But it says a lot about the company itself.
Nicholas Phillips: So is it safe to say, even if there's not, you know, a major infraction or a major rule that's broken, that companies still should take a step back and say, okay, what are some ways we can tweak this or what are some ways we can change this?
Richard John: Absolutely. I mean, you can't be obsessed with it, but always, you know, periodically, yeah. You, you want to say faster, better, cheaper, you know, can we do this in a better way that is going to be less bureaucratic, for example, is going to allow the, the business around the rules to move faster, you know. If you're doing that, that's part of maintaining a well-designed rule system.
And that's the difference between it's easy to do bad rules. See.
Nicholas Phillips: I keep coming back. Well, definitely remember that one. And I just got a really great question in from John, but I wanted to ask this first. So, how can companies balance, you know, their motives to obviously make a profit with some of the ethical considerations when they're drafting and updating some of their corporate policies?
Richard John: Well, they have to balance them. And you know, I guess I could use another example of, I was talking about Disney earlier, where they've done a pretty good job in instituting, you know, diversity, equity, inclusion into their basic functions because it serves them really well. On the other hand, Google has gotten a lot of, sort of negative press attention, in that, they have stepped back from a lot of their initiatives, and they're refiguring them trying to figure out how to do them better.
And you and you look at the two companies and you say, okay, Disney, you know, In the entertainment field, it's very visible externally, and it matters. It helps them do their business. Google sells ads. You know, it's a, I mean, it's a web engine, but, or search browser, whatever, you know. Their principal business is they sell advertising.
That's how they make their money. And, it, it, it's really good to have a good workplace internal to Google, but there isn't this external pressure and it's not clear that people are going to stop using Google if it's not that great a place to work inside, you know, so the incentives there are going to be, and I don't know that much about Google or Disney, but just in general, I use them as examples that Google is going to have a much more difficult internal argument to say, we need to make sure this matters, you know, and, and it has to matter.
I mean, they can't just say it and then say, you know, it's, it's got to be built into their values somehow for the rules to work, to make a difference. Yeah.
Nicholas Phillips: And the follow-up to that was from John. So John just wanted to know, you know, what are some strategies to deal with high performers?
They're not necessarily following company values and cultures. So they're, you know, turning a great profit, but they're not necessarily following the values or rules.
Richard John: Yeah. This is sort of a backbone question for businesses because the temptation is to let them do what they're going to do. And if you're the CEO of a company and you see one of your stars really behaving poorly, it's a test of your character. What are you going to do about it? You know, one of the elements of compliance systems is, if you do not have support from the top, it's not gonna work, right? It is, you know, if the boss is the one screaming at the meetings and you can have all the ground rules you want, it doesn't matter, right? Because who's gonna tell the boss, hey, you're breaking the rules. You have to fall into line and maybe you can do that, but really, really hard. And if you have somebody egregiously breaking the rules and senior management is not stepping up and supporting the compliance function to say, no, that's too far, you know, we've got boundaries, you know, you, you have to live within them.
You're not going to address it. If you have strong leadership, there's that leadership question that support, understands the importance of compliance to setting boundaries and giving direction, yeah, they have to step on that person.
Nicholas Phillips: Absolutely.
Richard John: And I'm sure everybody listening has examples where that didn't happen at all.
Nicholas Phillips: Absolutely, absolutely and just real quick something that I thought about was, do we see a lot of times, especially with the, you know, stuff going on with DEI across the country, do we see a lot of times, kind of that waterfall effect of, you know, one major company sets up a policy and then, you know, it kind of continues on. Do we see that happen a lot?
Richard John: Well, certainly it happened with DEI and it happened pretty, you know, a lot of the elements of DEI have been here since the 1960s, since the equal employment opportunity laws, affirmative action laws, but they were really a legal compliance approach of saying, okay, the law says we have to do these things and we're going to comply with them.
