How to change your corporate DNA
Tone at the tops
It is easy to say beautiful things (e.g., Compliance Policy, CSR Policy) but is very difficult to make it your corporate DNA. Unless you create "performance with integrity culture," it will not be. Everything starts from the tone at the tops. What matters is not what CEO thinks, but what employees think the CEO believes. They judge from CEO's behavior, not just from CEO's cold statements shown in your company intranet. The CEO and senior leaders of each business sections must lead by example. Leaders behavior is the best message to cascade down to the bottom where an employee, often in remote sites, may first recognize some irregularity (i.e., integrity concern).
Create a culture where people can raise a concern with no fear of retaliation
If an employee can raise a concern with no fear of retaliation, you will have an opportunity to investigate and fix any gap at a very early stage before the potential problem gets big. This is the best way to maintain your corporate integrity. Creating this culture of concern reporting with no fear of retaliation is a must. A global concern reporting system (employee hotline run by a third party service provider) that would allow them to raise any concern anonymously if they wish is also a must. Any supervisors, managers or executives (even CEO) who attempted to retaliate against any concern raising in good faith must be asked to leave the company as such a person would destroy this primary culture.
Be prepared for receiving 1.4 concerns per 100 employees per year. This figure is a median among 13,000 companies (see, 2018 Ethics & Compliance Hotline and Incident Management Benchmark Report available at navexglobal.com). If this figure is less than 0.3 (concerns per 100 employees per year), you should be scared because you are beyond the central 80% of such companies. You are not listening to your employees' concerns, and you will not recognize your problem until it becomes significant. No organization is perfect. Everybody makes mistakes. The differences are you fix it now, or wait until it gets big and comes to your attention.
Be ready for receiving 1.4 concerns per 100 employees per year, around 70% maybe HR-related (e.g., equal employment opportunity), and 45% of the cases will be substantiated, according to the NAVEX report cited above. Realize you receive such volume of integrity concerns, investigate, put remedial actions, discipline the implicated persons, send feedback to the reporter, and close the case within a reasonable period (say, 30 days). If you do not, your employee will not trust your system, and become silent, or go somewhere else (e.g., SNS, or media). The investigation must be done based on investigation policies and procedures carefully made by your external legal counsel (otherwise, the outside world will think your report may be biased, and you are still hiding something). HR person can investigate a significant part of them, but you have to train them how to conduct an investigation. You will have to retain an external law/audit firm to investigate a severe matter (e.g., bribery, account fraud).
Focused, Effective Communication and Training
We see many Japanese big brands' significant compliance misses in recent years (e.g., data falsification). They all have well-drafted compliance policies and presumably good record of employee training. What they do not is one or more of the above (tone at the tops, culture, and resources). Also, they need tailored training and communication for specific categories of executives and employees depending on the risk factor their job may involve. People would not learn much from computer-based training where they tend to try to click on icons as fast as possible to finish. Face to face, fun workshops are always preferred. Be creative using manga, video, etc. Two-way communication starting from the bottom (bottom-up session) is also very useful to kill two birds in one stone - identifying risks and conducting training. Please see "A hypothetical company's website" that tries to address these issues.