What you'll learn on this podcast episode
Amid the escalating severity and frequency of new risks worldwide, Ethics and Compliance (E&C) initiatives are doubling down on efforts to mitigate these risks. This critical focus is underscored in LRN's latest 2024 Ethics & Compliance Program Effectiveness Report, which draws insights from over 1,400 E&C professionals globally. Our findings reveal that values-driven programs not only prove most effective but also exhibit a robust correlation with risk reduction and enhanced business outcomes. In light of this evolving risk landscape, how are E&C programs in regions such as the Middle East adapting? Furthermore, what do the everyday practices of global best standards entail for programs operating within this region?
In this episode of the Principled Podcast, host Eric Morehead, is joined by Elvis Angyiembe, the co-founder of the Middle East and Africa Compliance Association—or MEACA. Elvis joined us last season to discuss what the E&C priorities are for companies in the Middle East. Today, they discuss key findings from the global edition of the 2024 Ethics & Compliance Program Effectiveness Report and how they apply to programs in that region.
Get a copy of the Global edition of LRN's 2024 Ethics & Compliance Program Effectiveness Report.
Where to stream
Be sure to subscribe to the Principled Podcast wherever you get your podcasts.
Guest: Elvis Angyiembe
Elvis Angyiembe is co-founder and co-chair of the Middle East and Africa Compliance Association (MEACA). He has significant experience working for multinational companies helping them manage significant legal and compliance matters. He has supported three companies under deferred prosecution agreements with the US Department of Justice. He has lived in Cameroon, Germany, US, South Africa, and currently in Dubai. He holds a Juris Doctorate (JD) from Thurgood Marshall School of Law in Houston, Texas and a bachelor's degree in criminology from the University of Maryland in College Park, Maryland.
Host: Eric Morehead
Eric Morehead is a member of LRN’s Advisory Services team and has over 20 years’ experience working with organizations seeking to address compliance issues and build effective compliance and ethics programs. Eric conducts program assessments and examines specific compliance risks, he drafts compliance policies and codes of conduct, works with organizations to build and improve their compliance processes and tools, and provides live training for Boards of Directors, executives, managers and employees.
Eric ran his own consultancy for six years where he advised clients on compliance program enhancements and assisted in creating effective compliance solutions.
Eric was formally the Head of Advisory Services for NYSE Governance Services, a leading compliance training organization, where he was responsible for all aspects of NYSE Governance Services’ compliance consulting arm.
Prior to joining NYSE, Eric was an Assistant General Counsel of the United States Sentencing Commission in Washington, DC. Eric served as the chair of the policy team that amended the Organizational Sentencing Guidelines in 2010.
Eric also spent nearly a decade as a litigation attorney in Houston, Texas where he focused on white-collar and regulatory cases and represented clients at trial and before various agencies including SEC, OSHA and CFTC.
Principled Podcast transcription
Intro: Welcome to the Principled Podcast, brought to you by LRN. The Principled Podcast brings together the collective wisdom on ethics, business and compliance, transformative stories of leadership and inspiring workplace culture. Listen in to discover valuable strategies from our community of business leaders and workplace change makers.
Eric Morehead: Amid escalating severity and frequency of new risks worldwide, ethics and compliance initiatives are doubling down on efforts to mitigate these risks. This critical focus is underscored in LRN's latest 2024 Ethics and Compliance Program Effectiveness Report, which draws insights from over 1400 E&C professionals globally. Our findings reveal that values-driven programs not only prove most effective, but also exhibit a robust correlation with risk reduction and enhanced business outcomes.
In light of this evolving risk landscape, how are E&C programs and regions such as the Middle East adapting? Furthermore, what do the everyday practices of global best standards entail for programs operating within this region?
Hello and welcome to LRN's Principled Podcast. I'm your host, Eric Morehead, Director Advisory Service Solutions at LRN. Today I'm joined by Elvis Angyiembe, the co-founder of the Middle East and Africa Compliance Association or MEACA. We had the pleasure of speaking with Elvis last season about what the E&C priorities for companies in the Middle East might be. Today we're going to discuss key findings from the global edition of the 2024 Ethics and Compliance Program Effectiveness Report, and how they apply to programs in that region.
Elvis, thanks for joining me on the Principled Podcast.
Elvis Angyiembe: Eric, thank you so much for having me. I'm glad to be back.
Eric Morehead: And can you start by telling our listeners a little bit about MEACA and your role in the organization?
