Multi-Industry Chief Compliance and Ethics Officers

Our company, GMI (formerly three firms: The Corporate Library, GovernanceMetrics, and Audit Integrity), specializes in governance risk.  We rate boards of directors like bonds, based on how effective they are in providing independent oversight.  Our analysis is both quantitative and qualitative and it is based on the actions and decisions of the board, not on their stated policies, classes taken, or what I call "resume independence."  Whether a director meets the loophole-ridden definition of independence embedded in SEC or exchange rules is not important.  Whether a director serves on the compensation committee that approved an atrocious pay plan or an audit committee that signed off on too many restatements is a far more powerful indicator of investment and liability risk than whether he or she has a connection to a supplier.  Our clients include director and officer liability insurers who use our ratings to help them determine coverage, law firms who use our data to help design settlements of shareholder suits, and shareholders who use our analysis in making portfolio and proxy voting decisions as well as audit firms, headhunters, academics, and journalists.  Every company is entitled to a free look at what we say about them at least once a year and a free unedited comment of any length to be included in our profile for any rebuttal or clarification they care to add.  We also issue frequent special reports on topics like severance packages and we are working with CalPERS and CalSTRS on developing a database of director candidates. 

I explain this as context for a discussion of what I will call board risk.  We've come a long way since my early years in this field when one public company had the CEO's father on the compensation committee, Disney's board had the CEO's lawyer, architect, and his kid's teacher, and O.J. Simpson served on five boards including one audit committee.  A director of General Motors told me that their board meetings consisted entirely of presentations with no time listed on the agenda for discussion or questions - and not one director challenged that.  The late Tom Horton, who served on many boards, used to say that the most important requirement for serving on a board was the ability to yawn with your mouth closed.

A series of disasters since then including the dot.com bubble, the Enron/WorldCom era collapses, the backdating of options, and the financial meltdown plus two massive new pieces of legislation have made boards better, more engaged, and more empowered.  I am especially proud that one of the reforms I proposed, regular executive session meetings of the outside directors without any company officers or employees in the room, has become widely adopted, along with the rise of the "lead director" to limit the CEO's ability to control the agenda and quality, quantity, and timing of the information provided to the directors.  But they can still do a lot better.  My recommendations include better lines of communication between the chairs of key committees (audit, risk, compensation, nomination) and large investors, more transparency about the criteria and procedures for director selection and evaluation, and adoption of a majority vote requirement for board service.

Shareholders are increasingly focusing on individual directors, with majority "no" or "withhold votes" increasing every year.  While legally the votes are not binding and a director can continue to serve with only a single vote in favor, I believe that insurers will be reluctant to provide coverage for a director who does not have the support of a majority of the shareholders.  Why should the courts extend the protection of the business judgment rule to a director the shareholders do not want on the board? 

Hi, Nell - Here's a suggestion for companies that want to improve the sharpness of their boards, and at the same time want to ensure their compliance and ethics program is effective.  Recruit for the board at least one sitting or former chief ethics and compliance officer (CECO) from another company. 

Of course, the CECO would have had to have been an actual compliance officer, not a junior person with a hollow title.   But think of the type of person who is a CECO.  The person has to be a quick learner and pay attention to detail. A CECO has to have nerves of steel and be willing to challenge even the most powerful officers.  And talk about someone who is not averse to addressing risk!  Dealing with risk is what our field does every day. 

As for the impact on the compliance program, I predict that any board that has an experienced CECO on it will never accept a one-page bland report on the program, or a simple assurance that all the risks are covered.  A report that just talked about the number of helpline calls and the number of employees trained would be met with a lot of tough questions about where the compliance audit reports were, why the officers weren't also trained, and how the company is addressing the new proposed privacy rules in the EU. 

In short, there is no silver bullet, but this would sure be a potent weapon. And it would also tell a company, that if it's own CECO was not being considered for another company's board, maybe having the CECO sit behind a little desk in the basement and reporting to  a junior manager was not the formula for success!