Compliance Archives - Columbia Law Review

Introduction Despite the best efforts of governments, regulators, prosecutors, private stakeholders, and academics to identify effective mechanisms for organizations to employ in an effort to prevent and deter improper conduct within their ranks, misconduct continues to persist within organizations of all types. Fake bank accounts. Faulty ignition switches. Sexual harassment. Protection of predators. Over and over again, the public learns of widespread and significant misconduct plaguing organizations that millions of individuals rely upon on a daily basis. Most troubling, however, is that the breadth and depth of many of these scandals were entirely avoidable. For example, in 2016, Wells Fargo announced that it had entered into an agreement to pay “a combined $185 million penalty to the Consumer Financial Protection Bureau . . . , the Office of the Comptroller of the Currency, and the City and County of Los Angeles to settle charges” without admitting formal wrongdoing that it fraudulently opened accounts on behalf of customers without their knowledge.[footnote]Bethany McLean, How Wells Fargo’s Cutthroat Corporate Culture Allegedly Drove Bankers to Fraud, Vanity Fair (May 31, 2017), https://www.vanityfair.com/news/2017/05/wells-fargo-corporate-culture-fraud [https://perma.cc/6G23-MNAZ].[/footnote] The initial settlement, however, was just the beginning of difficulties for the bank, and it has now entered into multiple settlements with the DOJ,[footnote]E.g., Press Release, DOJ, Justice Department Obtains $5.4 Million in Additional Relief to Compensate Servicemembers for Unlawful Repossessions by Wells Fargo Dealer Services (Nov. 14, 2017), https://www.justice.gov/opa/pr/justice-department-obtains-54-million-additional-relief-compensate-servicemembers-unlawful [https://perma.cc/MX78-FR6Y]; Press Release, DOJ, Justice Department Reaches $4 Million Settlement with Wells Fargo Dealer Services for Illegally Repossessing Servicemembers’ Cars (Sept. 29, 2016), https://www.justice.gov/opa/pr/justice-department-reaches-4-million-settlement-wells-fargo-dealer-services-illegally [https://perma.cc/C4AY-TP2V]; Press Release, DOJ, Wells Fargo Bank Agrees to Pay $1.2 Billion for Improper Mortgage Lending Practices (Apr. 8, 2016), https://www.justice.gov/opa/pr/wells-fargo-bank-agrees-pay-12-billion-improper-mortgage-lending-practices [https://perma.cc/CVZ6-TUNB].[/footnote] the SEC,[footnote]E.g., Order Approving Plan of Distribution, Exchange Act Release No. 80,302, 116 SEC Docket 1642 (Mar. 23, 2017); Order Instituting Administrative Cease-and-Desist Proceedings, Securities Act Release No. 9349, Exchange Act Release No. 67,649, Investment Company Act Release No. 30,167, 104 SEC Docket 1445 (Aug. 14, 2012); Press Release, SEC, Wells Fargo Advisors Admits Failing to Maintain Controls and Producing Altered Document, Agrees to Pay $5 Million Penalty (Sept. 22, 2014), https://www.sec.gov/news/press-release/2014-207 [https://perma.cc/6BBA-SEZQ].[/footnote] and the Federal Reserve,[footnote]E.g., Written Agreement Between Wells Fargo & Company and Board of Governors of the Federal Reserve System, Docket No. 18-007-B-HC (Feb. 2, 2018); Wells Fargo & Co., Wells Fargo Update: Federal Reserve Consent Order 1 (2018), https://mms.businesswire.com/media/20180202005711/en/638742/1/3837099cWells_Fargo_Consent_Order_en.pdf [https://perma.cc/XDP8-3ZEJ]; Press Release, Bd. of Governors of the Fed. Reserve Sys., Responding to Widespread Consumer Abuses and Compliance Breakdowns by Wells Fargo, Federal Reserve Restricts Wells’ Growth Until Firm Improves Governance and Controls. Concurrent with Fed Action, Wells to Replace Three Directors by April, One by Year End (Feb. 2, 2018), https://www.federalreserve.gov/newsevents/pressreleases/enforcement20180202a.htm [https://perma.cc/34LR-G72W] [hereinafter Fed. Reserve Wells Fargo Press Release].[/footnote] among others.[footnote]See, e.g., Emily Flitter, Wells Fargo Agrees to Settle Auto Insurance Suit for $386 Million, N.Y. Times (June 7, 2019), https://www.nytimes.com/2019/06/07/business/wells-fargo-auto-insurance-lawsuit-settlement.html (on file with the Columbia Law Review ); Imani Moise, Wells Fargo to Pay $575 Million in Settlement with U.S. States, Reuters (Dec. 28, 2018), https://www.reuters.com/article/us-wells-fargo-settlement/wells-fargo-to-pay-575-million-in-settlement-with-u-s-states-idUSKCN1OR19Q [https://perma.cc/8P9V-HL47]; Jonathan Stempel & Dena Aubin, Wells Fargo Officials Enter $240 Million Settlement over Bogus Accounts, Reuters (Mar. 1, 2019), https://www.reuters.com/article/us-wells-fargo-settlement/wells-fargo-officials-enter-240-million-settlement-over-bogus-accounts-idUSKCN1QI4P3 [https://perma.cc/LUA3-KAKW].