Elvis Angyiembe: Thank you, Eric. So MEACA is a non-for-profit legal and compliance association in Dubai. I co-founded MEACA about two years ago, and our aim is really to engage the legal and compliance community on compliance topics. So we provide networking opportunities for compliance professionals and for me, Eric, most importantly, we provide mentorship to up-and-coming compliance professionals. And we recently signed an MOU with the Middlesex University here in Dubai to collaborate with them on various compliance initiatives.
We also partner with industry groups to organize events. And as you already know, we did an event, a very successful event with LRN last year and we're looking forward to doing more events with LRN. We are looking at some partnerships in Saudi Arabia, in Cameroon, in Mauritius, and we just recently did a conference, an anti-corruption conference, which is our first anti-corruption conference in Nairobi, Kenya just last month. So MEACA is doing a lot of things and I think the future is bright for us.
Eric Morehead: Yes, I had the pleasure of attending that event in Dubai that you're mentioning that was co-hosted with LRN. And it was really, really exciting to see all the interest and kind of exuberance, even really around having a discussion around compliance and ethics with many, many local professionals that are responsible for compliance. I hesitate to say compliance officers because I think it's an evolving position where people might have multiple hats that they still need to wear in some organizations that were represented there, but it was really gratifying to see all the interest.
Elvis Angyiembe: Sure. I think it was a great event and I think that hopefully we can have more events like that in the future.
Eric Morehead: Turning our attention to the new report, a prominent finding that we've seen globally is the significant emphasis on risk mitigation within effective E&C programs. Global programs seem to be prioritizing risk mitigation and analysis as crucial areas for enhancement and evaluating their programs impact. Considering your experience with programs in the Middle East, I'm curious to know if this focus on risk resonated with you?
Elvis Angyiembe: Absolutely, absolutely. I mean, the insights from the report do resonate with me and they make sense. I think this is just fundamental to what we do as compliance professionals or what we do in compliance. Our role is to help companies manage risk. And there's no way that you can manage risk if you don't know what your risk is.
And Eric, if you bear in mind that you can never get risk with 0% and if you bear in mind that companies don't have infinite resources, risk mitigation becomes a lot more important, right? Because this is how you understand your entire risk profile so you can make an informed decision on where to focus your time and your limited resources.
And what I hear from companies now in the region is that there's an increased focus on risk surveillance. What does that mean? This means that companies are engaged in activities where they are constantly, constantly on an ongoing basis surveilling their business to see where there could be some risk that they're not aware of. Because you don't want to wait until that big case happens before you understand that you had risk in the business on a particular operation somewhere and you have to be more proactive. Especially in a region like this, we really need to make sure that people stay on top of the risk.
And the reality, Eric, is that we are not risk exterminators. We are risk mitigators. In order for you to mitigate risk, risk is something that's inherent in business dealings. You cannot conduct business with that risk. We just have to be aware of that risk and be able to mitigate it.
Eric Morehead: I like that distinction and I think that also should resonate more with the business too, that the compliance apparatus is not the only part of the organization that's so responsible for risk. You can help mitigate it, but the business also needs to be focused on risk too and how to identify and isolate and mitigate it as well. You're not a specialist that's going to come in and take care of everything. It's a team sport, if you will.
A core principle of E&C programs that also comes through in the data in the PEI report is that values, and this is a topic that LRN has really focused on since its inception, that values are the primary driver of ethical conduct, not rules. This concept is again, something that I hope at least from my perception, has gained traction over the years, even beyond LRN. And according to our data, 77% of E&C professionals that responded indicate that their organizations prioritize values over rules to inspire ethical behavior.
This is a notable increase of 27 percentage points since LRN initially posed this question almost 10 years ago, back in 2026. I'm interested in hearing your perspective on this shift, focusing more on values rather than a rule-based system.
Elvis Angyiembe: Thank you, Eric. I think this is a very good reflection and it's a very good development to see 77% of professionals saying that the organizations are moving more towards value-based. I think that's very good. Like you mentioned that it's all about culture, right? And cultures are built on values. So for you to build a strong compliance or integrity culture at the company, it has to be based on some values and not on rules. Because you can have the best policies, procedures, tools, but if there are no values that help employees make the right decisions, you're likely not going to get anywhere with your compliance program despite how much you invest.
So if people are doing something just because it's just a rule, more likely than not, it will not help. So they have to be doing something because they know in their heart that is the right thing to do.