You know, again, George Floyd did start a waterfall of saying, we need to do something cultural. And, you know, that's a much more difficult concept to say, yeah, okay. And I think that reducing that to rule systems, incredibly hard. Yeah.
Nicholas Phillips: Very true. Yeah, absolutely. And what role does leadership play when we're thinking about, you know, kind of compliance and, you know, corporate values?
So you mentioned like the CEO has, you know, maybe a VP or somebody who's a really, really good performer, but they may not necessarily be following the policies. What kind of role does leadership play when it comes to, you know, kind of drafting and changing some of our corporate policies?
Richard John: Well, leadership is focused in a lot of different areas, you know, and obviously, I just gave the example if leadership isn't on board with compliance, you know, no, but a lot of what leadership is really focused on at a lot of companies is, are the financial metrics.
Are we making money? And good for them, you know, that is critically important and, you know, that's often what the board is telling them is most important and they're going to go there, you know, it is something where, if cultural values support the mission or purpose of the business, yeah, then the leadership has to build the corporate values, you know, there is just a tremendous example with Paul O'Neill, you know, who is the Treasury Secretary back under George Bush, but also had been the CEO of Alcoa, and how he came in and Alcoa was struggling at that point. And he said, we're not worried about our finances right now. First thing we're going to do is health and safety. And we are going to focus there. We're going to make sure everybody in our company is safe.
You know, that we are doing our jobs in a way that, you go home, you know, uninjured. And the reaction to this was, well, that's not really what we're about. And he was, he was just laser focused on that. And the impact was, he said, well, he said some specific things. He said, we're going to get to zero injuries.
So he set a very clear, crazy goal. He said, I want to know about any workplace injury within 24 hours. And you need to tell me why it happened and how we're gonna fix it. And, and his, you know, he had managers who said, that's no, you know, and it goes, you're fired. And what happened was instituting that as the value that they were going to focus on, forced them to examine their business top to bottom.
And it involved everybody in the organization, you know, the person using a screwdriver had to have some idea of how do we do this safer? And it drove this bottom up examination of the business and it also forced their communication system. This is in the 90s. So email was, you know, not really a thing yet.
But it forced them to develop a communication system that was better than just about any company, you know, in the world, at that time. And it solved a lot of union issues, you know, it built trust with the day to day workers, and it was, it turned out to be immensely financially profitable, you know, and you look at that and you go, how did he know to do that?
But that is a wonderful example of a CEO who said, this value is going to change this company. And, and he, he beat it into place because it didn't exist there. You know, it was not a core value. It was, I mean, it was important, but it wasn't the maniacal focus that they brought to it. That's leadership. That's, that's meaningful leadership. It's not the fake stuff.
Nicholas Phillips: Very true. And I'd be interested to know, how should those folks writing, you know, kind of, some of the corporate policies think how those policies will affect people at each different level? So, you know, from your entry level employee to your CEO, C-Suite folks.
Richard John: Well, I mean, this isn't directly related to values, but a well-designed rule system is going to try to function without people even knowing that they're following the rules. That, you want to limit the bureaucracy, you know, how many forms do we really need to accomplish this? You know, how do we track it without, you know, putting the cameras on people at home? You know, how do we accomplish the goals in as effective a way as possible with the least impact on the core business? You know, if you have people stepping out of their normal role to satisfy some requirement of a rule system every 20 minutes, you know, that's not gonna work.
You want, you want efficiency. And, and there's generally ways to design a rule system to be less intrusive, less bureaucratic, and it takes a lot more work at the, at the front end, you know, and maybe some investment if it, if it's going to take some, you know, some coding or software off the shelf, you know, that you're going to buy a system that will allow you to follow, you know, institute the rules and let the business work at the same time.
Nicholas Phillips: Emily checks in with a very interesting question. So Emily just wanted to know any advice for how to shift a company's culture if coming in and seeing fundamental behaviors that need to be corrected, but are seeded in the existing culture. So how do we update company culture?