[/footnote] In addition to actions brought by governmental actors, alleged internal whistleblowers claimed that they were fired or retaliated against when they attempted to alert higher-ups within the corporation of the fraudulent activity.[footnote]Matt Egan, More Wells Fargo Workers Allege Retaliation for Whistleblowing, CNN (Nov. 7, 2017), http://money.cnn.com/2017/11/06/investing/wells-fargo-retaliation-whistleblower/index.html [https://perma.cc/RNF2-F7FT]. For Wells Fargo’s legal assessment of alleged retaliation against whistleblowers, see Indep. Dirs. of the Bd. of Wells Fargo & Co., Sales Practices Investigation Report 87 n.26 (2017), https://www08.wellsfargomedia.com/assets/pdf/about/investor-relations/presentations/2017/board-report.pdf [https://perma.cc/HT9K-TCHU] [hereinafter Wells Fargo Investigation Report].[/footnote] In early 2018, one such claim resulted in a $577,000 settlement and an order to rehire the employee.[footnote]C. Ryan Barber, Wells Fargo, Ending Its Appeal, Settles Whistleblower’s $577K Retaliation Case, Nat’l L.J. (Jan. 19, 2018), https://www.law.com/nationallawjournal/sites/nationallawjournal/2018/01/19/wells-fargo-ending-its-appeal-settles-whistleblowers-577k-retaliation-case/ (on file with the Columbia Law Review ).[/footnote] The significant failures throughout the organization’s ranks led to an unprecedented sanction from the Federal Reserve in February 2018, which restricts the bank’s ability to grow until it improves its internal governance and controls.[footnote]See Written Agreement Between Wells Fargo & Company and Board of Governors of the Federal Reserve System, supra note 4, at 8–9; Fed. Reserve Wells Fargo Press Release, supra note 4.[/footnote] And yet, Wells Fargo had structured its compliance program in line with what was expected under industry standards at the time. Indeed, as one scholar explained, “[A]t the time of its massive fake accounts scandal . . . Wells Fargo had a robust, [Organizational Sentencing] Guidelines-based compliance program with all of the ‘expected’ tools aimed at eliminating typical compliance lapses. Yet the company was unable to foresee, let alone prevent, an extreme compliance failure . . . .”[footnote]Todd Haugh, The Power Few of Corporate Compliance, 53 Ga. L. Rev. 129, 157 (2018) [hereinafter Haugh, Power Few] (footnote omitted).[/footnote] Likewise, General Motors failed to recognize and prevent an extreme compliance failure of a different sort, one that not only cost the organization billions of dollars, but also resulted in the deaths of at least 124 people.[footnote]Kirsten Korosec, Ten Times More Deaths Linked to Faulty Switch than GM First Reported, Fortune (Aug. 24, 2015), http://fortune.com/2015/08/24/feinberg-gm-faulty-ignition-switch/ (on file with the Columbia Law Review ); Eric D. Lawrence, GM Settles Deadly Ignition Switch Cases for $120 Million, USA Today (Oct. 20, 2017), https://www.usatoday.com/story/money/cars/2017/10/20/gm-settles-deadly-ignition-switch-cases-120-million/777831001/ [https://perma.cc/AFS8-CJ65].[/footnote] In 2014, General Motors announced a recall of over seventeen million vehicles worldwide, over eleven million of which cited issues of the ignition switch that would abruptly cause the car to lose power “when keys [were] accidentally bumped or moved out of the ‘Run’ position.”[footnote]Peter Valdes-Dapena & Tal Yellin, GM: Steps to a Recall Nightmare, CNN, https://money.cnn.com/infographic/pf/autos/gm-recall-timeline/index.html [https://perma.cc/4BWX-PUXY] (last visited Oct. 8, 2019).[/footnote] In instances where the switch failed and the car stalled, airbags would not deploy, creating the potential for serious injuries to both drivers and passengers.[footnote]Anton R. Valukas, Jenner & Block, Report to Board of Directors of General Motors Company Regarding Ignition Switch Recalls 1 (2014), https://www.aieg.com/wp-content/uploads/2014/08/Valukas-report-on-gm-redacted2.pdf [https://perma.cc/VB9L-5BHD].[/footnote] Notwithstanding this significant risk, the company chose not to fix the faulty switches, despite first receiving reports on the issue in 2004, and multiple reports thereafter.[footnote]Id. at 2–4.[/footnote] Indeed, when General Motors first analyzed the issue, it improperly classified the problem as a customer convenience issue instead of a safety issue, leading it to determine that it was simply too costly to make the necessary changes to the switch design.[footnote]Id. at 2; see also Valdes-Dapena & Yellin, supra note 11.[/footnote] And over the next number of years, the company continued to demonstrate a “lack of urgency, lack of ownership of the issue, lack of oversight, and lack of understanding of the consequences of the problem.”[footnote]Valukas, supra note 12, at 4, 9.