One of the most famous compliance quotes that I really liked is where they say "Compliance is what you do when no one is watching." And that's about values. That's about values. So we as humans have our own values that we bring to the workplace, and companies have to help us manage that by having the right values as well so they can help people make the right decisions.
Eric Morehead: I think that's again, something that LRN in particular has been focused on for years, but I'm glad to see the numbers in our research going in that direction, that perception is taking hold.
And while that's a good trend, not all of our findings in the recent research paint a totally positive picture. There are areas that require some enhancement, and one area is the growing disparity between leadership and middle management and effectively implementing E&C practices. There's this gap that we've noted before, but it's continuing to exist between what senior management expectations and their direction might be for compliance and what we see in the middle.
And currently there's a 37% point gap between leaders and managers who rely on organizational values to navigate challenging decisions. So the query is just what we were talking about is, do you rely on your values when you're making a difficult decision?
This is the widest gap that we've seen since we started gathering data on this particular point. And I'm curious what your reaction was to that. Were you surprised by that? And what are your thoughts on some strategies that E&C leaders in the Middle East might bring to bear to address that issue?
Elvis Angyiembe: So Eric, I think this is one of those that really surprised me. I would say it surprised me and then it didn't surprise me. So I'll tell you why it surprised me. It surprised me because it should not be the case because we're talking about the so-called tone from the top and tone from the middle. And what we're hearing from here is the tone from the top is getting better because the tone from the top believes in values and the tone from the middle is not necessarily binding to that. So that's kind of a surprising to me. And it's surprising because we probably see nowadays that most of the misconduct happens at the middle level, not necessarily at the top.
So these are the sort of managers that should be doing the role modeling because they're the ones that have a lot of people reporting to them, and if they do the wrong thing, others would just follow them. Right? And that's what you're hearing now from authorities saying that tone from the middle is even more important than tone from the top.
So if you go a couple of level down from tone from the top, we can, where I say in a lot of companies here in the middle and other regions where you're hearing companies saying once they look at the case dockets and they see where the misconduct is happening, it's happening at the middle level. That's why I say this surprises me because it should not be the case. And if we are not making progress as a profession in that regard, that middle managers buy into the idea that values is more important than rules, that they are not just waiting for somebody to tell them what to do, but that they're doing things because they believe that it's in line with the values, then I think we have some work to do.
And I will say, again, it didn't ... I said didn't surprised me. It didn't surprise me. It didn't surprise me because again, I'm really hearing from folks on the ground as they're doing their own risk assessments, that they're seeing a lot of misconduct at this level, and there's really some focus from companies how they can address this issue at the middle management level.
And what we are seeing, Eric, is that companies are doing a lot more targeted trainings at this employee levels below the top level. We've seen where companies are trying to engage this middle level more by getting them to take more accountability for compliance and E&C program, examples of where you are having these middle managers themselves deliver compliance trainings so that they can show the right example to people they are leading and also really teaching them how to fish and not keep giving them the fish, because if you teach them how to fish, then now they own it and then now they can just run the program themselves and help you manage the risk.
Because look, I've said this in other opportunities that I've had, is I think we as E&C professionals, our job really is to try to empower the business to be able to manage this and not just rely on us telling them what to do. And this is the whole concept of teaching them how to fish and not just giving them fish.
Eric Morehead: I really like that idea and I think it's borne out not only in the data that we see in reports like PEI, but as you mentioned at the top of your answer, when we see failures and misconduct happen, it's not always at the top of the organization, which I think is kind of traditionally what the perception has been. It's happening in the middle where there's so much more going on. And so that's where the danger is, that's where the risk is, is right there in the middle.
And so focusing a little more time and effort on arming those leaders so that they know what to do, even if you have the most best well-funded compliance program in the world, you can't be everywhere. You're not going to be in every transaction, every situation. And so if those leaders that are involved in that are armed and have the right tools, then that's going to be the success.
Focusing a little while longer on some of the less positive results that we saw in the data, one area that also spiked a little bit this year globally, not just in the Middle East, is around sanctions and controls. Even though we're seeing on the global risk landscape a more focus on sanctions and controls, only 38% of the respondents to our survey suggested that they had strengthened their risk controls. And this is despite everything that's happening that we see in the headlines every day with what's going on in the Ukraine, current issues in the Middle East.
Does this surprise you that there's this lack of focus on risk around sanctions and controls? And do you have an opinion about why that might be?