Richard John: Yeah, I mean, that's, again, rule systems can only do so much that, you know, there's a lot of, what's going to happen with driving culture change, like Paul O'Neill at Alcoa is a very strong person at the top saying, these are our new rules. So he, you know, you could have set up those rules without Paul O'Neill, nothing would have happened.
You need individuals, people matter. But you, you want to, you know, follow the, I don't have the graphic here with me, but the compliance circle that you design your system. And I'll go through, just briefly, that the first thing you need to know is the purpose or the reason behind your rules. And you want to be as clear as possible on that.
And frankly, I think with a lot of companies, when they said, we're going to do DEI and jumped in, they didn't have a common understanding of what that was. Or, you know, the people who are instituting the rules may have been way more ambitious than others in the company. You want to know, you know, here's what we're trying to do, and it's, it's got to be achievable.
But from there, you then say, can we write rules that track that purpose? And sometimes it's, you know, it, it isn't going to work very well. Not that you don't try. You know, if it's worth doing, it's worth doing badly, maybe, but once you get there, then you have to figure out your training program.
How do we explain these rules to the people that need to follow them? And you, and there's a lot of sales in that piece of the compliance circle, in that, if you're not explaining it right or you're not selling it, you're not explaining, tying it back to that purpose, how we're going to make a better company because we're going to follow these rules, you're not going to get uptake. And that, you know, you can't underestimate the importance of that training function if, when you're ready to go out. Once, once you have your rules up and running, then you need to police them. You know, and this is the biggest piece of the compliance circle, because it's all the time that you have your rules in place.
You need some ways of tracking that aren't too intrusive, too sort of, nasty, you know, to say, are people following these rules? You know, and, and then if you hear, you know, somebody's not following them, you need investigative capacity and that usually is the compliance officer can be, you know, using a broad term that could be HRm it could be IT. You know, somebody who is responsible for that rule system to come in and say, okay, what happened, you know, and do it quickly and thoroughly and get to a reasonable answer on, was there a violation? And then finally, you've got to do enforcement. You've got to say, yeah, there was a rule violation.
We need to meaningfully respond to it. We can't say this was a star performer so we're not going to do anything, where a lot of companies fall down. They get all the way there and then they go nah. You need to have enforcement that not only has some fairness about it, but appears fair to the organization that people are being treated in a reasonable way.
And then finally there's the assessment function, you know, that you do this periodic review, you know, maybe it's at the time you get the major incident and you say, you know, what happened? You need somebody thinking creatively about the rules to say, yeah, they, that didn't work. You know, we need to, you know, maybe we need to retrain or we need to rewrite or, boy, we did a crappy investigation, you know, but the whole circle has to be looked at to say, you know, where do we tweak or not? It worked great. Boy, are we smart. You know?
Nicholas Phillips: It seems like the process isn't finished after like a discipline hands out. Is that safe to say that, you know, even after discipline hands out there, you need that time to take a step back and reflect and see, okay, how can we make changes to maybe some of our systems?
Richard John: Sure, you know, and I used the word signal earlier that individual events are signals. They're giving you information. And as an organization, you can use that information or you can ignore it. But I'm saying, if you want an effective compliance system, you want to use that as a point to think about, saying, was that an isolated incident?
Was that just a jerk? You know, or is that somebody who's meant well, was in a situation where they didn't know what to do, you know, and they just made a mistake, or you know, you, you can just kind of go, we're busy. If, if these rules really matter, then you want to be doing that kind of thinking, and it doesn't have to be too elaborate, but some, some.
Nicholas Phillips: And just real quickly on the DEI topic. Do we see this happen a lot, where a lot of companies are quick to set up a policy and then a few years later, kind of scrap it? Or is it more along the lines of like they set up a policy and then tweak it a little bit?