[/footnote] This lack of urgency and oversight turned out to be exceptionally costly to General Motors, both in terms of its public reputation as well as its bottom line. In 2017, General Motors entered into a $120 million settlement with victims of its defective ignition switch scandal, a figure that came on top of roughly $2.5 billion worth of penalties imposed on the company.[footnote]Lawrence, supra note 10.[/footnote] These penalties included, for instance, a $900 million settlement with the DOJ in a criminal case, and multiple other settlements with accident victims.[footnote]Id.[/footnote] When organizations fail to properly address potential compliance failures, it presents a particularly problematic situation, because the responsibility for preventing and detecting misconduct within an organization lies primarily with the organization itself.[footnote]See U.S. Sentencing Guidelines Manual § 8B2.1 (U.S. Sentencing Comm’n 2004) (describing an “effective compliance and ethics program,” including due diligence, the promotion of ethical conduct, and compliance with the law); see also id. ch. 8, introductory cmt. (noting that the guidelines “provid[e] a structural foundation from which an organization may self-police its own conduct through an effective compliance and ethics program” (emphasis added)).[/footnote] An underlying assumption of all modern compliance efforts is that organizations are in the best position to monitor and police the behavior of their members.[footnote]Miriam Hechler Baer, Governing Corporate Compliance, 50 B.C. L. Rev. 949, 959 (2009).[/footnote] This understanding stems from past incidents of corporate misconduct and is uncontroversial. For instance, when the Enron and Arthur Andersen scandals broke in 2001, they sent a ripple effect across corporate America and triggered a variety of responses from Congress, regulators, and prosecutors.[footnote]Lawrence A. Cunningham, Deferred Prosecutions and Corporate Governance: An Integrated Approach to Investigation and Reform, 66 Fla. L. Rev. 1, 16–18 (2014).[/footnote] Legislation was passed.[footnote]See Sarbanes–Oxley Act of 2002, Pub. L. No. 107-204, § 302, 116 Stat. 745, 777–78 (codified at 15 U.S.C. § 7241 (2012)).[/footnote] Enforcement priorities shifted.[footnote]For example, within weeks of Arthur Andersen’s conviction for obstruction of justice, then-President George W. Bush formed the President’s Corporate Fraud Task Force within the Department of Justice. Compare United States v. Arthur Andersen, LLP, 374 F.3d 281, 284 (5th Cir. 2004) (noting that a guilty verdict was returned on June 15, 2002), rev’d, 544 U.S. 696, 708 (2005), with Exec. Order No. 13,271, 67 Fed. Reg. 46,091 (July 11, 2002) (establishing the task force to “investigate and prosecute significant financial crimes, recover the proceeds of such crimes, and ensure just and effective punishment of those who perpetrate financial crimes”). For more information on the Corporate Fraud Task Force, see The President’s Corporate Fraud Task Force, DOJ Archives, http://www.justice.gov/archive/dag/cftf/ [https://perma.cc/EKG4-VQYW] (last visited Oct. 9, 2019). Under then-President Barack Obama, the program shifted into the Interagency Financial Fraud Task Force. See Press Release, SEC, President Obama Establishes Interagency Financial Fraud Enforcement Task Force (Nov. 17, 2009), http://www.sec.gov/news/press/2009/2009-249.htm [https://perma.cc/NDN8-ATNR]; see also Cunningham, supra note 20, at 16–17 (outlining different changes to enforcement priorities as a result of Enron and other corporate scandals).[/footnote] And the manner in which corporate misconduct was settled and resolved changed dramatically.[footnote]See Brandon L. Garrett, The Public Interest in Corporate Settlements, 58 B.C. L. Rev. 1483, 1498–511 (2017) (surveying the use of supervised probation, deferred prosecution agreements, and nonprosecution agreements in addressing corporate misconduct and collecting relevant citations).[/footnote] The focus for corporations, regulators, and prosecutors shifted to “corporate compliance programs as the key to optimal deterrence.”[footnote]Cunningham, supra note 20, at 17.[/footnote] As compliance programs catapulted in importance, it led to the intensification of “internal policing of corporate employees.”[footnote]Id.[/footnote] And as organizations took on this responsibility of policing their employees in an effort to comply with ever-increasing regulatory and legal requirements, they began to focus on the structure—the separation of work in an organization into subunits and dividing the control of and responsibilities for the work—of the compliance programs they created.[footnote]See infra section I.B.[/footnote] Focusing on the structure of an organization’s compliance efforts was seen as essential to ensuring an effective and robust compliance and ethics program.[footnote]See infra section I.B.[/footnote] Determining the proper structure of compliance programs has been a question scholars, practitioners, prosecutors, and regulators have wrestled with for decades.