Elvis Angyiembe: Well, I mean, this is an interesting one as well, right? And Eric, what I would say is sanction controls and trade continues to be a huge risk in the region, and it's for a couple of reasons, including the fact that places like the UAE and other countries are in close proximity to a lot of these countries that are under sanctions, at least the ones on this part of the world. So there's just an inherent risk that if you're doing business in this region, there's a higher probability that you can be involved in a transaction that can implicate sanctions. So just that geographical location itself creates that risk. So it's always going to be a risk.
The next piece about it is just the general lack of awareness because a lot of the companies that are operating here are not necessarily US companies, for example, or not necessarily European companies that are subject to the sort of sanctions that are coming from the US and the EU. So they just feel like, okay, they don't really have to worry about it.
But they have to increase their level of awareness because depending on what products they are selling, if the products have any sort of US origin, then they are subject to the sanctions. And I don't think that a lot of companies that operating here have really done that sort of analysis. Even if they're just a distributor and they're buying products, they should be aware whether some of those products have US or European origin parts or technology that would subject them to sanctions.
I think that's part of it, just the geographical proximity itself and just the general lack of awareness, not because I guess people don't want to be aware, but just a lot of them are not subject to US laws and they've not really thought about whether they should dig deeper in whether they're subject to US laws or not.
But the reality is, and I was speaking to some folks working for the US government here in the UAE, they are trying their best to raise awareness amongst companies here in the UAE, so people understand that even if they're not US companies, they could be subject to the sanctions and that they need to do something about it. Because I would imagine that as a regulatory body, US sanctions authorities, their goal is not just to sanction people. I think they want to increase awareness as well. So I think even at MEACA, we're trying to put up an event with folks that are working on US sanctions here to see how we can continue to risk awareness.
So I think as awareness is going to increase, we are going to see people take this risk more seriously because they might think that they're not of subject sanctions where they are. Certain topics like anti-bribery and corruption, anti-money laundering and data privacy are really taken very, very seriously. Trade and sanction controls is something that should also come to the fore.
Eric Morehead: It follows kind of the same pattern, right, as that there's the extraterritorial jurisdiction of the United States it kind of looms large in a lot of these areas, and once that's recognized, that creates a little bit of incentive to at least put some more attention to it.
One other area that is highlighted in the report, and that Elvis you particularly noted, and it's also an area that's near and dear to me too, is incentives and disincentives for ethical conduct. I think kind of historically as compliance officers, we understand or have been involved in disincentives for a long time. Incentives are a little bit more difficult to put your finger on, but the report does present a couple of data points addressing the matter.
More than 60% of E&C professionals that responded indicated that their organizations have integrated ethical behavior into performance systems. So that's their way of incentivizing. Also in hiring decisions, promotions, bonus structures, so where they can measure for the purposes of incentivizing ethical performance, that's how they're integrating it. And 61% of respondents stated that their organization includes provisions for the clawback of bonuses, incentives and compensation. So let the company giveth, the company can taketh away.
I'm curious what aspects of this data and these findings around incentives and disincentives caught your attention and wanted to get your thoughts on this area?
Elvis Angyiembe: It is an interesting topic, Eric like you mentioned. The topic of incentivizing employees to be compliant has been one of those topics that I've heard about. You go to every compliance conference and there's this discussion about it.
So on the one hand, there's the argument that you should not be paying somebody or incentivizing somebody to do the right thing because you just expect them to do the right thing. The code of conduct says you should not do something and then they should just not do it. You don't have to pay them.
So I think the discussion is really evolving now in terms of what can we really do? And I think the discussion is evolving because there's some regulatory authorities' expectation in terms of what needs to be done. I mean, you're aware already that regulatory authorities have whistleblower programs where they incentivize people for reporting misconduct and things like that. Should companies also have similar? So I think it's a very, very interesting conversation that is still happening. There's probably really a balance that can be struck.
So what I'm seeing really is to your point, and the 60% doesn't surprise me because when I speak to folks in businesses here in the region, these discussions are happening where if you take an example of an employee who is to be promoted into a manager position, I don't think that a lot of companies in the past have really been looking at, do we have any complaints against this person? What are the reviews against this person? Have they been involved in some misconduct before? Because if you don't do that, then you're just promoting somebody and putting them into a position of power where they just have a lot more opportunity to do misconduct.
So I think the discussions should really be around the way you're being very, very strategic to say, how are you promoting people? How are you putting people into positions of authority? What sort of track record do they have? We are not just thinking about technical skills, we're also thinking about soft skills with values and integrity being one of those soft skills and getting feedback.
One of the easiest ways to do that is to call the E&C department and say, "We are trying to promote B into this regional role."
