The numerous new risks that companies face because of COVID-19 puts compliance teams in a new spotlight and will likely increase demand for their expertise from senior management and boards at their companies, according to compliance and legal experts.
Whether the issue is how to ensure the health and safety for employees returning to work, protecting the privacy of their health records or managing what many expect will be a deluge of internal whistleblower reports, compliance input will likely be sought from the highest levels of the organization.
“There is a tidal wave of issues coming that will present very unique compliance challenges,” said Rob Biskup, managing director at Deloitte Advisory. “You might look at this as an opportunity for compliance to enter their prime and gain a seat at the main table.”
Financial firms have already seen new risks emerging from the unprecedented distributions of billions of dollars in U.S. government aid to small businesses. Some of the largest U.S. banks already are reported to be facing lawsuits over their handling of the Paycheck Protection Program, a $350 billion fund aimed to shelter small businesses from the economic fallout of COVID-19. The suits allege that the banks prioritized applications based on the size of fees they would receive.
The potential reputational risks that flow from these missteps, not to mention the scrutiny banks will likely receive from congressional oversight committees created under the multi-trillion stimulus CARES Act legislation, point to the need for greater interaction between compliance and the board. But the risks also extend to those receiving government money or who are seeking to profit from the crisis through new business opportunities.
“You could say any company that is going to be borrowing money from or selling products to the federal government should be investing heavily in compliance,” added Biskup, who was previously chief compliance officer at the Ford Motor Company. “These are heightened risk areas for compliance that will necessarily provide increased interaction with the board and senior management.”
The implications extend across all companies and industries that are impacted by the health crisis, say experts, and point to the need for an independent voice that boards can rely on in assessing the risks and oversight of their management teams.
Eric Young, CEO of Young Enterprises LLC and former chief compliance officer at BNP Paribas, agreed. “The COVID-19 crisis has highlighted multiple, cross-industry issues including board-of-director governance, business continuity, vendor management, health and safety issues, as well as magnified the stress on regulatory compliance with laws and controls to manage potentially higher risks to cyber-crimes, fraud, and money laundering,” said Young.
“The crisis has actually put a spotlight on the independent compliance officer’s role relative to the board of directors’ oversight of these issues.”
Boards are in the “tunnel” of the health crisis
COVID-19 may be beyond the most dire risk scenarios many companies could have envisioned. According to a new analysis from McKinsey & Co., few boards “have a clear perspective on when and how their organizations will emerge from the tunnel the coronavirus pandemic has forced them to enter.”
“The light at its end is very dim,” the report continued. “Uncertainty is high for most sectors and businesses, with boards and management teams struggling to find solid ground, which makes it all the more vital that boards are deliberate about where they focus their attention.”
Based on recent conversations with the leading board chairs, McKinsey put forward three questions they should be asking:
- How can the board keep abreast of the management team’s crisis response without taxing executives’ already-packed agendas?
- What specific activities can board directors take on to augment management capacity?
- What should be the organization’s strategic posture for the post-crisis world, and how can boards encourage the management team to align its decisions with that strategy?
In Young’s view, boards should also question whether they have the enterprise risk and compliance skills to more ‘effectively challenge’ management’s actions or inactions.
With many companies having a high percentage of their staff working remotely, the challenge for compliance officers to monitor their activities has become more difficult. And in an environment where many companies will be forced to lay off staff, the pressure on performance will increase. The risk to cut corners or engage in unethical behavior increases.
Crisis will accelerate changes already underway
For some legal experts, the crisis will hasten risk-management changes already underway at many companies. “There is a new generation of operational risk that must be presented and addressed through the compliance program,” said Michael Peregrine, a partner at the law firm McDermott, Will & Emery.
Peregrine says boards will be inundated with urgent issues that require prioritization. In his view, for companies that have moved away from a silo-ed approach towards compliance, COVID-19 will accelerate the trend towards a structure where compliance is on a more equal footing with legal departments, for example.
The question will be how compliance aligns itself with legal to present a compelling picture of the risks the board now faces.
“You are just competing for the board’s attention when the board is drinking from a fire hose,” said Peregrine. “There always has to be a level of coordination between compliance and chief legal officers.”
As part of the identification of new issues, Peregrine recommend that chief compliance officers team with the general counsel. “Approaching these issues collectively is important.”