[footnote]At a minimum, the question of how to structure a compliance program has been an issue since the 1991 passage of the original iteration of the Organizational Sentencing Guidelines, which is applicable to corporations, partnerships, unions, funds, trusts, nonprofits, and governmental entities. See Paula Desio, U.S. Sentencing Comm’n, An Overview of the Organizational Guidelines 2–3, https://www.hcca-info.org/Portals/0/PDFs/Resources/Conference_Handouts/Compliance_Institute/2006/707handout.pdf [https://perma.cc/R44R-2XGJ] (last visited Jan. 20, 2020).[/footnote] Should the compliance program be segmented into particular subject areas or should there be one global compliance program?[footnote]Walmart, for instance, segments its compliance department by subject area and then by geography. Jay T. Jorgensen & C. Kevin Marshall, Corruption and Compliance: Promoting Integrity in a Global Economy, 49 U.C. Davis L. Rev. 425, 431–33 (2015); see also Global Ethics & Compliance, Walmart, https://corporate.walmart.com/our-story/global-ethics-compliance [https://perma.cc/HZ52-WBU5] (last visited Oct. 9, 2019).[/footnote] Should the chief compliance officer report to the general counsel or the audit committee?[footnote]See Michael W. Peregrine, Seeking Clarity at the Crossroads of Legal and Compliance, Corp. Couns. (Sept. 18, 2014), https://s3-us-east-2.amazonaws.com/mwe.media/wp-content/uploads/2019/04/05161327/cc091814.pdf [https://perma.cc/GVG3-PY56].[/footnote] Should compliance professionals be embedded within particular departments or remain separate as a deterrent to capture?[footnote]See id.[/footnote] These and other foundational questions about how organizations should structure their compliance programs were necessary and important progressions for creating the compliance programs found within organizations today. Yet despite spending a great deal of time, effort, and money to enact structural reforms and improvements within organizations’ compliance programs, every year brings a new, more stunning example of how organizations’ attempts to reign in misconduct often fail to prevent even the most extensive compliance failures within industries and firms. The scandals at Wells Fargo and General Motors each reflect an intense failure by the organization to effectuate its monitoring and policing responsibilities despite the presence of compliance programs that were structured in a manner expected to effectuate an appropriate amount of monitoring and policing. There are a variety of accepted understandings—both within industry and academic scholarship—about what is necessary for the creation of an effective compliance program. However, when one considers the significant compliance failures that continue to occur despite the adoption of increasingly sophisticated internal compliance programs, it suggests that it may be time to affirmatively question certain understandings and assumptions that serve as the foundation of modern-day compliance programs.[footnote]This effort is at nascent stages but has begun. For example, Professor Todd Haugh has recently argued that compliance programs have suffered in effectiveness because they assume that compliance failures will fall within a normal distribution amongst one’s employees. In actuality, however, “[U]nethical employee conduct is just as likely to follow a skewed, or ‘fat-tailed,’ distribution.” Haugh, Power Few, supra note 9, at 135 (quoting Daniel A. Farber, Uncertainty, 99 Geo. L.J. 901, 923 (2011)).[/footnote] This Article contributes to that effort. Compliance programs within firms focus, for good reason, on preventing and detecting misconduct within their ranks. Those striving to create effective ethics and compliance programs spend a great deal of time on developing appropriate structures to house, manage, and support compliance efforts so that they will effectively prevent and detect wrongdoing within firms. But as demonstrated in prior work, prevention and detection are just the first two of four stages—the latter stages being investigation and remediation—within compliance efforts.[footnote]See Veronica Root, The Compliance Process, 94 Ind. L.J. 203, 219–27 (2019) [hereinafter Root, Compliance Process].