Eric Morehead: What have you heard?
Elvis Angyiembe: "Please, can you let me know if you've heard anything?" And there's times where you're going to be like, "Oh, wow, we have six cases against them." Even if they have not been proven, like we said, where there smoke, there's fire, right?
Eric Morehead: Yes.
Elvis Angyiembe: So I think this is a very, very interesting conversation in terms of how you then really embed E&C into this sort of decision making to make sure that at least if there's risk somewhere that is one individual that has a propensity to do some bad stuff, that we don't continue to promote them and keep them within the company.
I think a lot of this, that's how you incentivize it or ... So in that way, the people that you put in these positions are the ones that have not been involved in misconduct, so they're doing the right thing. So you consider that as part of the promotion decision. And obviously if somebody has been involved in bad stuff, you don't really reward them for that because it just sets the wrong tone.
Now, you can think about how do you do people's performance evaluations? What sort of targets do you set for them? You set targets where a manager is required to do some compliance training or is required to make sure that the employees report issues, something that can make them see that if they do the right thing, that maybe 10% of their bonus is based on that. So I think we're seeing a lot of that.
On the topic of clawback, when you try to dis-intensify noncompliance is becoming more and more common now that you're seeing clawback clauses inserted into contracts of senior management. We're talking about the tone from the top where there's leaders that a lot of that compensation depends on bonuses or the volume of sales that they make. And if you put a clawback in there, it obligates them for a long period of time to make sure that they have to stay clean. So if they win a huge contract and then they get a bonus for it, and then you find out two years down the road that they did something improper to win that huge contract, you have to have the ability to go back and take that money from them. So hopefully what that does there now is that it really keeps people on their toes to make sure that they're doing the right thing because even after they've received some money, there's a possibility that they can still lose it.
Eric Morehead: Yeah, it keeps their mind focused. I think we're seeing that globally, but I'm gratified to hear that that's something you're seeing there in the Middle East operating as well.
This year, this 2024 report marks 10 years that LRN has been conducting the program effectiveness reporting. And we've talked about a lot of the themes that we've seen not only in this year's report, but we've seen over that decade, addressing risk, talking about values, operationalizing E&C incentives.
I'm curious, looking ahead, what specific advancements do you envision E&C programs addressing in the coming year or even over the next few years? What's right on the horizon for us and what do you see on the horizon and the Middle East in particular?
Elvis Angyiembe: What I see on the horizon is the use of data. I think data is very, very important and companies have to really develop the ability to use data to be able to make informed decisions.
I think once we get there, then you're running an E&C program that is proactive, not reactive. Because you want to be able to catch the misconduct before it happens, right?
Eric Morehead: Yeah.
Elvis Angyiembe: So right now, a lot of the E&C programs that we have are reactive because you find a massive misconduct somewhere and then you go investigate and then you have to put controls in place and make sure it doesn't happen again. How do we get to a point where we actually catch those things before they happen? So I think on the horizon should really be how we can use all the data available to us within the company. So having tools where platforms or tools that speak to every little aspect of the company. So you can speak to HR data, to internal controls, to audit. So all that data can get into maybe a data lake or something where you're catching red flags before transactions actually happen.
I think that's a natural progression of the EN&C program. I think that's the expectation of the authorities as well. As you're aware, I think the DOJ also have their own data analytics team, and the expectation is that companies need to build that as well. So that's what I would expect to see within the next couple of years.
Eric Morehead: No, I think that's certainly something that I hear a lot about. And sort of like incentives, it's not well-defined, but the expectation is still there, whether it's well-defined or not.
Elvis, thank you so much for sharing your insights on the report and your perspectives about ethics compliance programs in the Middle East. It's been great having you on the podcast, and I hope you'll come back and speak with us again.
Elvis Angyiembe: Thank you, Eric. I'll be very happy to come back. So thank you.
Eric Morehead: My name is Eric Morehead and I want to thank all of you for tuning in to the Principled Podcast by LRN.
Outro: We hope you enjoyed this episode. The Principled Podcast is brought to you by LRN. At LRN, our mission is to inspire principled performance in global organizations by helping them foster winning ethical cultures rooted in sustainable values. Please visit us at lrn.com to learn more. And if you enjoyed this episode, subscribe to our podcasts on Apple Podcasts, Stitcher, Google Podcasts, or wherever you listen. And don't forget to leave us a review.
Be sure to subscribe to the Principled Podcast wherever you get your podcasts.