Richard John: Yeah, you know, I've certainly read a lot of the critiques of what's happening right now with, you know, they use the word backlash and that, and there's, you know, this, the suspicion that this was all just fake, you know, that it was the thing to do a few years ago, but nobody really intended it or meant it.
And, and I like to think better of people. I think that the people in these businesses wanted to do the right thing. But at the same time, I think they're trying to analyze, what did we institute then, did it work? The challenge I see for these businesses is to say, do we just get rid of it? Or do we do the hard assessment and say, well, what worked? What didn't work? And move forward from there, you know, I, I have an example from here in Tompkins County, you know, on the legislature, there was a Governor's Executive Order saying, examine your criminal justice system, particularly policing.
And we went through a really elaborate process to say, we want to reimagine public safety. And in my mind, you know, the purpose. It was pretty straightforward, which was, we want to make sure that there's an understanding between law enforcement and the community that is served by law enforcement, that there's opportunity for discussion and communication, that we do things to build trust, and that's a pretty straightforward proposition, and I think that's not really controversial. But there were lots of other ideas about what the purpose was and to do things that were far more big, you know, and, and the temptation to do things big is understandable, but you kind of have to, I believe, go into this with some humility about what you're actually able to achieve.
And there's a lot of things you can do in, you know, as politicians making public statements, that reduce trust, that make people more upset. And, and some of that happened. And, you know, you look at the outcome three years in from when we started. How did we do? Well, we accomplished some really good things, say, transparency.
You know, are we now, we have all sorts of stuff on the internet, so you can go see what our district attorney is doing, what our jail statistics are, what our assigned counsel in a probation department you know, our sheriff, all sorts of information. That's been really good. We've had a lot of community discussion.
Have we solved the issue? No. But, you know, we've gotten to a point now we're saying, all right, let's really do some analysis of what worked, what didn't work. And, you know, is there, are there tweaks we can make to, to get to that next level? And, you know, I think we also maybe weren't very good at it, but some introspection about, what did we do that made it harder?
And I think businesses do that too, in that, when they're casting about trying to figure out what is the purpose right at the beginning, you know what, how do we set direction? If you don't take enough time to say, here's really what we're trying to achieve, you can get into lots of backwaters and you, you know, you get people angry. Anyway.
Nicholas Phillips: Very true. So I want to kind of shift gears a little bit. So we've been talking, you know, very, very broadly about policy and kind of how it collaborates with values. I'd be interested to know, you know, what should policy makers kind of keep in mind when drafting their rules with the idea that, you know, these are our company values.
How do we make these rules reflect that?
Richard John: Yeah, and again, going back to something I said early on, if, if your rules are really related to risk management, it's much easier, you know, because you, you see a specific problem, you know, this is the danger. These rules will help us try to control or limit that danger.
When you're talking about culture, you know, I use the word humility. You, you have to enter into this with the understanding that this is not easy. This is going to be, you know, it's going to take a lot of work. And I think you have to be open to comment. You know, the idea that you can do a cram down that you see an area of the company where there's a problem and you're going to institute new culture and drive it in.
You're just going to have a fight. You know, you are just going to have a very hard time. You can, you can, you can write some great rules. You know, if you don't get that consensus and do it early, it's questionable whether you'll ever get there. You know, and again, that's generally done in the purpose or goal stage, certainly rule writing, but then the training, you know, that that is the explanation to the business saying, here's our new boundaries, here's our new directions in these rules, you know, and, and it ties back to this cultural purpose. You know, do you want to go big? Paul O'Neill did, you know, but, but that was a risk management rule.
Nicholas Phillips: Yeah.
Richard John: Although it really did touch on safety culture and, and it worked in that case. It often is not that effective, but I'd say humility, you know, and, and proceeding in a very deliberate way.
Chris Wofford: Thanks for listening to Cornell Keynotes and check out the episode notes for more info on the Compliance Systems Certificate Program from eCornell. Thanks again for listening and subscribe to stay in touch.