[/footnote] This Article focuses on the detection and investigative stages and the continuum between them. It demonstrates that many recent compliance failures within organizations might have been avoided if more robust processes—meaning the actions, practices, and routines that firms can employ to communicate and analyze information—had been in place to ensure investigations were conducted in a manner that allowed the firm to analyze information from diverse areas within the firm. As such, this Article argues that firms must focus on adopting process-based reforms that will bolster internal investigations into complex compliance failures and act as a safety net when compliance programs fail to detect or appropriately respond to misconduct within firms. Part I of this Article describes why the effort to curb corporate criminal misconduct came to rely heavily on self-policing within the organization, which contributed to the rise of the compliance function. This Part goes on to demonstrate, through the use of literature from the fields of organizational behavior and corporate governance, the importance of implementing certain structures within the creation of compliance programs. For purposes of this Article, structure refers to a firm’s decisions on how to organize itself.[footnote]Tor Hernes, A Process Theory of Organization 69 (2014) (citing Stewart Ranson, Bob Hinings, and Royston Greenwood’s definition of organizational structure as “the social structures of relationships that reside in organizations”); see also Nicola Faith Sharpe, Process over Structure: An Organizational Behavior Approach to Improving Corporate Boards, 85 S. Cal. L. Rev. 261, 266–68 (2012). But see Hernes, supra, at 69–71 (arguing that the duality of process and structure is a fallacy).[/footnote] Part I then recounts current understandings of compliance within legal scholarship, which include an emphasis on the key structural components necessary for an effective compliance program and their focus on the prevention and detection of corporate misconduct. Part II focuses on the evolution of the compliance function. It demonstrates that traditional compliance programs were narrow in scope, with a focus on particular subject matter areas. Yet, the rise of more complex organizations—organizations with many diffuse departments or complicated organizational structures with a variety of parents and subsidiaries—brought new challenges for compliance efforts. A complex organization for purposes of this Article might be one organizational entity with a number of departments, such as a university, but it may also be a complicated corporate family with many subsidiaries, like Walmart. These larger, more complex organizations often suffer from information silos, which occur when departments or divisions within a large organization are isolated from other parts of the organization.[footnote]Cf. Richard E. Levy & Robert L. Glicksman, Agency-Specific Precedents, 89 Tex. L. Rev. 499, 510–14 (2011) (discussing effects of information silos on large government bureaucracies in administrative agencies).[/footnote] These information silos sometimes result in difficulty communicating properly throughout the organization and, in particular, can impede a firm’s attempts to fully and properly investigate claims of potential misconduct. Part III sets forth the thesis of this Article and argues that firms must focus on adopting process-based reforms that will bolster the firm’s investigations into complex compliance failures, thereby acting as a safety net when compliance programs fail to detect or appropriately respond to misconduct within firms. Part III begins by presenting two case studies, which demonstrate that recent compliance failures at complex organizations suggest that many of these compliance programs—regardless of the program’s organizational structure—suffer from information silos that result in improper or inadequate responses to significant organizational misconduct. Part III then highlights how process-based reforms might assist large, complex firms in detecting compliance failures before they become widespread, significant, or both. It applies specific process-based reforms to the compliance failures at Wells Fargo and General Motors in an effort to demonstrate how these types of additional interventions might add value to firm compliance programs. In particular, Part III suggests the creation of three interventions meant to bolster firms’ detection and investigative efforts: (i) standardized internal investigation questions, (ii) materiality surveys, and (iii) reliance upon an aggregation principles when evaluating information. Relying on two additional case studies, Part III then highlights two limitations to process-related reforms: organizations without robust structural compliance programs, as evidenced by investigations into the Catholic Church, and organizations with corrupt cultures, as evidenced by the internal Uber sexual harassment scandal. Part IV discusses some potential benefits raised by this Article’s proposed framework. The Article then turns to highlighting some remaining questions. This Article, admittedly, focuses on a relatively narrow area within compliance efforts—failures within the detection and investigative continuum of compliance efforts within complex organizations—but shortcomings in this space are associated with potentially devastating consequences for firms.